@wjarka/cezarion 0.15.1 → 0.16.0

package/dist/workflows/run.js

@@ -1,16 +1,21 @@
+import { workerEvidenceRunIds } from '../runs/worker-execution.js';
 import { ciErrorMessage } from '../ci-wait/errors.js';
-import { ciWaitRequestSchema, ciWaitResultSchema } from '../contract/index.js';
+import { ciWaitRequestSchema, ciWaitResultSchema, previewStopRequestSchema, previewServeRequestSchema } from '../contract/index.js';
+import { previewToolEnabled } from '../ci-wait/tools.js';
+import { previewStopResult, previewResult, validateRegistration } from '../preview/registration.js';
 import { acquireCiResources } from '../ci-wait/resources.js';
 import { artifactInstructions, provisionArtifactDirectory } from '../artifacts/lifecycle.js';
 import { workerContextHash, workerWorkflowHash, workerStepIdentity, captureWorkerAccount, boundWorkerAccountEnv, WorkerIdentityError } from '../delegation/execution-identity.js';
 import { buildChildEnv } from '../core/agent-env.js';
 import { randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { parseAskMarkerResult, stripAskMarker, } from '../core/ask.js';
 import { hasRegisteredRunProcess, onUsage, registerRunProcess, unregisterRunProcess } from '../core/process-usage.js';
-import { inspectGeneration, isCurrentProcess, processStartToken, recordedProcessLive } from '../delegation/process-liveness.js';
+import { processGroupAlive, processGroupOf, sessionGroupOf, signalProcessGroup } from '../core/session-process.js';
+import { WorkerScratchCleanup } from '../delegation/scratch-cleanup.js';
+import { noJitter, ORPHAN_BACKOFF, retryDelayMs } from '../delegation/retry-backoff.js';
+import { inspectExecutionGeneration, isCurrentProcess, processesWithCwdUnder, processStartToken, recordedGroupSignalable, recordedProcessLive, sharedCwdScan } from '../delegation/process-liveness.js';
 import { parseUsageLimit } from '../core/usage-limit.js';
 import { startManagedSession } from '../core/managed-session.js';
 import { createRunner } from '../core/runner-factory.js';
@@ -23,14 +28,16 @@ import { todosPath } from '../todos.js';
 // Contract VALUES, like `workspaceUiStateSchema` in workspace/migrations.ts: the attachment
 // vocabulary the routes validate with is the same one the engine stores and re-reads by, so the
 // wire and the disk can never disagree about what counts as an image (#950).
-import { requestWaitRequestSchema, workerWaitRequestSchema, attachmentExtension, delegationStateSchema, pendingHumanAsk, askRequestSchema, isImageAttachmentName, isImageMediaType, } from '../contract/index.js';
+import { requestWaitRequestSchema, workerWaitRequestSchema, attachmentExtension, delegationStateSchema, askRequestSchema, isImageAttachmentName, isImageMediaType, } from '../contract/index.js';
 import { inputDeliveryOf } from '../core/agent-runner.js';
 import { discoverSkills } from '../skills.js';
-import { materializeSkillDir } from '../skills-remote.js';
+import { materializeSkillDir, waitForCachedTeamSkills, waitForTeamSkills } from '../skills-remote.js';
 import { seedAgentConfigLocalLayer } from '../agent-config/seed.js';
 import { readAgentModelSettings, readAgentModelProvider } from '../agent-config/models.js';
 import { loadConfig, resolveWorktreeRetention } from '../config.js';
 import { autosaveCommit, createWorktree, resolveBaseRef, worktreeDiff, worktreeShortstat } from '../git-worktree.js';
+import { runGroupedCommand } from './grouped-command.js';
+import { resolveWorktreeSetup, runWorktreeSetup, worktreeSetupAgentNote, worktreeSetupEndNote, worktreeSetupEnv, worktreeSetupRecordError, worktreeSetupStartNote, } from '../worktree-setup.js';
 import { getHeadCommit, getRepoInfo } from '../server/git.js';
 import { ensureOwnedWorkspace, verifyOwnedWorkspace } from '../delegation/workspace.js';
 import { verifyWorkerContext } from '../delegation/context.js';
@@ -43,8 +50,9 @@ import { parentReadiness } from '../delegation/readiness.js';
 import { answersQuestion, openQuestions, questionMessage } from '../delegation/questions.js';
 import { workerOutcome } from '../runs/delegation-state.js';
 import { loadWorkflows } from './load.js';
+import { RUN_IN_USE_ELSEWHERE } from '../runs/store.js';
 import { isReclaimable, reclaimWorktrees, rematerializeReclaimedWorktree } from '../runs/retention.js';
-import { AgentTempDirError, agentTmpEnv, agentTmpDirLocations, removeAgentTmpDir, sweepAgentTmpDirs, } from '../runs/agent-tmpdir.js';
+import { AgentTempDirError, agentTmpEnv, agentTmpDirLocationEvidence, removeAgentTmpDir, } from '../runs/agent-tmpdir.js';
 import { extractTaskRefs, refineTaskRefs, titleRefNumber } from '../runs/task-refs.js';
 import { parseTaskMarkers, stripTaskMarkers } from '../runs/task-markers.js';
 import { autoNamingActive, generateRunName, liveTitleUpdatesEnabled, postValidateTitle } from '../runs/auto-name.js';
@@ -61,24 +69,81 @@ async function configuredModelProvider(backend, repoRoot) {
 /** An interactive session that hears nothing from the user closes itself. */
 export const IDLE_TIMEOUT_MS = 15 * 60_000;
 /**
- * Task-completion marker from the agent contract (HANDOFF_INSTRUCTIONS): a
- * turn whose text ends with `CEZ:DONE` means "goal achieved, nothing to ask" —
+ * Task-completion marker from the agent contract (HANDOFF_INSTRUCTIONS):
+ * an active `CEZ:DONE` declaration means "goal achieved, nothing to ask" —
  * the session is closed right away instead of parking at `waiting` (#347).
  * Detection runs on the accumulated turn text so delta-streaming backends
  * (codex, opencode) can't split the marker across text events.
  */
-const DONE_MARKER_RE = /CEZ:DONE\s*$/;
-/**
- * Still-working marker from the agent contract (spec
- * 2026-07-18-subagent-monitoring-status, #490): a turn whose text ends with
- * `CEZ:MONITORING` means "I ended this turn but I'm still working on my own
- * downstream work (a sub-agent / a command I'm monitoring), not waiting on the
- * user" — cezar parks it as `running`/`activity:'monitoring'` instead of
- * `waiting`, so the cockpit shows a non-attention state. `CEZ:DONE` wins if both
- * appear. Detected on accumulated turn text (like `CEZ:DONE`) so delta-streaming
- * backends can't split the marker across text events.
- */
-const MONITORING_MARKER_RE = /CEZ:MONITORING\s*$/;
+import { PROSE_HUMAN_GATE, workerOutcomeKey } from '../runs/transcript-facts.js';
+/** Classify only active prose: quoted/indented examples and fenced code cannot
+ * declare a park or request a human. A standalone monitoring line belongs to
+ * this turn even when a later assistant block acknowledges a new instruction. */
+function turnParkSignals(text) {
+    let fence;
+    let monitoring = false;
+    let humanGate = false;
+    let done = false;
+    let askResult = { kind: 'none' };
+    let previous = '';
+    for (const raw of text.split('\n')) {
+        const delimiter = raw.match(/^ {0,3}(`{3,}|~{3,})/);
+        if (delimiter) {
+            previous = ''; // a fenced example consumes its heading, not the next declaration
+            const token = delimiter[1];
+            if (!fence)
+                fence = { char: token[0], length: token.length };
+            else if (token[0] === fence.char && token.length >= fence.length)
+                fence = undefined;
+            continue;
+        }
+        if (fence)
+            continue;
+        if (/^(?: {4}|\t|\s*>)/.test(raw)) {
+            if (raw.trim())
+                previous = '';
+            continue;
+        }
+        // Lists and emphasis format active prose; they do not quote it. Exclude
+        // fenced/indented/blockquote examples before removing their decoration.
+        const line = raw.trim().replace(/^(?:[-+*]|\d+[.)])\s+(?:\[[ xX]\]\s+)?/, '')
+            .replace(/^#{1,6}\s+/, '').replace(/\*{1,2}|_{1,2}/g, '');
+        if (!line)
+            continue;
+        const example = /\b(?:example|sample|literal|quoted)(?: marker)?\s*:\s*$/i.test(previous);
+        if (!example && raw.trim() === 'CEZ:MONITORING') {
+            monitoring = true;
+            humanGate = false; // a later declaration supersedes earlier, resolved prose
+            done = false;
+        }
+        if (!example && raw.trim() === 'CEZ:DONE') {
+            done = true;
+            humanGate = false;
+            askResult = { kind: 'none' }; // retain the existing later-DONE precedence
+        }
+        // Preserve the existing payload validation/repair and latest malformed
+        // marker diagnostics. Only active declarations participate: an ACK after
+        // a real ASK must not erase its card, nor turn examples into questions.
+        const candidate = example ? { kind: 'none' } : parseAskMarkerResult(raw);
+        if (candidate.kind !== 'none') {
+            askResult = candidate;
+            done = false;
+        }
+        // Deliberately require a direct question/request, not words like "review",
+        // "checks" or "approval" in progress reports (hearsay-tools/cezarion#772 and hearsay-tools/cezarion#609).
+        const prose = line.replace(/`[^`]*`|"[^"]*"/g, '');
+        if (!example && prose.split(/(?<=[.!?])\s+/).some(sentence => /^(?:(?:should|shall|can|may) I\b|(?:do|would|could|can|will|are) you\b).*\?\s*$/i.test(sentence) ||
+            /^(?:which|what|how|where|when|who)\b.*\b(?:you|(?:should|shall|can|may) (?:I|we))\b.*\?\s*$/i.test(sentence) ||
+            /^(?:which|what) (?:module|option|approach|strategy|framework|library)\?\s*$/i.test(sentence) ||
+            /^(?:is|are) (?:this|these|that|it)\b.*\b(?:ok(?:ay)?|acceptable|approved)\?\s*$/i.test(sentence) ||
+            /^(?:please\s+(?:review|approve|confirm|choose|decide|answer|select|provide)\b|(?:I(?:['’]m| am)?\s+)?(?:need|awaiting|waiting for)\s+your\s+(?:review|approval|confirmation|answer|decision|input|permission)\b|(?:the )?PR (?:is )?ready for (?:your )?review\b)/i.test(sentence))) {
+            humanGate = true;
+            done = false;
+        }
+        previous = line;
+    }
+    return { monitoring, humanGate, done, askResult };
+}
 /** Claude's native scheduler is the backend-level equivalent of the textual
  * monitoring marker. Keep this recognition here, at the workflow boundary,
  * so the v1 event protocol stays unchanged and other backends do not acquire
@@ -117,6 +182,17 @@ function appendCompletedAssistantText(current, event) {
     }
     return appendTurnText(current, event.item.text);
 }
+/** Last top-level completed item: a non-empty assistant message is a visible tail; reasoning or a tool is silent even after earlier visible text (#544). An empty turn stays `none` and never nudges. */
+export function trackTurnTail(tail, event) {
+    if (event.type !== 'item.completed' || event.item.parentItemId !== undefined)
+        return tail;
+    const item = event.item;
+    if (item.kind === 'message' && item.role === 'assistant' && item.text.trim() !== '')
+        return 'visible';
+    if (item.kind === 'reasoning' || item.kind === 'tool')
+        return 'silent';
+    return tail;
+}
 /** Strip a trailing marker from one text event so transcripts stay free of
  *  protocol noise. Delta backends may split the marker across events — then
  *  it stays visible; detection above is unaffected. */
@@ -166,15 +242,14 @@ function askMarkerRecovery(result) {
  * they are hand-duplicated, and `AGENTS.md` warns that a lifecycle change
  * applied to only one of them ships half a fix — the notes and their tones are
  * exactly that kind of change. `enabled` is the caller's own precondition (the
- * session is open, the turn is not a `CEZ:DONE`, and for an agent step, the run
- * is interactive); when false there is no marker to look for. */
-function resolveAskTurn(turnText, completedAssistantText, enabled) {
+ * session is open and the turn is not a terminating `CEZ:DONE`); when false
+ * there is no marker to look for. Intermediate steps can ask too (#427). */
+function resolveAskTurn(v1Result, v2Result, enabled) {
     if (!enabled)
         return { ask: null, notes: [] };
-    const v1Result = parseAskMarkerResult(turnText);
-    // v1 is authoritative whenever it carries an ASK marker. Claude can omit
-    // the trailing marker from v1 while v2 retains the complete message.
-    const result = v1Result.kind === 'none' ? parseAskMarkerResult(completedAssistantText) : v1Result;
+    // For unreconciled channels, v1 remains authoritative when it carries an
+    // ASK; a marker absent from v1 can still come from the complete v2 message.
+    const result = v1Result.kind === 'none' ? v2Result : v1Result;
     const notes = [];
     const rejection = askMarkerRejection(result);
     if (rejection)
@@ -184,11 +259,57 @@ function resolveAskTurn(turnText, completedAssistantText, enabled) {
         notes.push({ message: recovery, tone: 'danger' });
     return { ask: result.kind === 'valid' ? result.request : null, notes };
 }
-/** A trailing ASK marker — valid card or rejected payload — means the user
+/** A partial channel cannot keep an earlier gate alive when the other carries
+ * the same transcript plus later declarations. Compare raw lines in order,
+ * preserving fences/examples and ACKs between declarations. Neither channel
+ * always wins: v1 reconstructs omitted snapshots, v2 can retain refreshed ones.
+ * Incomparable transcripts keep the existing conservative channel policy. */
+function orderedTurnText(v1, v2) {
+    if (!v1)
+        return v2;
+    if (!v2 || v1 === v2)
+        return v1;
+    const contains = (full, partial) => {
+        const lines = partial.split('\n');
+        let next = 0;
+        for (const line of full.split('\n')) {
+            if (line === lines[next])
+                next++;
+        }
+        return next === lines.length;
+    };
+    if (contains(v2, v1))
+        return v2;
+    if (contains(v1, v2))
+        return v1;
+    return undefined;
+}
+/** One turn-end decision for fresh and Continue, also retained until an input
+ * ACK settles. DONE and human/completion gates take precedence over a quiet
+ * declaration or live workers; a false pending-ASK flag alone proves nothing. */
+function classifyTurnEnd(turnText, completedAssistantText, options) {
+    const complete = orderedTurnText(turnText, completedAssistantText);
+    const v1 = turnParkSignals(complete ?? turnText);
+    const v2 = complete === undefined ? turnParkSignals(completedAssistantText) : v1;
+    const done = options.interactive && options.sessionOpen && (v1.done || v2.done) &&
+        v1.askResult.kind === 'none' && v2.askResult.kind === 'none' && !v1.humanGate && !v2.humanGate;
+    const askTurn = resolveAskTurn(v1.askResult, v2.askResult, options.sessionOpen && !done);
+    // Ordinary markerless autonomous turns keep their existing nudge policy.
+    // Prose and rejected-ASK fallbacks override a quiet park this turn would
+    // otherwise enter. Recovery notes beside a valid card are not rejections.
+    const quietPark = v1.monitoring || v2.monitoring || options.scheduledWake || options.liveWorkers || options.dependencyWait;
+    const rejectedAsk = !askTurn.ask && askTurn.notes.length > 0;
+    const humanGate = !done && quietPark && (v1.humanGate || v2.humanGate || rejectedAsk);
+    const monitoring = options.interactive && options.sessionOpen && !done && !askTurn.ask &&
+        !options.pendingHumanAsk && !options.completionAttention && !humanGate &&
+        (v1.monitoring || v2.monitoring || options.scheduledWake || options.liveWorkers);
+    return { ...askTurn, done, monitoring, humanGate };
+}
+/** An active ASK marker — valid card or rejected payload — means the user
  *  must answer. Drop follow-ups queued mid-turn so they cannot start a new
  *  turn the moment idle fires (OpenCode serializes `sendMessage` that way). */
 function discardQueuedMessagesOnAsk(session, outcome) {
-    if (outcome.ask || outcome.notes.length)
+    if (outcome.ask || outcome.notes.length || outcome.humanGate)
         session?.discardQueuedMessages();
 }
 function isSyntheticContinuation(run, step) {
@@ -202,10 +323,7 @@ function isSyntheticContinuation(run, step) {
 }
 /** Periodic "cezar autosave" commit in the task worktree (spec 006). */
 export const AUTOSAVE_INTERVAL_MS = 90_000;
-/** Stop on a workflow check: SIGTERM first, SIGKILL to its process group after this grace. */
-export const CHECK_KILL_GRACE_MS = 3_000;
-/** After SIGKILL, how long to wait for the group to disappear before resolving unconfirmed. */
-export const CHECK_TERMINATION_CONFIRM_MS = 5_000;
+export { CHECK_KILL_GRACE_MS, CHECK_TERMINATION_CONFIRM_MS } from './grouped-command.js';
 /** The periodic autosave timer is opt-in (#471): off, a task branch carries only the
  *  agent's own commits plus the turn-end/pre-PR flushes — no mid-run "cezar autosave"
  *  noise interleaving PR history. The flushes (`autosaveCommit` at turn end and before
@@ -224,13 +342,23 @@ export function repositoryRootLockDisabled(env = process.env) {
     return env.CEZ_DISABLE_REPO_LOCK === '1';
 }
 const REPOSITORY_ROOT_LOCK_DISABLED_NOTE = 'repository-root lock disabled by CEZ_DISABLE_REPO_LOCK=1 (shared checkout is unsafe)';
-/** Safety cap on autonomous auto-continues per run — stops a stuck agent from nudging forever. */
 /** #505: a real steer is read at the harness's next model step; a quiet boundary this long
  * with input still unread means the harness will not read it without help. */
 export const UNREAD_INPUT_GRACE_MS = 30_000;
-const MAX_AUTO_CONTINUES = 40;
-const AUTONOMOUS_NUDGE = 'Continue working autonomously until the task is fully complete. Do not ask me for confirmation or clarification — make reasonable assumptions and proceed. When everything is done, end the session with your done signal.';
-const MONITORING_WAKE_NUDGE = 'Re-check the downstream work you were monitoring. Continue toward the task goal; emit CEZ:MONITORING again only if it is still pending.';
+/** #486: recheck a turn-end that deferred close/park only because the harness still held a human follow-up. */
+export const HELD_HUMAN_INPUT_RECHECK_MS = 250;
+function unreadInputUnconfirmedNote(count) {
+    return `delivered ${count} message${count === 1 ? '' : 's'}; the agent did not confirm reading ${count === 1 ? 'it' : 'them'}`;
+}
+/** Bound a final-message nudge that is ACKed but never produces a turn (#544).
+ *  OpenCode heartbeats re-arm the managed-session no-progress guard, so this is
+ *  the DEFAULT-path exit when the agent stays silent. Overridable on RunManager. */
+export const FINAL_MESSAGE_NUDGE_REPLY_MS = 5 * 60_000;
+/** Bound one unattended session; an explicit Continue starts a new budget. */
+export const MAX_AUTO_CONTINUES = 40;
+export const AUTONOMOUS_NUDGE = 'Continue working autonomously until the task is fully complete. Do not ask me for confirmation or clarification — make reasonable assumptions and proceed. When everything is done, end the session with your done signal.';
+export const FINAL_MESSAGE_NUDGE = 'Your last turn ended without a message to the user. Write your user-facing reply now: what you did, where things stand, and anything you need from the user. If the task goal is fully achieved, end that message with CEZ:DONE.';
+const MONITORING_WAKE_NUDGE = 'Re-check the downstream work you were monitoring. Continue toward the task goal. When the watched work is finished and the task goal is complete, end your final message with CEZ:DONE. If the watched work is still pending, end with CEZ:MONITORING. Never yield markerless for a monitoring wrap-up. If you genuinely need user input, follow the normal question path instead.';
 /**
  * Auto-resume after a provider usage limit (spec 2026-08-03-auto-resume-after-usage-limit).
  *
@@ -439,6 +567,10 @@ const ORPHAN_PROBE_CACHE_MS = 2_000;
 class WorkerOrphanAliveError extends Error {
 }
 const admissionError = (error, fallback) => error instanceof WorkerOrphanAliveError ? error.message : fallback;
+/** The delegation family a run belongs to, by its root's id: a worker's parent, else itself. */
+function familyOf(run) {
+    return run.delegation?.role === 'worker' ? run.delegation.parentRunId : run.id;
+}
 /**
  * The mini workflow engine: executes a `WorkflowDef` against a repo, one step
  * at a time, persisting every event to the RunStore (which the SSE endpoints
@@ -468,6 +600,8 @@ export class RunManager {
     beginWorkerExecution(runId, admitted = true) {
         if (this.store.getRun(runId)?.delegation?.role !== 'worker')
             return;
+        if (this.reclaiming.has(runId))
+            throw new Error('Worker resources are being cleaned up');
         // #469: one site for Continue, --resume, parent replies and queued revival after a crash.
         // Fresh: admission is one-shot, so a cached "alive" must not refuse an orphan that has since died.
         if (!this.executions.has(runId))
@@ -561,18 +695,17 @@ export class RunManager {
             return { state: 'unknown' };
         if (record !== 'absent' && isCurrentProcess(record.controller))
             return { state: 'none' };
-        // Finalization may reap terminal task scratch, so a process working there keeps the generation alive.
+        // Legacy execution proof also considers scratch holders; cleanup uses a separate strict proof.
+        const locations = agentTmpDirLocationEvidence(this.dataDir, runId);
         return { state: 'orphan', generation: proof.generation, ...(record === 'absent' ? {} : { record }),
-            paths: [run.delegation.workspace.path, ...agentTmpDirLocations(this.dataDir, runId)],
-            // No process of this worker can predate its record (1 s slack for tick rounding).
-            ...(Number.isFinite(Date.parse(run.createdAt)) ? { since: Date.parse(run.createdAt) - 1_000 } : {}) };
+            paths: [run.delegation.workspace.path, ...locations.paths], pathsComplete: locations.complete };
     }
     orphanedWorkerGeneration(runId, admitting = false) {
         const orphan = this.orphanState(runId, admitting);
         return orphan.state === 'orphan' ? orphan : undefined;
     }
-    /** Completes a crashed generation's proof once every one of its processes is proven gone (#469).
-     * Sync and signal-free; recovery, resume, delivery, collect and destroy then take their normal paths.
+    /** Settles a crashed generation after exit proof. Sync and signal-free; recovery, resume,
+     * delivery, collect and destroy then take their normal paths.
      * A non-gone probe is cached briefly: on darwin the scan is a synchronous `lsof` on the event loop. */
     settleOrphanedWorkerExecution(runId, opts = {}) {
         const orphan = this.orphanedWorkerGeneration(runId, opts.admitting);
@@ -581,7 +714,7 @@ export class RunManager {
         const cached = this.orphanProbes.get(runId);
         if (!opts.fresh && cached?.generation === orphan.generation && Date.now() - cached.at < ORPHAN_PROBE_CACHE_MS)
             return false;
-        const probe = inspectGeneration(orphan);
+        const probe = inspectExecutionGeneration({ ...orphan, cwds: opts.cwds });
         if (probe.liveness !== 'gone') {
             this.orphanProbes.set(runId, { generation: orphan.generation, at: Date.now(), probe });
             return false;
@@ -604,45 +737,70 @@ export class RunManager {
         return true;
     }
     orphanProbes = new Map();
-    orphanReprobes = new Map();
+    /** Pending orphan reprobes by run id. One timer serves them all (hearsay-tools/cezarion#879). */
+    orphanDue = new Map();
+    orphanTimer;
+    /** The `at` the timer was armed for; with the clock, it decides what a tick takes. */
+    orphanArmedFor = 0;
     orphanBlockers = new Map();
     reportedOrphanBlockers = new Map();
     // Private and overridable so tests need not wait out production cadence.
-    orphanReprobeMs = 15_000;
-    orphanReprobeLimitMs = 15 * 60_000;
-    orphanReprobeSlowMs = 60_000;
+    orphanBackoff = ORPHAN_BACKOFF;
     orphanTermGraceMs = 10_000;
     /** #469: a survivor that dies after recovery has no other wake source (no exit callback for a
      * process another cezar spawned). Unref'd; finalization's `run` event then lets worker waits and
-     * outcomes observe it. Fast for the first window, then slow but uncapped, so a long-lived
-     * survivor is still noticed when it exits. A tick while this manager holds the run is skipped;
-     * only terminal reasons (proof settled, generation changed, run gone, unknown record, dispose)
-     * stop it. */
+     * outcomes observe it. Every 15 s for the first 15 minutes, then backing off to hourly
+     * (hearsay-tools/cezarion#879), so a long-lived survivor is still noticed when it exits. One
+     * timer serves every orphan, and a tick shares one `/proc` scan across them. A tick while this
+     * manager holds the run is skipped; only terminal reasons (proof settled, generation changed,
+     * run gone, unknown record, dispose) stop it. */
     armOrphanReprobe(runId) {
         const armed = this.orphanedWorkerGeneration(runId);
-        if (this.disposed || this.orphanReprobes.has(runId) || !armed)
-            return;
-        const slowAfter = Date.now() + this.orphanReprobeLimitMs;
-        const schedule = () => {
-            const timer = setTimeout(() => {
-                const orphan = this.orphanState(runId);
-                if (orphan.state === 'busy')
-                    return schedule();
-                if (orphan.state !== 'orphan' || orphan.generation !== armed.generation || this.settleOrphanedWorkerExecution(runId))
-                    this.clearOrphanReprobe(runId);
-                else
-                    schedule();
-            }, Date.now() < slowAfter ? this.orphanReprobeMs : this.orphanReprobeSlowMs);
-            timer.unref?.();
-            this.orphanReprobes.set(runId, timer);
-        };
-        schedule();
+        if (this.disposed || this.orphanDue.has(runId) || !armed)
+            return;
+        this.orphanDue.set(runId, { generation: armed.generation, at: Date.now() + retryDelayMs(0, this.orphanBackoff, noJitter), attempts: 0 });
+        this.wakeOrphanReprobes();
+    }
+    wakeOrphanReprobes() {
+        clearTimeout(this.orphanTimer);
+        this.orphanTimer = undefined;
+        if (this.disposed || !this.orphanDue.size)
+            return;
+        let next = Infinity;
+        for (const { at } of this.orphanDue.values())
+            next = Math.min(next, at);
+        this.orphanArmedFor = next;
+        this.orphanTimer = setTimeout(() => this.orphanReprobeTick(), Math.max(0, next - Date.now()));
+        this.orphanTimer.unref?.();
+    }
+    orphanReprobeTick() {
+        this.orphanTimer = undefined;
+        if (this.disposed)
+            return;
+        // Orphans due within 5 % of the fast cadence ride along, so near neighbours share the scan, and
+        // every orphan this tick keeps is re-armed from the same instant, so they stay together.
+        const now = Date.now();
+        const dueBy = Math.max(this.orphanArmedFor, now) + this.orphanBackoff.fastMs / 20;
+        const cwds = sharedCwdScan();
+        for (const [runId, pending] of [...this.orphanDue]) {
+            if (pending.at > dueBy)
+                continue;
+            this.orphanDue.delete(runId);
+            const orphan = this.orphanState(runId);
+            let attempts = pending.attempts;
+            if (orphan.state !== 'busy') {
+                // Ticks are seconds apart, so the brief probe cache would only skip them: probe fresh.
+                if (orphan.state !== 'orphan' || orphan.generation !== pending.generation ||
+                    this.settleOrphanedWorkerExecution(runId, { fresh: true, cwds }))
+                    continue;
+                attempts++;
+            }
+            this.orphanDue.set(runId, { ...pending, attempts, at: now + retryDelayMs(attempts, this.orphanBackoff, noJitter) });
+        }
+        this.wakeOrphanReprobes();
     }
     clearOrphanReprobe(runId) {
-        const timer = this.orphanReprobes.get(runId);
-        if (timer)
-            clearTimeout(timer);
-        this.orphanReprobes.delete(runId);
+        this.orphanDue.delete(runId);
     }
     /** Why the last destroy could not prove termination (#469), and whether that differs from the
      * reason last reported, so a retry loop appends one lifecycle event per distinct blocker set. */
@@ -683,29 +841,16 @@ export class RunManager {
         // >= 500 ms: every probe may be a synchronous darwin `lsof`.
         const pause = () => new Promise(resolve => setTimeout(resolve, Math.max(0, Math.min(500, deadline - Date.now()))));
         // A live controller is another cezar's: nothing to signal or wait for. Otherwise signal only
-        // recorded, token-verified survivors (none for a legacy record-less generation), then wait
-        // out every other holder until the deadline; the scan's processes are never signalled.
+        // recorded, token-verified survivors and recorded session groups (none for a legacy
+        // record-less generation), then wait for readable cwd holders until the deadline.
         if (!orphan.record || !recordedProcessLive(orphan.record.controller)) {
             if (orphan.record) {
-                const targets = orphan.record.processes.filter(entry => entry.startToken !== undefined && recordedProcessLive(entry));
-                const signal = (name) => {
-                    for (const entry of targets) {
-                        if (!same())
-                            return;
-                        // Re-verified immediately before every signal, exactly: a reused PID is never touched.
-                        if (processStartToken(entry.pid) === entry.startToken)
-                            try {
-                                process.kill(entry.pid, name);
-                            }
-                            catch { /* already gone */ }
-                    }
-                };
-                signal('SIGTERM');
-                const killAt = Math.min(deadline, Date.now() + this.orphanTermGraceMs);
-                while (Date.now() < killAt && targets.some(recordedProcessLive))
-                    await pause();
-                if (targets.some(recordedProcessLive))
-                    signal('SIGKILL');
+                const { processes } = orphan.record;
+                await this.terminateRecorded({
+                    pids: processes.filter(entry => entry.pgid === undefined && entry.startToken !== undefined && recordedProcessLive(entry)),
+                    groups: processes.filter(entry => entry.pgid !== undefined),
+                    paths: orphan.paths,
+                }, deadline, pause, same);
             }
             while (!this.settleOrphanedWorkerExecution(runId, { fresh: true }) && Date.now() < deadline && same())
                 await pause();
@@ -718,13 +863,70 @@ export class RunManager {
         else if (probe?.pids.length)
             this.orphanBlockers.set(runId, { kind: 'processes', pids: probe.pids });
     }
+    /** Destroy only: SIGTERM recorded survivors, then SIGKILL what outlives `orphanTermGraceMs`.
+     * `pids` are signalled by token-verified pid; `groups` are session leaders whose whole process
+     * group is signalled (hearsay-tools/cezarion#890), so what an agent left behind exits with it. A
+     * dead leader's group counts only while a process holding `paths` is in it. Every signal
+     * re-verifies first: a reused PID or group number is never touched. */
+    async terminateRecorded(targets, deadline, pause, current = () => true) {
+        const holders = processesWithCwdUnder(targets.paths);
+        const holderGroups = () => (holders === 'unknown' ? [] : holders).map(processGroupOf).filter((pgid) => pgid !== undefined);
+        const groups = targets.groups.filter(entry => recordedGroupSignalable(entry, holderGroups()) && processGroupAlive(entry.pgid));
+        const living = () => targets.pids.some(recordedProcessLive) || groups.some(entry => processGroupAlive(entry.pgid));
+        const signal = (name) => {
+            for (const entry of targets.pids) {
+                if (!current())
+                    return;
+                if (processStartToken(entry.pid) === entry.startToken)
+                    try {
+                        process.kill(entry.pid, name);
+                    }
+                    catch { /* already gone */ }
+            }
+            const evidence = holderGroups();
+            for (const entry of groups) {
+                if (!current())
+                    return;
+                if (recordedGroupSignalable(entry, evidence))
+                    signalProcessGroup(entry.pgid, name);
+            }
+        };
+        if (!living())
+            return;
+        signal('SIGTERM');
+        const killAt = Math.min(deadline, Date.now() + this.orphanTermGraceMs);
+        while (Date.now() < killAt && living())
+            await pause();
+        if (living())
+            signal('SIGKILL');
+    }
+    /** Destroy of a finished generation (hearsay-tools/cezarion#890): a dev server or watcher its
+     * agent left in its process group holds the worktree, and nothing else ties it to the worker.
+     * A record whose controller is another live cezar is not ours to act on. */
+    async terminateFinishedWorkerGroups(runId, timeoutMs) {
+        const proof = this.store.readWorkerExecution(runId);
+        if (proof?.phase !== 'complete')
+            return;
+        const record = this.store.readWorkerProcesses(runId, proof.generation);
+        const run = this.store.getRun(runId);
+        if (typeof record === 'string' || run?.delegation?.role !== 'worker' ||
+            (recordedProcessLive(record.controller) && !isCurrentProcess(record.controller)))
+            return;
+        const groups = record.processes.filter(entry => entry.pgid !== undefined);
+        if (!groups.length)
+            return;
+        const deadline = Date.now() + Math.min(30_000, Math.max(0, Number.isFinite(timeoutMs) ? timeoutMs : 0));
+        const pause = () => new Promise(resolve => setTimeout(resolve, Math.max(0, Math.min(100, deadline - Date.now()))));
+        const paths = [run.delegation.workspace.path, ...agentTmpDirLocationEvidence(this.dataDir, runId).paths];
+        await this.terminateRecorded({ pids: [], groups, paths }, deadline, pause);
+    }
     /** Best effort: a failed write leaves the working-directory scan as this process's evidence. */
     recordWorkerProcess(runId, pid) {
         const generation = this.executions.get(runId)?.generation;
         if (!generation)
             return;
         try {
-            if (!this.store.appendWorkerProcess(runId, generation, pid))
+            if (!this.store.appendWorkerProcess(runId, generation, pid, sessionGroupOf(pid)))
                 console.warn(`[cez] worker ${runId} process record unavailable; relying on the working-directory scan`);
         }
         catch {
@@ -746,6 +948,12 @@ export class RunManager {
         return { workerId: runId, state: !this.executions.has(runId) && this.store.readWorkerExecution(runId)?.phase === 'complete' ? 'terminated' : 'stopping' };
     }
     async awaitRunTermination(runId, timeoutMs, opts = {}) {
+        const terminated = await this.proveRunTermination(runId, timeoutMs, opts);
+        if (terminated && opts.reapOrphans && !this.disposed)
+            await this.terminateFinishedWorkerGroups(runId, timeoutMs);
+        return terminated;
+    }
+    async proveRunTermination(runId, timeoutMs, opts) {
         const execution = this.executions.get(runId);
         if (!execution) {
             const generation = this.finalizedWorkers.get(runId);
@@ -767,25 +975,6 @@ export class RunManager {
         });
         return !this.executions.has(runId) && this.store.readWorkerExecution(runId)?.phase === 'complete';
     }
-    /** Private cleanup capability, never serialized. Obtain after stop/termination
-     * under the service's destroy lock; each invocation rechecks the same generation. */
-    getWorkerNoMaterializationProof(runId) {
-        const initial = this.store.readWorkerExecution(runId);
-        const recorded = this.store.getRun(runId)?.delegation;
-        if (!initial?.neverMaterialized || initial.phase !== 'complete' || recorded?.role !== 'worker')
-            return undefined;
-        const workspace = { ...recorded.workspace };
-        const verify = candidate => {
-            const run = this.store.getRun(runId);
-            const current = this.store.readWorkerExecution(runId);
-            const delegation = run?.delegation;
-            return !this.disposed && !this.isActive(runId) && run?.status === 'cancelled' &&
-                delegation?.role === 'worker' && !!delegation.destroy &&
-                current?.generation === initial.generation && current.phase === 'complete' && current.neverMaterialized === true &&
-                Object.keys(workspace).every(key => candidate[key] === workspace[key] && delegation.workspace[key] === workspace[key]);
-        };
-        return verify(workspace) ? verify : undefined;
-    }
     /** Irreversible history removal is an execution tombstone, including for legacy children. */
     historyDeletionPending(runId) {
         const run = this.store.getRun(runId);
@@ -816,6 +1005,14 @@ export class RunManager {
     ciRegistrations = new Map();
     ciRetries = new Map();
     ciResources;
+    /** #781: the workspace-wide preview host. Absent (`cez run`, tests) means every registration is `headless`. */
+    preview;
+    /** The same host, for a removal outside this manager that must release a run's preview first. */
+    get previewHost() {
+        return this.preview;
+    }
+    /** #781: cezar's own listening port, which no dev server may register. */
+    cezarPort;
     ciSupervisor;
     workerWaiting = new Set();
     workerWakeAdmitted = new Set();
@@ -825,13 +1022,40 @@ export class RunManager {
     reconcilingWorkers = false;
     reconcilingFamily;
     pendingReconciliations = new Set();
-    recovering = false;
+    /** What the recovery in progress covers: every run at boot (`family` undefined), or the one
+     *  family an adoption hands it (#779, plan step 3). Undefined: no recovery in progress. */
+    recoveryScope;
+    /** Settles when the recovery in progress (if any) has finished. */
+    recoveryInFlight;
+    /** Adoptions of dead processes' runs, one at a time (`adoptOrphanedRun`). */
+    adoptionTail = Promise.resolve();
     /** Quiet window before unread input is resubmitted or left unconfirmed (#505). */
     unreadInputGraceMs;
+    /** Quiet window after a final-message nudge before a still-silent session parks (#544). */
+    finalMessageNudgeReplyMs;
     disposed = false;
+    /** Whether any recovery is in progress: one at a time (`recover`), and `pump` waits for it. */
+    get recovering() {
+        return this.recoveryScope !== undefined;
+    }
+    /**
+     * Whether a recovery in progress holds this run, so its wakes, input flushes and delegation
+     * reconciles wait for that recovery's own passes: every run during boot recovery, and only the
+     * adopted family's during a recovery scoped to one. The rest of a running project stays live: a
+     * wake held back for an unrelated family would be lost, since the scoped passes never revisit it.
+     */
+    recoveringRun(run) {
+        const scope = this.recoveryScope;
+        if (!scope)
+            return false;
+        if (scope.family === undefined)
+            return true;
+        const record = typeof run === 'string' ? this.store.getRun(run) : run;
+        return record !== undefined && familyOf(record) === scope.family;
+    }
     onDelegationRun = (run, source) => {
         // Delegation metadata checkpoints do not change task status.
-        if (!this.disposed && source !== 'delegation-checkpoint')
+        if (!this.disposed && source === undefined)
             this.reapTerminalScratch(run.id);
         if (!this.disposed && !['queued', 'running', 'waiting'].includes(run.status))
             this.withdrawCiWait(run.id);
@@ -839,7 +1063,10 @@ export class RunManager {
             this.active.get(run.id)?.revokeDelegation?.();
         // Cleanup checkpoints emit terminal records too. With delegation disabled,
         // these observations must not replay the project's conversation histories.
-        if (this.disposed || this.recovering || (source === 'delegation-checkpoint' && process.env.CEZ_DELEGATION !== '1'))
+        if (this.disposed || this.recoveringRun(run) || (source === 'delegation-checkpoint' && process.env.CEZ_DELEGATION !== '1'))
+            return;
+        // A destroy retry changes nothing the family reconcile reads (#880).
+        if (source === 'delegation-destroy-progress')
             return;
         if (run.delegation && run.delegation.role !== 'invalid' && !['queued', 'running', 'waiting'].includes(run.status)) {
             this.reconcileWorkerWaits(run.delegation.role === 'root' ? run.id : run.delegation.parentRunId);
@@ -850,6 +1077,10 @@ export class RunManager {
      *  explicit user Continue, these are bulk scheduler work and must re-enter
      *  through `pump()` so both workspace and per-project caps are honored. */
     pendingContinuations = new Map();
+    /** Accepted Continues supersede in-flight settlement even before launch or after
+     * idle close. Retain these across dropActive/dispose so absence cannot look like
+     * the earlier execution again; disposal alone never revokes terminal intent. */
+    continuationGenerations = new Map();
     /** Per-run image counter behind `pasted-<n>` / `screenshot-<n>` (#472). Lives on
      *  the manager rather than the `ActiveRun` so a *queued* run — which has no
      *  `ActiveRun` at all — can persist attachments. Seeded lazily from disk. */
@@ -904,7 +1135,11 @@ export class RunManager {
         this.store = store;
         this.repoRoot = repoRoot;
         this.dataDir = join(repoRoot, '.ai/cezar');
+        this.workerScratchCleanup = new WorkerScratchCleanup(store, this.dataDir, id => this.isActive(id) || this.executions.has(id) || this.reclaiming.has(id));
+        this.preview = options.preview;
+        this.cezarPort = options.cezarPort;
         this.unreadInputGraceMs = options.unreadInputGraceMs ?? UNREAD_INPUT_GRACE_MS;
+        this.finalMessageNudgeReplyMs = options.finalMessageNudgeReplyMs ?? FINAL_MESSAGE_NUDGE_REPLY_MS;
         this.semaphore = options.semaphore ?? new WorkspaceSemaphore();
         this.ciResources = acquireCiResources(this.semaphore);
         this.ciSupervisor = this.ciResources.supervisor;
@@ -933,6 +1168,7 @@ export class RunManager {
      */
     dispose() {
         this.disposed = true;
+        this.workerScratchCleanup.pause();
         for (const task of this.ciWatches.values())
             task.abort.abort();
         this.ciWatches.clear();
@@ -945,8 +1181,9 @@ export class RunManager {
         this.ciResources.release();
         this.delegationProvisioner = undefined;
         this.finalizedWorkers.clear();
-        for (const runId of [...this.orphanReprobes.keys()])
-            this.clearOrphanReprobe(runId);
+        this.orphanDue.clear();
+        clearTimeout(this.orphanTimer);
+        this.orphanTimer = undefined;
         this.orphanProbes.clear();
         this.orphanBlockers.clear();
         this.reportedOrphanBlockers.clear();
@@ -1209,10 +1446,77 @@ export class RunManager {
         const controller = await this.ciResources.controller();
         if (!controller || this.disposed || state.cancelled || this.active.get(runId) !== state)
             return;
-        const provisioned = controller.provision((request, signal) => this.registerCiWait(runId, request, generation, signal));
+        const provisioned = controller.provision((request, signal) => this.registerCiWait(runId, request, generation, signal), (request, signal) => this.registerPreviewServer(runId, request, signal), (request, signal) => this.stopPreviewServer(runId, request, signal));
         state.revokeCiTools = provisioned.revoke;
         return provisioned;
     }
+    async stopPreviewServer(runId, request, signal) {
+        const parsed = previewStopRequestSchema.parse(request);
+        if (!previewToolEnabled())
+            return previewStopResult('preview_disabled');
+        if (!this.preview)
+            return previewStopResult('headless');
+        if (this.disposed || signal?.aborted)
+            return previewStopResult('unavailable');
+        const run = this.store.getRun(runId);
+        if (!run?.worktreePath || !existsSync(run.worktreePath))
+            return previewStopResult('worktree_missing');
+        const owner = this.preview.portOwner(parsed.port);
+        if (owner && owner.runId !== runId)
+            return previewStopResult('port_held');
+        if (!run.previewServers?.some(server => server.port === parsed.port))
+            return previewStopResult('not_registered');
+        return this.preview.stopPreview(runId, parsed, signal);
+    }
+    /**
+     * #781: record a dev server the agent registered. One probe at registration becomes
+     * `answeredAtRegistration`; the run is re-validated after it, since the probe awaits.
+     */
+    async registerPreviewServer(runId, request, signal) {
+        const parsed = previewServeRequestSchema.parse(request);
+        const validate = () => {
+            const run = this.store.getRun(runId);
+            const owner = this.preview?.portOwner(parsed.port);
+            const result = validateRegistration({
+                request: parsed,
+                worktreePath: run?.worktreePath && existsSync(run.worktreePath) ? run.worktreePath : undefined,
+                cezarPort: this.cezarPort?.(),
+                existing: run?.previewServers ?? [],
+                owner,
+                runId,
+                enabled: previewToolEnabled(),
+                headless: !this.preview,
+            });
+            const withoutWorktree = !!run && !run.worktreePath;
+            return { ...result, answer: () => previewResult(result.code, { ...parsed, ownerTitle: owner?.title, withoutWorktree }) };
+        };
+        const first = validate();
+        if (!first.server || !this.preview)
+            return first.answer();
+        // A server process supplies `cezarPort`, but recovered runs can call before the cockpit binds:
+        // until it knows its port, `cezar_port` cannot be checked, so the tool asks for a retry instead.
+        if (this.cezarPort && this.cezarPort() === undefined)
+            return previewResult('unavailable', parsed);
+        const answered = await this.preview.probe(parsed.port).catch(() => false);
+        // A session revoked during the probe (cancel, stop) must leave no card behind.
+        signal?.throwIfAborted();
+        const checked = validate();
+        if (!checked.server)
+            return checked.answer();
+        const server = { ...checked.server, answeredAtRegistration: answered };
+        const existing = this.store.getRun(runId)?.previewServers ?? [];
+        const previous = existing.find(entry => entry.port === server.port);
+        const changed = !!previous && (previous.command !== server.command || previous.cwd !== server.cwd || previous.path !== server.path);
+        const previewServers = checked.code === 'replaced'
+            ? existing.map(entry => entry.port === server.port ? server : entry)
+            : [...existing, server];
+        this.store.updateRun(runId, { previewServers });
+        this.store.appendEvent(runId, { type: 'preview.server-registered', server });
+        // A copy cezar runs from the old command must not keep answering for the new registration.
+        if (changed)
+            await this.preview.replaced(runId, server.port).catch(() => { });
+        return checked.answer();
+    }
     /** Trusted capability callbacks supply run identity; the model supplies only a PR and deadline. */
     async registerCiWait(runId, request, generation, capabilitySignal) {
         const parsed = ciWaitRequestSchema.parse(request);
@@ -1390,7 +1694,7 @@ export class RunManager {
     queueCiWake(runId) {
         const run = this.store.getRun(runId);
         const wait = run?.ciWait;
-        if (this.disposed || this.recovering || !run || !wait?.result || !wait.wakeId ||
+        if (this.disposed || this.recoveringRun(run) || !run || !wait?.result || !wait.wakeId ||
             !['running', 'waiting', 'queued'].includes(run.status) || run.stopping ||
             this.hasPendingHumanAsk(runId) || this.workerExecutionStopped(runId) || this.executionBlockedByRootFinish(run))
             return;
@@ -1693,6 +1997,7 @@ export class RunManager {
      * root (spec 006 degradation rule), which is always the tighter bound.
      */
     async pump() {
+        // Any recovery, scoped or not: each ends with a pump of its own, so nothing waits for long.
         if (this.disposed || this.recovering)
             return;
         this.reconcileMonitoringWakeTimers();
@@ -2004,13 +2309,25 @@ export class RunManager {
      *  - `running` → mark interrupted, then immediately resume the last agent
      *    session via the Continue path, pointing the agent at its handoff file.
      * Call once, before the server starts taking requests.
+     *
+     * With `familyRootId`, the same recovery for the one delegation family a dead process left
+     * behind, which `adoptOrphanedRun` has just loaded. Either way only runs this store owns are
+     * touched: another live process's runs are not in the live set, and the passes that read every
+     * worker or root skip their families (#779, plan step 3).
      */
-    async recover() {
-        if (this.disposed || this.recovering)
-            return;
-        this.recovering = true;
+    async recover(familyRootId) {
+        // A store that could not open (#779) knows none of its runs: recovering it would read "none".
+        if (this.disposed || this.recovering || this.store.unavailable)
+            return;
+        this.recoveryScope = { ...(familyRootId === undefined ? {} : { family: familyRootId }) };
+        let settled;
+        this.recoveryInFlight = new Promise((resolve) => { settled = resolve; });
+        const inScope = (run) => familyRootId === undefined || familyOf(run) === familyRootId;
         try {
-            for (const run of this.store.listRuns()) {
+            // Recovery reads the live set (#779): `listRuns()` is the runs `open` loaded by the `live`
+            // column, and finished runs have nothing to recover. The worker passes below go through
+            // indexed queries instead.
+            for (const run of this.store.listRuns().filter(inScope)) {
                 this.store.clearExpiredInboxClaims(run.id, new Date().toISOString());
                 this.armInboxClaimExpiry(run.id);
                 // #505: the session that accepted this input died before the model read it.
@@ -2023,26 +2340,29 @@ export class RunManager {
             }
             // #469: a generation whose processes died with the old controller is finalized first, so it
             // re-launches through the ordinary Continue path; live task scratch is retained.
-            for (const run of this.store.listRuns())
-                if (run.delegation?.role === 'worker' && !this.settleOrphanedWorkerExecution(run.id))
-                    this.armOrphanReprobe(run.id);
-            this.reconcileWorkerWaits();
+            // Any worker, finished or not, may hold a generation a dead controller left `starting`. Its
+            // private proof is read first, so only those workers' records are decoded: settling and
+            // re-probing are no-ops for every other proof phase.
+            // Another process's workers are its own to settle.
+            const workerIds = familyRootId === undefined ? this.store.listWorkerIds() : this.store.listWorkersOf(familyRootId).map((run) => run.id);
+            for (const id of workerIds) {
+                if (this.store.readWorkerExecution(id)?.phase === 'starting' && !this.store.writeRefusal(id) &&
+                    !this.settleOrphanedWorkerExecution(id))
+                    this.armOrphanReprobe(id);
+            }
+            this.reconcileWorkerWaits(familyRootId);
             const live = this.store
                 .listRuns()
-                .filter((r) => ['queued', 'waiting', 'running'].includes(r.status))
+                .filter((r) => inScope(r) && ['queued', 'waiting', 'running'].includes(r.status))
                 .sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-            // A crash never reaches `dropActive`, so its temp directory (#785) outlived the run.
-            // Startup is the one moment we know which runs are still live, so sweep every other
-            // per-run directory here — bounded to `<dataDir>/tmp`, never a sibling.
-            // An owned process can survive its controller, including behind terminal
-            // public status. Unknown private termination retains that process's scratch.
-            const retained = this.store.listRuns().filter(run => run.delegation?.role === 'worker' &&
-                this.store.readWorkerExecution(run.id)?.phase !== 'complete');
-            // `dispose()` deliberately does not terminate live sessions, so a waiting
-            // record may still own a process even while this manager is recovering.
-            // Idle-close ends a process, not its task. Preserve all live task scratch,
-            // including workers whose previous process generation has completed.
-            sweepAgentTmpDirs(this.dataDir, [...live, ...retained].map(run => run.id));
+            // Scratch cleanup discovers private evidence independently of the salvageable run index.
+            // Terminal worker cleanup/retries and the generic orphan sweep share this boundary. An
+            // adopted family only schedules its own members: the sweep belongs to restart.
+            if (familyRootId === undefined)
+                this.workerScratchCleanup.recover();
+            else
+                for (const run of this.familyMembers(familyRootId))
+                    this.workerScratchCleanup.schedule(run.id);
             for (const run of live) {
                 if (this.isActive(run.id))
                     continue;
@@ -2066,6 +2386,13 @@ export class RunManager {
                     continue;
                 }
                 if (run.delegation && run.delegation.role !== 'invalid' && this.hasPendingHumanAsk(run.id)) {
+                    // A crash between the prose checkpoint and wait withdrawal must not
+                    // recover the superseded wait as an autonomous wake.
+                    const gateSeq = this.pendingHumanAskSeq(run.id);
+                    if (this.store.readEvents(run.id).some(event => event.seq === gateSeq && event.type === 'note' && event.code === PROSE_HUMAN_GATE)) {
+                        this.withdrawCiWait(run.id);
+                        this.withdrawWorkerWait(run.id);
+                    }
                     this.store.updateRun(run.id, { status: 'waiting', activity: undefined });
                     // Only the durable, explicitly human payload may resume an unanswered
                     // question. A refused recovery leaves attention, not terminal failure.
@@ -2147,6 +2474,18 @@ export class RunManager {
                 });
                 const interruptedIndex = run.workflowDef?.steps.findIndex(step => step.id === interruptedStepId) ?? -1;
                 const interruptedDef = interruptedIndex >= 0 ? run.workflowDef?.steps[interruptedIndex] : undefined;
+                const requeueInput = () => ({ task: run.task, runner: run.runner, model: run.model, effort: run.effort,
+                    agentProfile: run.agentProfile, systemPrompt: run.systemPrompt, autonomous: run.autonomous,
+                    generateFollowups: run.generateFollowups, worktree: run.worktree });
+                // Worktree setup (#917) interrupted before any agent session: there is no session to
+                // continue, so start the workflow over. `execute` sees setup still `running` and reruns it.
+                if (run.workflowDef && run.worktreeSetup?.status === 'running' && !run.steps.some(step => step.sessionId)) {
+                    this.store.updateRun(run.id, { status: 'queued', error: undefined, finishedAt: undefined, currentStepId: undefined });
+                    this.store.flush();
+                    this.pendingJobs.set(run.id, { workflow: run.workflowDef, startAt: 0, input: requeueInput() });
+                    this.queue.push(run.id);
+                    continue;
+                }
                 if (run.workflowDef && interruptedDef && stepKind(interruptedDef) === 'check') {
                     this.store.updateStep(run.id, interruptedDef.id, { status: 'pending', error: undefined, finishedAt: undefined });
                     this.store.updateRun(run.id, { status: 'queued', error: undefined, finishedAt: undefined, currentStepId: undefined });
@@ -2154,9 +2493,7 @@ export class RunManager {
                     this.pendingJobs.set(run.id, {
                         workflow: run.workflowDef,
                         startAt: interruptedIndex,
-                        input: { task: run.task, runner: run.runner, model: run.model, effort: run.effort,
-                            agentProfile: run.agentProfile, systemPrompt: run.systemPrompt, autonomous: run.autonomous,
-                            generateFollowups: run.generateFollowups, worktree: run.worktree },
+                        input: requeueInput(),
                     });
                     this.queue.push(run.id);
                     continue;
@@ -2177,17 +2514,27 @@ export class RunManager {
             // one — see `reconcileAutoResumes`.
         }
         finally {
-            this.recovering = false;
+            this.recoveryScope = undefined;
+            this.recoveryInFlight = undefined;
+            settled();
         }
         // A question a crash caught before or after its commit to the parent still gets routed (#505).
-        for (const run of this.store.listRuns())
+        // Only a family with a live member has anyone left to route to or fall back from.
+        const families = familyRootId === undefined ? this.liveFamilyMembers() : this.familyMembers(familyRootId);
+        for (const run of families)
             if (run.delegation?.role === 'worker')
                 this.routeWorkerQuestion(run.id);
-        this.reconcileWorkerWaits();
-        // A parent reply accepted just before the crash still answers its worker (#505).
-        for (const run of this.store.listRuns())
+        if (familyRootId === undefined)
+            this.reconcileAllWorkerFamilies();
+        else
+            this.reconcileWorkerWaits(familyRootId);
+        // A parent reply accepted just before the crash still answers its worker (#505), and only a
+        // live worker takes one.
+        for (const run of this.store.listRuns().filter(inScope))
             if (run.delegation?.role === 'worker')
                 this.answerRoutedQuestion(run.id);
+        // The rest re-arms wakes from durable state and is idempotent, so it runs for every live run
+        // even after one adopted family: anything the recovery window held back goes out now.
         for (const run of this.store.listRuns()) {
             if (run.ciWait && !['running', 'waiting', 'queued'].includes(run.status))
                 this.withdrawCiWait(run.id);
@@ -2197,6 +2544,33 @@ export class RunManager {
         this.reconcileAutoResumes();
         void this.pump();
     }
+    /**
+     * Take over a run whose owning process is gone (#779, plan step 3): a control (Stop, Continue,
+     * archive…) reached a run `runOwnership` calls `orphaned`. Its family is claimed, its live runs
+     * are settled rather than resumed (`settleOrphanedRun`: interrupted, or cancelled before they
+     * began), and the family is recovered as a restart would, which repairs it but finds nothing live
+     * to resume. The control that follows then acts on a run this process now owns — rather than on
+     * a record nobody owns, a dead end until a restart — and only Continue starts agent work, with
+     * the user's own input. With `stop` the control is Stop, which the adoption carries out itself:
+     * `runId` ends cancelled, as an accepted Stop reads, rather than interrupted. False when a live
+     * process holds it after all (or it is gone): the control is refused as another process's.
+     * Adoptions run one at a time, after any recovery already in progress.
+     */
+    adoptOrphanedRun(runId, opts = {}) {
+        const adoption = this.adoptionTail.then(async () => {
+            while (this.recovering && this.recoveryInFlight)
+                await this.recoveryInFlight;
+            if (this.disposed)
+                return false;
+            const family = this.store.adoptFamily(runId, opts);
+            if (family === undefined)
+                return false;
+            await this.recover(family);
+            return true;
+        });
+        this.adoptionTail = adoption.catch(() => undefined);
+        return adoption;
+    }
     /** The persisted definition when it looks sane, else the catalog by name. */
     async reviveWorkflow(run) {
         // "Looks sane" is the STORE's job now: it parses `workflowDef` against the definition schema
@@ -2216,6 +2590,17 @@ export class RunManager {
     preserveRunAfterDisposal(runId, state) {
         return this.isDisposedDelegatedRun(runId) && !state.cancelled && !state.finishRequested;
     }
+    /**
+     * Register an executing run: the ONE way an `ActiveRun` enters `active`. Both construction
+     * sites (`execute` and `runContinuation`, which serves Continue and restart recovery) call it,
+     * so the store pins every run this manager executes (#779) — its record stays the held object
+     * every turn-end handler reads and writes until `dropActive` lets it go. A second site that set
+     * `active` directly would execute a run the store could evict mid-turn (the #811 shape).
+     */
+    activate(runId, state) {
+        this.active.set(runId, state);
+        this.store.pin(runId, 'active');
+    }
     /** Remove a run from the live registries — keeps `waiting ⊆ active`. */
     dropActive(runId) {
         const state = this.active.get(runId);
@@ -2225,6 +2610,7 @@ export class RunManager {
             state.releaseRepoRoot = undefined;
             this.clearIdleTimer(state);
             this.clearAutosaveTimer(state);
+            this.clearHeldHumanInputTimer(state);
         }
         this.waiting.delete(runId);
         this.monitoring.delete(runId);
@@ -2239,6 +2625,7 @@ export class RunManager {
         if (state)
             this.clearMonitoringWakeTimer(state, runId);
         this.active.delete(runId);
+        this.store.unpin(runId, 'active');
         if (!this.disposed && this.store.getRun(runId)?.ciWait)
             this.queueCiWake(runId);
         if (!this.executions.has(runId) && this.store.getRun(runId)?.stopping)
@@ -2261,9 +2648,16 @@ export class RunManager {
         // left a window — measured as exactly one extra task — where the queue saw a free slot and
         // an account that looked healthy, and started work that was already doomed.
         this.scheduleAutoResumeIfLimited(runId);
-        // Closed-session success may have parked a completion wait without a live wire.
-        if (this.store.getRun(runId)?.delegation)
+        // Closed-session success may have parked a completion wait without a live wire. The global
+        // pass covers the families still in memory (#779); this run's own family may have just left
+        // the live set with it, so it is reconciled by name first.
+        const settled = this.store.getRun(runId);
+        if (settled?.delegation) {
+            const familyRoot = settled.delegation.role === 'root' ? settled.id : settled.delegation.role === 'worker' ? settled.delegation.parentRunId : undefined;
+            if (familyRoot !== undefined)
+                this.reconcileWorkerWaits(familyRoot);
             this.reconcileWorkerWaits();
+        }
         this.releaseSlot();
         // A run leaving the active registry may have reached a terminal transition
         // (done/review/failed/cancelled), increasing the finished-worktree count.
@@ -2273,6 +2667,18 @@ export class RunManager {
         void this.enforceRetention();
         this.reapTerminalScratch(runId);
     }
+    workerScratchCleanup;
+    /** Project detach cancels autonomous cleanup; reattach reconstructs the durable intents. */
+    pauseWorkerCleanup() { this.workerScratchCleanup.pause(); }
+    recoverWorkerCleanup() { if (!this.disposed)
+        this.workerScratchCleanup.recover(); }
+    /** Hold off every admission path until destructive work (including async Git) completes. */
+    claimWorkerCleanup(runId) {
+        if (this.disposed || this.reclaiming.has(runId) || this.isActive(runId) || this.executions.has(runId))
+            return undefined;
+        this.reclaiming.add(runId);
+        return () => { this.reclaiming.delete(runId); this.workerScratchCleanup.schedule(runId); };
+    }
     /** Scratch belongs to the task, not its current agent process (#515).
      * Terminal status alone is not process-exit proof: an active session or an
      * unfinished private worker generation must retain its files until exit. */
@@ -2282,8 +2688,11 @@ export class RunManager {
             return;
         if (this.active.has(runId) || this.starting.has(runId) || this.queue.includes(runId))
             return;
-        if (run.delegation?.role === 'worker' && this.store.readWorkerExecution(runId)?.phase !== 'complete')
+        const privateWorkers = workerEvidenceRunIds(this.dataDir);
+        if (run.delegation?.role === 'worker' || run.delegation?.role === 'invalid' || !privateWorkers || privateWorkers.includes(runId)) {
+            this.workerScratchCleanup.schedule(runId);
             return;
+        }
         removeAgentTmpDir(this.dataDir, runId);
     }
     // ---- usage-limit auto-resume (spec 2026-08-03-auto-resume-after-usage-limit) --------------
@@ -2625,7 +3034,7 @@ export class RunManager {
     async enforceRetention() {
         try {
             const keep = await resolveWorktreeRetention(this.repoRoot);
-            await reclaimWorktrees(this.repoRoot, this.store, keep, { claim: (run) => this.claimWorktreeReclaim(run.id) });
+            await reclaimWorktrees(this.repoRoot, this.store, keep, { claim: (run) => this.claimWorktreeReclaim(run.id), previewHost: this.preview });
         }
         catch {
             // retention is best-effort; swallow so terminal transitions never break.
@@ -2691,6 +3100,9 @@ export class RunManager {
         return true;
     }
     cancel(runId) {
+        // Another process's run (#779, plan step 3): only its owner can stop it.
+        if (this.store.writeRefusal(runId))
+            return false;
         if (this.store.getRun(runId)?.delegation?.role === 'worker') {
             const proof = this.store.readWorkerExecution(runId);
             this.store.commitWorkerCancellation(runId);
@@ -2753,13 +3165,38 @@ export class RunManager {
      * forced removal is deleting — nor a removal start under a session that was just admitted.
      */
     claimWorktreeReclaim(runId) {
-        if (this.reclaiming.has(runId) || this.isActive(runId))
+        if (this.reclaiming.has(runId) || this.isActive(runId) || this.store.writeRefusal(runId))
             return null;
         const run = this.store.getRun(runId);
-        if (!run || !isReclaimable(run, this.store.listRuns()))
+        if (!run || !isReclaimable(run, (id) => this.store.getRun(id)))
             return null;
-        this.reclaiming.add(runId);
-        return () => { this.reclaiming.delete(runId); };
+        return this.holdForMaintenance([runId]);
+    }
+    /**
+     * Hold `runIds` against Continue, reclaim, publish and branch cleanup here AND in every other
+     * cezar process for the length of an async operation (#779, plan step 3; PR #851 review). An
+     * ownership check alone is a moment: pinning claims each run's family, so another process
+     * cannot claim and Continue it while this one rematerializes, publishes or deletes. Null when
+     * any hold fails (another process took the claim first); nothing stays held then.
+     */
+    holdForMaintenance(runIds) {
+        const pinned = [];
+        for (const id of runIds) {
+            if (!this.store.pin(id, 'maintenance')) {
+                for (const done of pinned)
+                    this.store.unpin(done, 'maintenance');
+                return null;
+            }
+            pinned.push(id);
+        }
+        for (const id of runIds)
+            this.reclaiming.add(id);
+        return () => {
+            for (const id of runIds) {
+                this.reclaiming.delete(id);
+                this.store.unpin(id, 'maintenance');
+            }
+        };
     }
     /**
      * Claim every run that owns a branch about to be deleted (issue 08 §B3), or null when any is in
@@ -2774,19 +3211,15 @@ export class RunManager {
      * branch cleanup and Continue off the checkout until the push and `gh` are done with it.
      */
     claimForPublish(runId) {
-        if (this.reclaiming.has(runId) || this.isActive(runId))
+        if (this.reclaiming.has(runId) || this.isActive(runId) || this.store.writeRefusal(runId))
             return null;
-        this.reclaiming.add(runId);
-        return () => { this.reclaiming.delete(runId); };
+        return this.holdForMaintenance([runId]);
     }
     claimForBranchCleanup(runIds) {
         const unfinished = (id) => !['done', 'failed', 'cancelled'].includes(this.store.getRun(id)?.status ?? 'done');
-        if (runIds.some((id) => this.reclaiming.has(id) || this.isActive(id) || unfinished(id)))
+        if (runIds.some((id) => this.reclaiming.has(id) || this.isActive(id) || unfinished(id) || this.store.writeRefusal(id)))
             return null;
-        for (const id of runIds)
-            this.reclaiming.add(id);
-        return () => { for (const id of runIds)
-            this.reclaiming.delete(id); };
+        return this.holdForMaintenance(runIds);
     }
     /**
      * Fold a queued run's persisted prompt — `run.task` plus everything stacked
@@ -3098,7 +3531,7 @@ export class RunManager {
         if (parent?.delegation?.role !== 'root')
             return [];
         const ids = new Set([...parent.delegation.receipts.map(receipt => receipt.workerId),
-            ...this.store.listRuns().filter(run => run.delegation?.role === 'worker' && run.delegation.parentRunId === runId).map(run => run.id)]);
+            ...this.store.listWorkersOf(runId).map(run => run.id)]);
         return parentReadiness(parent, [...ids].map(workerId => ({ workerId, run: this.store.getRun(workerId),
             terminated: this.store.readWorkerExecution(workerId)?.phase === 'complete', result: this.store.getRun(workerId)
                 ? this.store.readWorkerResult(runId, workerId) : this.store.readDeletedWorkerResult(runId, workerId),
@@ -3432,7 +3865,7 @@ export class RunManager {
             }
             this.queueWorkerWake(runId);
         }
-        else if (!this.recovering)
+        else if (!this.recoveringRun(runId))
             this.flushAgentInputs(runId);
     }
     /** A worker's pending question goes to its owning parent as a conversation request
@@ -3442,11 +3875,8 @@ export class RunManager {
         const worker = this.store.getRun(workerId);
         if (worker?.delegation?.role !== 'worker')
             return;
-        const events = this.store.readEvents(workerId);
-        const ask = pendingHumanAsk(events);
-        if (!ask)
-            return;
-        if (events.some(event => (event.type === 'worker-question-routed' || event.type === 'worker-question-fallback') && event.askSeq === ask.seq))
+        const ask = this.store.transcriptFacts(workerId).pendingAsk;
+        if (!ask || ask.routedMessageId !== undefined || ask.fallback)
             return;
         const fallback = (reason) => { this.store.appendEvent(workerId, { type: 'worker-question-fallback', askSeq: ask.seq, reason }); };
         const request = askRequestSchema.safeParse({ questions: ask.questions });
@@ -3494,23 +3924,20 @@ export class RunManager {
     answersFallenBackAsk(runId, opts, deferred) {
         if (deferred || !(opts.text?.trim() || opts.images?.length))
             return false;
-        const events = this.store.readEvents(runId);
-        const ask = pendingHumanAsk(events);
-        return !!ask && events.some(event => event.type === 'worker-question-fallback' && event.askSeq === ask.seq);
+        return !!this.store.transcriptFacts(runId).pendingAsk?.fallback;
     }
     /** The worker's pending ask when it went to the parent and has not fallen back to a human. */
     routedAsk(runId) {
         const run = this.store.getRun(runId);
         if (run?.delegation?.role !== 'worker')
             return undefined;
-        const events = this.store.readEvents(runId);
-        const ask = pendingHumanAsk(events);
-        if (!ask || events.some(event => event.type === 'worker-question-fallback' && event.askSeq === ask.seq))
+        // Indexed at append time (#880): the reconcile and every message to a worker ask this.
+        const ask = this.store.transcriptFacts(runId).pendingAsk;
+        if (!ask || ask.fallback || ask.routedMessageId === undefined)
             return undefined;
-        const routed = events.find(event => event.type === 'worker-question-routed' && event.askSeq === ask.seq);
         const root = this.store.getRun(run.delegation.parentRunId);
-        const message = routed && root?.delegation?.role === 'root'
-            ? root.delegation.conversation?.messages.find(entry => entry.id === routed.messageId) : undefined;
+        const message = root?.delegation?.role === 'root'
+            ? root.delegation.conversation?.messages.find(entry => entry.id === ask.routedMessageId) : undefined;
         return message ? { askSeq: ask.seq, message } : undefined;
     }
     /** The parent's reply answers the routed question like a human answer would: through the
@@ -3620,9 +4047,7 @@ export class RunManager {
     }
     /** Routed questions this parent has not answered yet, by asking worker. */
     unansweredQuestions(parentId) {
-        return this.store.listRuns().flatMap(run => {
-            if (run.delegation?.role !== 'worker' || run.delegation.parentRunId !== parentId)
-                return [];
+        return this.store.listWorkersOf(parentId).flatMap(run => {
             const routed = this.routedAsk(run.id);
             const root = this.store.getRun(parentId);
             const answered = root?.delegation?.role === 'root' && root.delegation.conversation?.outcomes.some(outcome => outcome.requestId === routed?.message.id);
@@ -3636,8 +4061,8 @@ export class RunManager {
         if (parent?.delegation?.role !== 'root')
             return;
         const state = parent.delegation.conversation ?? { messages: [], outcomes: [] };
-        const routed = this.store.listRuns().flatMap(run => {
-            const ask = run.delegation?.role === 'worker' && run.delegation.parentRunId === parentId ? this.routedAsk(run.id) : undefined;
+        const routed = this.store.listWorkersOf(parentId).flatMap(run => {
+            const ask = this.routedAsk(run.id);
             // An accepted reply still on its way to a live worker answers it; no human card beside it.
             const replied = ask && state.outcomes.some(outcome => outcome.requestId === ask.message.id && outcome.status === 'replied');
             return ask && !(replied && ['queued', 'running', 'waiting'].includes(run.status) && !run.stopping) ? [{ workerId: run.id, ...ask }] : [];
@@ -3725,7 +4150,7 @@ export class RunManager {
         for (const root of family) {
             if (root.delegation?.role !== 'root' || !root.delegation.conversation)
                 continue;
-            const next = reconcileConversationState(root, this.store.listRuns(), now, run => run.delegation?.role === 'worker' ? this.store.readWorkerExecution(run.id)?.phase === 'complete' : !this.isActive(run.id));
+            const next = reconcileConversationState(root, (id) => this.store.getRun(id), now, run => run.delegation?.role === 'worker' ? this.store.readWorkerExecution(run.id)?.phase === 'complete' : !this.isActive(run.id));
             if (next && next !== root.delegation.conversation)
                 this.store.commitConversation(root.id, next);
             projectConversationEvents(this.store, this.store.getRun(root.id));
@@ -3742,7 +4167,10 @@ export class RunManager {
                 const arm = (delay) => {
                     const handle = setTimeout(() => {
                         this.workerWaitTimers.delete(key);
+                        // This root's own family by name: it may have no live member left by its deadline
+                        // (#779), which the pass over live families would skip.
                         try {
+                            this.reconcileWorkerWaits(root.id);
                             this.reconcileWorkerWaits();
                         }
                         catch {
@@ -3759,7 +4187,41 @@ export class RunManager {
             }
         }
     }
-    /** Authority and wait live on disk; these collections are admission/timer caches only. */
+    /** One delegation family: its root, then the root's direct workers (the store's
+     *  `parent_run_id` query). Workers cannot delegate, so this never recurses. */
+    familyMembers(rootId) {
+        const root = this.store.getRun(rootId);
+        return [...(root ? [root] : []), ...this.store.listWorkersOf(rootId)];
+    }
+    /** Every member of every family with a live member, each once: the families the store holds
+     *  in memory (#779), which is where every delegation sweep that is not about one family looks. */
+    liveFamilyMembers() {
+        const roots = new Set();
+        for (const run of this.store.listRuns()) {
+            if (run.delegation?.role === 'root')
+                roots.add(run.id);
+            else if (run.delegation?.role === 'worker')
+                roots.add(run.delegation.parentRunId);
+        }
+        return [...roots].flatMap(rootId => this.familyMembers(rootId));
+    }
+    /**
+     * Recovery's full pass (#661): every family whose root carries a conversation — settled ones
+     * too, so a projection or outcome a crash interrupted is repaired — then every live family.
+     * Only roots with a conversation are read; a settled family without one has nothing to settle:
+     * every other repair the sweep makes on a finished member (a stale `wait`, a cancelled root's
+     * Finish intent) is a clause of `isLiveRecord`, so open already holds that family.
+     * Everything else asks `reconcileWorkerWaits()`, which covers the live families (#779).
+     */
+    reconcileAllWorkerFamilies() {
+        // Another process's families are its own to repair (#779, plan step 3).
+        for (const rootId of this.store.listConversationRootIds())
+            if (!this.store.writeRefusal(rootId))
+                this.reconcileWorkerWaits(rootId);
+        this.reconcileWorkerWaits();
+    }
+    /** Authority and wait live on disk; these collections are admission/timer caches only. One
+     *  family by its root's id, or (no id) every family with a live member. */
     reconcileWorkerWaits(familyRootId) {
         if (this.disposed)
             return;
@@ -3783,20 +4245,21 @@ export class RunManager {
         this.reconcilingWorkers = true;
         this.reconcilingFamily = familyRootId;
         try {
-            const inFamily = (run) => familyRootId === undefined || run.id === familyRootId ||
-                (run.delegation?.role === 'worker' && run.delegation.parentRunId === familyRootId);
-            this.reconcileConversations(this.store.listRuns().filter(inFamily));
-            for (const parent of this.store.listRuns().filter(inFamily)) {
+            // One family by name, or every family with a live member (#779): a family nobody in it is
+            // live has nothing left to settle, and its members are no longer in memory.
+            const family = familyRootId === undefined ? this.liveFamilyMembers() : this.familyMembers(familyRootId);
+            this.reconcileConversations(family);
+            for (const parent of family) {
                 if (!parent.delegation || parent.delegation.role === 'invalid' || this.historyDeletionPending(parent.id))
                     continue;
                 if (parent.status === 'cancelled' && parent.delegation.role === 'root' && parent.delegation.finishRequestedAt) {
                     this.store.commitRootFinishCancellation(parent.id);
                 }
                 if (!['queued', 'running', 'waiting'].includes(parent.status)) {
-                    if (!this.recovering) {
+                    if (!this.recoveringRun(parent)) {
                         this.withdrawWorkerWait(parent.id);
                         this.fallbackRoutedQuestions(parent.id, `parent-${parent.status}`);
-                        for (const child of this.store.listRuns().filter(child => parent.delegation?.role === 'root' && parent.status !== 'review' && child.delegation?.role === 'worker' && child.delegation.parentRunId === parent.id)) {
+                        for (const child of parent.delegation.role === 'root' && parent.status !== 'review' ? this.store.listWorkersOf(parent.id) : []) {
                             if (['queued', 'running', 'waiting'].includes(child.status))
                                 this.cancel(child.id);
                         }
@@ -3812,7 +4275,7 @@ export class RunManager {
                 if (delivered) {
                     // Receipt persistence precedes the live status update. After a crash
                     // this is interrupted execution, not generic waiting-run success.
-                    if (this.recovering && !delivered.inboxClaim?.acknowledgedAt && parent.status === 'waiting' && !this.hasPendingHumanAsk(parent.id)) {
+                    if (this.recoveringRun(parent) && !delivered.inboxClaim?.acknowledgedAt && parent.status === 'waiting' && !this.hasPendingHumanAsk(parent.id)) {
                         this.store.updateRun(parent.id, { status: 'running', activity: undefined });
                     }
                     const state = this.active.get(parent.id);
@@ -3829,7 +4292,7 @@ export class RunManager {
                     continue;
                 }
                 const now = new Date().toISOString();
-                const outcomes = this.store.listRuns().filter(child => child.delegation?.role === 'worker' && child.delegation.parentRunId === parent.id).flatMap(child => {
+                const outcomes = this.store.listWorkersOf(parent.id).flatMap(child => {
                     const outcome = workerOutcome(child, now);
                     return outcome && this.store.readWorkerExecution(child.id)?.phase === 'complete' ? [outcome] : [];
                 });
@@ -3892,9 +4355,7 @@ export class RunManager {
                             } }]);
                 }
                 for (const outcome of next.outcomes) {
-                    if (!this.store.readEvents(parent.id).some(event => event.type === 'worker-outcome' &&
-                        event.waitId === wait.id && event.outcome?.workerId === outcome.workerId &&
-                        (event.outcome?.revision ?? 0) === (outcome.revision ?? 0))) {
+                    if (!this.store.transcriptFacts(parent.id).workerOutcomeKeys.includes(workerOutcomeKey(wait.id, outcome.workerId, outcome.revision ?? 0))) {
                         this.store.appendEvent(parent.id, { type: 'worker-outcome', waitId: wait.id, outcome });
                     }
                 }
@@ -3974,7 +4435,7 @@ export class RunManager {
             this.store.commitAgentInputs(parentId, (run.agentInputs ?? []).map(entry => entry.id === input.id ? input : entry));
         }
         // Rebuild ordinary queued work before appending new wake admissions on restart.
-        if (this.recovering)
+        if (this.recoveringRun(run))
             return;
         const state = this.active.get(parentId);
         // A parent's reply to a routed question (#505) is the one message a pending ask admits.
@@ -4058,7 +4519,9 @@ export class RunManager {
     /** Transcript bubbles include refused sends. Only a successful delivery
      * checkpoint can answer the specific ask observed before that send. */
     pendingHumanAskSeq(runId) {
-        return pendingHumanAsk(this.store.readEvents(runId))?.seq;
+        // Fallback human gates use the same exact successful-delivery receipt as asks,
+        // without inventing a structured question card or changing its summary. Indexed (#880).
+        return this.store.transcriptFacts(runId).pendingGateSeq;
     }
     hasPendingHumanAsk(runId) {
         return this.pendingHumanAskSeq(runId) !== undefined;
@@ -4190,6 +4653,7 @@ export class RunManager {
      * goes back to the queue so a later session delivers it; never shown as delivered. */
     requeueUnreadAtClose(runId, state, session) {
         this.clearUnreadInputTimer(state);
+        this.clearHeldHumanInputTimer(state);
         // Everything this session accepted but never saw read: steered input, messages bundled
         // behind a human answer, and an opening instruction whose turn never succeeded.
         const opening = state.openingAgentInputId && this.store.getRun(runId)?.agentInputs?.some(input => input.id === state.openingAgentInputId && input.deliveredAt && !input.consumedAt) ? [state.openingAgentInputId] : [];
@@ -4209,7 +4673,11 @@ export class RunManager {
      * run parks as waiting or monitoring. Shared by acknowledgements that land after a
      * turn ended and by the unread-input grace timer (#505). */
     settleIdleBoundary(runId, state, session) {
-        if (state.atTurnBoundary !== session || state.pendingHumanAsk || this.workerWait(runId) || this.store.getRun(runId)?.ciWait || this.hasQueuedAgentInputs(runId))
+        // An in-flight acknowledgement still owns this boundary; its .then re-settles.
+        if (this.harnessHoldsHumanInput(state) || state.agentInputFlight)
+            return;
+        const proseGate = state.parkAfterAck?.session === session && state.parkAfterAck.humanGate;
+        if (state.atTurnBoundary !== session || (state.pendingHumanAsk && !proseGate) || this.workerWait(runId) || this.store.getRun(runId)?.ciWait || (!proseGate && this.hasQueuedAgentInputs(runId)))
             return;
         if (state.doneAtBoundary === session) {
             if (this.deferParentCompletion(runId))
@@ -4219,9 +4687,20 @@ export class RunManager {
             session.end();
         }
         else if (state.parkAfterAck?.session === session && !this.waiting.has(runId) && !this.monitoring.has(runId)) {
+            // The nudged turn may finish before its transport ACK (OpenCode HTTP/SSE).
+            // Its turn-end deferred to agentInputFlight; now apply the same policy
+            // before parking, with DONE and queued/accepted input still taking priority.
+            if (!state.parkAfterAck.humanGate && state.currentStepId && this.tryAutonomousNudge(runId, state, state.currentStepId, null)) {
+                appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — status=running (autonomous nudge)');
+                return;
+            }
+            if (state.autonomousNudgePending === session) {
+                appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — status=running (awaiting input readiness)');
+                return;
+            }
             // A wake turn can finish before its HTTP/RPC acknowledgement. Retiring
             // that wait must release its completed turn, not invent another turn.
-            if ((state.parkAfterAck.monitoring || this.hasLiveWorkers(runId)) && !this.parentCompletionAttention(runId)) {
+            if ((state.parkAfterAck.monitoring || (!state.parkAfterAck.humanGate && this.hasLiveWorkers(runId))) && !this.parentCompletionAttention(runId)) {
                 this.store.updateRun(runId, { status: 'running', activity: 'monitoring' });
                 if (state.currentStepId)
                     this.store.updateStep(runId, state.currentStepId, { status: 'running' });
@@ -4229,6 +4708,16 @@ export class RunManager {
                 this.clearIdleTimer(state);
                 this.armMonitoringWakeTimer(runId, state);
             }
+            else if (state.currentStepId && this.maybeFinalMessageNudge(runId, state, state.currentStepId, {
+                ask: false,
+                humanGate: !!state.parkAfterAck.humanGate,
+                monitoring: !!state.parkAfterAck.monitoring,
+                silentTail: !!state.parkAfterAck.silentTail,
+                alreadyNudged: !!state.parkAfterAck.alreadyFinalMessageNudged,
+            })) {
+                appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — status=running (final message nudge)');
+                return;
+            }
             else {
                 this.store.updateRun(runId, { status: 'waiting', activity: undefined });
                 if (state.currentStepId)
@@ -4237,6 +4726,8 @@ export class RunManager {
                 this.armIdleTimer(runId, state);
             }
             this.waiting.add(runId);
+            if (state.autonomous)
+                appendHandoffHeartbeat(this.dataDir, runId, `turn complete — status=${this.monitoring.has(runId) ? 'monitoring' : 'waiting'}`);
             this.releaseSlot();
         }
     }
@@ -4246,12 +4737,12 @@ export class RunManager {
     armUnreadInputTimer(runId, state) {
         this.clearUnreadInputTimer(state);
         const session = state.session;
-        if (!session?.open || !this.harnessOwesInput(state) || state.agentInputFlight)
+        if (!session?.open || state.pendingHumanAsk || !this.harnessOwesInput(state) || state.agentInputFlight)
             return;
         const timer = setTimeout(() => {
             state.unreadInputTimer = undefined;
             if (this.disposed || this.active.get(runId) !== state || state.session !== session || !session.open || state.cancelled ||
-                state.agentInputFlight || !this.harnessOwesInput(state))
+                state.pendingHumanAsk || state.agentInputFlight || !this.harnessOwesInput(state))
                 return;
             const ids = [...state.unreadInputIds];
             const retried = ids.filter(id => state.unreadRetried?.has(id));
@@ -4263,7 +4754,7 @@ export class RunManager {
                     this.store.commitAgentInputsUnconfirmed(runId, retried);
                 }
                 catch { /* receipt stays awaiting; a restart replays it */ }
-                this.store.appendEvent(runId, { type: 'note', message: `delivered ${retried.length} message${retried.length === 1 ? '' : 's'}; the agent did not confirm reading ${retried.length === 1 ? 'it' : 'them'}` });
+                this.store.appendEvent(runId, { type: 'note', message: unreadInputUnconfirmedNote(retried.length) });
             }
             if (fresh.length) {
                 state.unreadRetried ??= new Set();
@@ -4287,14 +4778,85 @@ export class RunManager {
             clearTimeout(state.unreadInputTimer);
         state.unreadInputTimer = undefined;
     }
+    /** #486: a turn-end deferred close/park only because the harness still held a human follow-up. */
+    armHeldHumanInputTimer(runId, state) {
+        this.clearHeldHumanInputTimer(state, false);
+        const session = state.session;
+        if (!session?.open || !this.harnessHoldsHumanInput(state)) {
+            state.heldHumanInputSince = undefined;
+            return;
+        }
+        state.heldHumanInputSince ??= Date.now();
+        const timer = setTimeout(() => {
+            state.heldHumanInputTimer = undefined;
+            if (this.disposed || this.active.get(runId) !== state || state.session !== session || !session.open ||
+                state.cancelled || state.idleClosed || state.atTurnBoundary !== session)
+                return;
+            if (this.harnessHoldsHumanInput(state)) {
+                // An in-flight ACK still owns this boundary; its .then re-settles.
+                if (state.agentInputFlight) {
+                    this.armHeldHumanInputTimer(runId, state);
+                    return;
+                }
+                if (Date.now() - (state.heldHumanInputSince ?? 0) >= this.unreadInputGraceMs) {
+                    const held = session.heldHumanInputCount?.() ?? 0;
+                    this.store.appendEvent(runId, {
+                        type: 'note',
+                        message: held > 0
+                            ? unreadInputUnconfirmedNote(held)
+                            : 'delivered held messages; the agent did not confirm reading them',
+                    });
+                    state.heldHumanInputExpired = true;
+                    this.settleIdleBoundary(runId, state, session);
+                    return;
+                }
+                this.armHeldHumanInputTimer(runId, state);
+                return;
+            }
+            this.settleIdleBoundary(runId, state, session);
+        }, HELD_HUMAN_INPUT_RECHECK_MS);
+        timer.unref?.();
+        state.heldHumanInputTimer = timer;
+    }
+    clearHeldHumanInputTimer(state, resetClock = true) {
+        if (state.heldHumanInputTimer)
+            clearTimeout(state.heldHumanInputTimer);
+        state.heldHumanInputTimer = undefined;
+        if (resetClock) {
+            state.heldHumanInputSince = undefined;
+            state.heldHumanInputExpired = undefined;
+        }
+    }
     /** #505: the harness accepted input this session has not reported reading yet. */
     harnessOwesInput(state) {
         return !!state?.unreadInputIds?.size;
     }
+    /** #486: a human follow-up is still queued in the live session and will still be delivered. */
+    harnessHoldsHumanInput(state) {
+        return !state.heldHumanInputExpired && !!state.session?.open && state.session.holdsHumanInput();
+    }
     /** A callback from an old/replaced/disposed session carries no authority. */
     handleAgentInputReady(runId, state, session) {
-        if (session && this.active.get(runId) === state && state.session === session)
-            this.flushAgentInputs(runId);
+        if (!session || this.disposed || this.active.get(runId) !== state || state.session !== session ||
+            !session.open || state.idleClosed || state.cancelled || state.finishRequested || state.agentInputError || state.agentSessionError)
+            return;
+        // Durable input always gets the first opportunity. Only the same refused,
+        // completed boundary may retry; ordinary/native question parks are not wakes.
+        if (this.flushAgentInputs(runId))
+            return;
+        // #486: held human input drained at this still-current boundary with no new turn.
+        // Runners fire onAgentInputReady from the transport ACK finally/callback while
+        // agentInputFlight is still set; settling here parks before the ACK .then can nudge.
+        if (state.atTurnBoundary === session && !this.harnessHoldsHumanInput(state) &&
+            !state.agentInputFlight && !this.harnessOwesInput(state)) {
+            this.settleIdleBoundary(runId, state, session);
+        }
+        if (state.autonomousNudgePending !== session || state.atTurnBoundary !== session ||
+            state.doneAtBoundary === session || !state.currentStepId)
+            return;
+        if (this.tryAutonomousNudge(runId, state, state.currentStepId, null)) {
+            appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — status=running (autonomous nudge)');
+        }
     }
     /** Reservation is synchronous; only an acknowledged transport may checkpoint delivery. */
     submitAgentInput(runId, state, content, inputIds = []) {
@@ -4524,6 +5086,8 @@ export class RunManager {
     /** Restore active lifecycle/accounting when either Cezar or the backend
      * resumes work in a parked session. */
     resumeParkedRun(runId, state) {
+        this.clearHeldHumanInputTimer(state);
+        state.autonomousNudgePending = undefined;
         state.atTurnBoundary = undefined;
         state.doneAtBoundary = undefined;
         state.parkAfterAck = undefined;
@@ -4595,6 +5159,9 @@ export class RunManager {
             : this.submitAgentInput(runId, state, deliverable);
         if (delivered) {
             if (userAuthored) {
+                state.finalMessageNudged = undefined;
+                state.finalMessageNudgeParked = undefined;
+                state.finalMessageNudgeSawContent = undefined;
                 if (ciHumanMessage)
                     this.store.commitQueuedMessageDelivery(runId, ciHumanMessage.id);
                 if (answeringAskSeq !== undefined) {
@@ -4682,6 +5249,13 @@ export class RunManager {
         const current = steps.findIndex((step) => step.id === run.currentStepId);
         return current < 0 || current < steps.length - 1;
     }
+    /** A clean process exit cannot complete a workflow still blocked on a question.
+     * Keep its existing durable waiting step so Continue can resume the tail. */
+    unansweredWorkflowAsk(runId, state) {
+        const run = this.store.getRun(runId);
+        return !state.finishRequested && !!run && this.hasPendingHumanAsk(runId) &&
+            this.waitingBeforeFinalWorkflowStep(run);
+    }
     /** Locate the original workflow step whose closed session a synthetic Continue is resuming. */
     waitingWorkflowStepIndex(run) {
         const steps = run.workflowDef?.steps ?? run.steps.filter(step => !isSyntheticContinuation(run, step));
@@ -4727,6 +5301,26 @@ export class RunManager {
     /** Restart recovery may discover several interrupted tasks at once. Those
      *  continuations are queued; an explicit user Continue remains immediate. */
     deferForCapacity = false, conversation) {
+        // Another process's run (#779, plan step 3) is its owner's to continue.
+        const refusal = this.store.writeRefusal(runId);
+        if (refusal)
+            return { ok: false, error: refusal };
+        // A finished run is loaded and held for the whole admission (#779): every read below sees
+        // the record its own writes change, exactly as for a live run. Admission makes it live
+        // (queued or running) or refuses it; either way the `continue` pin ends here.
+        // The check above is a moment: another process may claim the run before the hold lands
+        // (PR #851 review). Holding it is what claims it, so a failed hold refuses the Continue.
+        if (!this.store.pin(runId, 'continue')) {
+            return { ok: false, error: this.store.getRun(runId) ? this.store.writeRefusal(runId) ?? RUN_IN_USE_ELSEWHERE : 'not found' };
+        }
+        try {
+            return this.admitContinuation(runId, opts, deferForCapacity, conversation);
+        }
+        finally {
+            this.store.unpin(runId, 'continue');
+        }
+    }
+    admitContinuation(runId, opts, deferForCapacity, conversation) {
         if (agentModelsLocked(this.repoRoot) && (opts.model?.trim() || opts.effort?.trim())) {
             return { ok: false, error: AGENT_MODELS_LOCKED_ERROR };
         }
@@ -4967,6 +5561,7 @@ export class RunManager {
             this.store.updateRun(runId, acceptedPatch);
             this.store.flush();
         }
+        this.continuationGenerations.set(runId, Symbol());
         // Keep fresh viewable images even if persistence failed; recovery uses saved URLs.
         const images = contentBlocksOf(opts.images ?? []).filter((block) => block.type === 'image');
         if (deferForCapacity) {
@@ -5028,6 +5623,8 @@ export class RunManager {
         this.workerIdentity(runId);
         const record = this.store.getRun(runId);
         let cwd;
+        // Retention (#483) rebuilt a reclaimed directory: a bare checkout that needs setup again (#917).
+        let rematerialized = false;
         if (record?.delegation?.role === 'worker') {
             try {
                 if (record.delegation.destroy)
@@ -5047,7 +5644,7 @@ export class RunManager {
             }
         }
         else {
-            await rematerializeReclaimedWorktree(this.repoRoot, this.store, runId);
+            rematerialized = await rematerializeReclaimedWorktree(this.repoRoot, this.store, runId);
             cwd = record?.worktreePath && existsSync(record.worktreePath) ? record.worktreePath : this.repoRoot;
         }
         if (this.store.getRun(runId)?.stopping) {
@@ -5059,8 +5656,14 @@ export class RunManager {
         // The env is a live ceiling: a run created while the inbox was on must not keep writing
         // follow-ups after it is switched off.
         const generateFollowups = followupsEnabled() && record?.generateFollowups !== false;
-        const state = { delegationSettings: undefined, revokeDelegation: undefined, cancelled: false, interrupt: () => undefined, cwd, pendingHumanAsk: this.hasPendingHumanAsk(runId) };
-        this.active.set(runId, state);
+        // Continue/recovery constructs a second ActiveRun: hydrate the durable mode here too.
+        const state = {
+            delegationSettings: undefined, revokeDelegation: undefined,
+            cancelled: false, interrupt: () => undefined, cwd,
+            pendingHumanAsk: this.hasPendingHumanAsk(runId),
+            autonomous: record?.autonomous === true, autoContinues: 0,
+        };
+        this.activate(runId, state);
         this.starting.delete(runId);
         if (state.cwd === this.repoRoot) {
             if (repositoryRootLockDisabled()) {
@@ -5089,6 +5692,9 @@ export class RunManager {
         this.armAutosave(runId, state);
         if (record)
             seedHandoffFile(this.dataDir, record); // idempotent — normally already there
+        // Worktree setup (#917) for a directory retention rebuilt, or one a restart interrupted.
+        const setupNote = await this.prepareWorktree(runId, state, (await loadConfig(this.repoRoot)).worktreeSetup, (event) => this.store.appendEvent(runId, event), rematerialized ? 'rematerialized' : 'resume');
+        // A Stop during setup settles below, at the prelaunch cancellation check before any spawn.
         // Registry snapshot for `/skill` expansion. `execute` loads this for the workflow's own
         // sessions; a continuation builds its OWN ActiveRun, and without this the resumed session
         // expanded against an empty registry and leaked `/om-...` verbatim to the backend, which
@@ -5141,6 +5747,7 @@ export class RunManager {
         state.pendingHumanAsk = openingAnswerAskSeq === undefined && this.hasPendingHumanAsk(runId);
         let turnText = '';
         let completedAssistantText = '';
+        let turnTail = 'none';
         let sawClaudeScheduleWakeup = false;
         let sessionError;
         const sink = this.makeUiSink(runId, stepId);
@@ -5158,6 +5765,8 @@ export class RunManager {
             }
             if (event.type === 'text') {
                 this.clearUnreadInputTimer(state); // real content: the harness is working
+                this.clearHeldHumanInputTimer(state);
+                this.noteFinalMessageNudgeContent(runId, state, event);
                 turnText = appendTurnText(turnText, event.text);
                 const text = stripAskMarker(stripTaskMarkers(stripMonitoringMarker(stripDoneMarker(event.text))), false);
                 if (text)
@@ -5168,8 +5777,11 @@ export class RunManager {
                 this.retireUnreadInputs(runId, state, event.inputIds, true);
                 return;
             }
-            if (event.type === 'tool-call' || event.type === 'tool-result')
+            if (event.type === 'tool-call' || event.type === 'tool-result') {
                 this.clearUnreadInputTimer(state);
+                this.clearHeldHumanInputTimer(state);
+                this.noteFinalMessageNudgeContent(runId, state, event);
+            }
             this.store.appendEvent(runId, { ...event, stepId });
             if (event.type === 'cost')
                 this.recordReportedCost(runId, stepId, state, backend, event.usd);
@@ -5244,36 +5856,45 @@ export class RunManager {
                 sink.flushAll();
                 this.trackTurnEnd(runId, turnText); // titleSummary + diffStat (#389)
                 const sessionOpen = !state.cancelled && state.session?.open;
-                const done = sessionOpen && DONE_MARKER_RE.test(turnText.trimEnd());
-                // `CEZ:ASK` → the user is genuinely blocked; wins over `CEZ:MONITORING`
-                // (a pending question is always attention), loses to `CEZ:DONE` (#473).
-                const askTurn = resolveAskTurn(turnText, completedAssistantText, Boolean(sessionOpen) && !done);
-                const { ask, notes: askNotes } = askTurn;
-                discardQueuedMessagesOnAsk(state.session, askTurn);
-                const monitoring = !this.parentCompletionAttention(runId) &&
-                    sessionOpen &&
-                    !done &&
-                    !ask &&
-                    !state.pendingHumanAsk &&
-                    (MONITORING_MARKER_RE.test(turnText.trimEnd()) || sawClaudeScheduleWakeup || this.hasLiveWorkers(runId));
+                const turn = classifyTurnEnd(turnText, completedAssistantText, {
+                    sessionOpen: !!sessionOpen, interactive: true, pendingHumanAsk: !!state.pendingHumanAsk,
+                    completionAttention: this.parentCompletionAttention(runId), scheduledWake: sawClaudeScheduleWakeup,
+                    liveWorkers: this.hasLiveWorkers(runId),
+                    dependencyWait: !!(this.workerWait(runId) || this.store.getRun(runId)?.ciWait),
+                });
+                const { done, monitoring, humanGate, ask, notes: askNotes } = turn;
+                discardQueuedMessagesOnAsk(state.session, turn);
+                const silentTail = turnTail === 'silent';
+                const alreadyFinalMessageNudged = state.finalMessageNudged === state.session;
+                state.finalMessageNudged = undefined;
                 turnText = '';
                 completedAssistantText = '';
+                turnTail = 'none';
                 sawClaudeScheduleWakeup = false;
                 for (const note of askNotes)
                     this.store.appendEvent(runId, { type: 'note', ...note, stepId });
                 this.store.updateRun(runId, { invalidAsk: !ask && askNotes.length > 0 ? true : undefined });
-                if (ask)
+                // Only a newly parsed portable ASK can be overridden. Do this before
+                // prepareHumanAsk latches it; an existing/native ask still blocks the helper.
+                let autoContinued = !!ask && !!sessionOpen && this.tryAutonomousNudge(runId, state, stepId, ask);
+                if (ask && !autoContinued)
                     this.prepareHumanAsk(runId, state);
-                const ciWaitParked = !!sessionOpen && this.parkCiWait(runId, state);
+                if (humanGate && !ask && !state.pendingHumanAsk)
+                    this.prepareProseHumanGate(runId, state);
+                const ciWaitParked = !humanGate && !!sessionOpen && this.parkCiWait(runId, state);
                 const completionBlocked = !ciWaitParked && !!done && this.deferParentCompletion(runId);
-                const workerWaitParked = ciWaitParked || completionBlocked || (!!sessionOpen && this.parkWorkerWait(runId, state));
+                const workerWaitParked = ciWaitParked || completionBlocked || (!humanGate && !!sessionOpen && this.parkWorkerWait(runId, state));
                 state.doneAtBoundary = done ? state.session : undefined;
-                state.parkAfterAck = sessionOpen && state.session ? { session: state.session, monitoring: !!monitoring } : undefined;
+                state.parkAfterAck = sessionOpen && state.session ? { session: state.session, monitoring, humanGate, silentTail, alreadyFinalMessageNudged } : undefined;
                 // #505: input the harness accepted but has not read yet runs as its next turn.
                 // An in-flight submission is settled by its acknowledgement (parkAfterAck), not here.
-                const agentInputDelivered = !ask && !workerWaitParked && (this.flushAgentInputs(runId) || this.harnessOwesInput(state) || !!state.agentInputFlight);
+                const agentInputDelivered = autoContinued || (!ask && !workerWaitParked && (this.flushAgentInputs(runId) || (!humanGate && this.harnessOwesInput(state)) || !!state.agentInputFlight || this.harnessHoldsHumanInput(state)));
                 if (!ask && !workerWaitParked)
                     this.armUnreadInputTimer(runId, state);
+                if (!ask && !workerWaitParked && this.harnessHoldsHumanInput(state))
+                    this.armHeldHumanInputTimer(runId, state);
+                else
+                    this.clearHeldHumanInputTimer(state);
                 if (state.agentInputError)
                     return;
                 if (done && !workerWaitParked && !state.pendingHumanAsk && !agentInputDelivered && !state.agentInputFlight && !this.hasQueuedAgentInputs(runId)) {
@@ -5284,26 +5905,13 @@ export class RunManager {
                     return;
                 }
                 if (sessionOpen && !agentInputDelivered && !workerWaitParked && !this.workerWakeAdmitted.has(runId)) {
-                    // Autonomous (#autonomous): never hand the ball back to the user. Nudge the agent to
-                    // keep going (bounded by MAX_AUTO_CONTINUES) instead of parking at `waiting`.
-                    const autoContinued = state.autonomous &&
-                        !this.parentCompletionPending(runId) &&
-                        !state.pendingHumanAsk &&
-                        !this.hasQueuedAgentInputs(runId) &&
-                        (state.autoContinues ?? 0) < MAX_AUTO_CONTINUES &&
-                        !state.cancelled &&
-                        (() => {
-                            const sent = this.submitAgentInput(runId, state, [{ type: 'text', text: AUTONOMOUS_NUDGE }]);
-                            if (!sent)
-                                return false;
-                            state.autoContinues = (state.autoContinues ?? 0) + 1;
-                            this.store.appendEvent(runId, {
-                                type: 'note',
-                                message: `autonomous — continuing without pausing (${state.autoContinues}/${MAX_AUTO_CONTINUES})`,
-                            });
-                            return true;
-                        })();
-                    if (!autoContinued) {
+                    if (!ask && !humanGate)
+                        autoContinued = this.tryAutonomousNudge(runId, state, stepId, null);
+                    if (!autoContinued)
+                        autoContinued = this.maybeFinalMessageNudge(runId, state, stepId, {
+                            ask: !!ask, humanGate, monitoring, silentTail, alreadyNudged: alreadyFinalMessageNudged,
+                        });
+                    if (!autoContinued && state.autonomousNudgePending !== state.session) {
                         // `CEZ:ASK` → park `waiting` (attention) AND surface the structured
                         // question as an ask card (#473). `CEZ:MONITORING` or Claude's native
                         // `ScheduleWakeup` → non-attention `running`/`activity:'monitoring'`
@@ -5341,7 +5949,7 @@ export class RunManager {
                 if (this.store.getRun(runId)?.autoResumeAttempts !== undefined) {
                     this.store.updateRun(runId, { autoResumeAttempts: undefined });
                 }
-                appendHandoffHeartbeat(this.dataDir, runId, `turn complete — status=${agentInputDelivered ? 'running' : monitoring ? 'monitoring' : sessionOpen ? 'waiting' : 'running'}`);
+                appendHandoffHeartbeat(this.dataDir, runId, `turn complete — status=${autoContinued ? (state.finalMessageNudged === state.session ? 'running (final message nudge)' : 'running (autonomous nudge)') : state.autonomousNudgePending && state.autonomousNudgePending === state.session ? 'running (awaiting input readiness)' : agentInputDelivered ? 'running' : monitoring ? 'monitoring' : sessionOpen ? 'waiting' : 'running'}`);
             }
         };
         // Backend + model come off the record: the run's current backend by default, or the
@@ -5466,13 +6074,70 @@ export class RunManager {
             effort: continueEffort, agentProfile: continueProfile.profileId, accountBinding: continueProfile.accountBinding,
             systemPrompt: record?.systemPrompt, allowedTools: grants.allowedTools, bashAllowlist: grants.bashAllowlist };
         const runner = createRunner(continueBackend);
+        // Re-expand the continued step's skill from the current registry (#790) BEFORE
+        // provisionSession. `await materializeSkillDir` used to sit after the pre-launch
+        // revalidation, so Stop during that await still launched with revoked tools.
+        // `record.systemPrompt` is only the extra prompt; the opening session put
+        // `skillSystemPrompt(skill)` in front. Skip that prefix only when this
+        // session resumes into its own thread on an in-thread runner — those
+        // already carry the playbook in history. A missing skill degrades to
+        // today's extra-only prompt with one lifecycle warning; in-thread skips
+        // do not warn. Workers still inherit only the extra prompt (#778).
+        const skipSkillOnResume = sessionId !== undefined && runner.systemPromptOnResume === 'in-thread';
+        let continuationSkillPrompt;
+        let fallbackSkillPrompt;
+        const continuedSkillName = toolsStep?.skill;
+        if (continuedSkillName) {
+            let skill = (state.skills ?? []).find((candidate) => candidate.name === continuedSkillName);
+            if (!skill) {
+                // Boot recovery can outrun the async team-skills cache (`getTeamSkillsCached`
+                // returns [] until `initialTeamSkillsLoad` resolves). Wait briefly, then
+                // re-discover; never hang Continue on the network. The on-disk clone's
+                // list arrives before the passive fetch (#859), so stop as soon as it
+                // names this skill instead of waiting out a slow first fetch of the day.
+                try {
+                    await new Promise((resolve) => {
+                        const timeout = setTimeout(resolve, 1_500);
+                        timeout.unref?.();
+                        const settle = () => { clearTimeout(timeout); resolve(); };
+                        waitForTeamSkills(this.repoRoot).then(settle, settle);
+                        waitForCachedTeamSkills(this.repoRoot).then((cached) => {
+                            if (cached.some((candidate) => candidate.name === continuedSkillName))
+                                settle();
+                        }, () => undefined);
+                    });
+                    state.skills = await discoverSkills(this.repoRoot).catch(() => state.skills ?? []);
+                    skill = (state.skills ?? []).find((candidate) => candidate.name === continuedSkillName);
+                }
+                catch {
+                    // Best-effort — a slow or failing team-skills load must not fail Continue.
+                }
+            }
+            if (skill) {
+                const playbook = skillSystemPrompt(skill);
+                if (skipSkillOnResume)
+                    fallbackSkillPrompt = playbook;
+                else
+                    continuationSkillPrompt = playbook;
+                if (skill.source === 'team' && skill.team?.dir) {
+                    // Rematerialize into a #483 rematerialized worktree; do not note it on Continue.
+                    await materializeSkillDir(state.cwd, skill).catch(() => false);
+                }
+            }
+            else if (!skipSkillOnResume) {
+                this.store.appendEvent(runId, {
+                    type: 'lifecycle',
+                    message: `skill /${continuedSkillName} is not in the skill registry — its instructions were not re-sent to the continued session`,
+                });
+            }
+        }
         state.currentStepId = stepId;
         this.beginUsageInvocation(runId, state, stepId);
         // A continuation's opening message becomes the session's `userPrompt` and never passes
         // through `deliverMessage`, so it needs the SAME delivery-only `/skill` rewrite the
         // live path applies (#811). Delivery-only: the `user-message` event above already
         // persisted the user's original text, and the transcript must keep showing that.
-        const openingPrompt = expandRegistrySlashSkillText(prompt, state.skills ?? []);
+        const openingPrompt = expandRegistrySlashSkillText(prompt, state.skills ?? []) + (setupNote ? `\n\n${setupNote}` : '');
         state.agentSessionError = undefined;
         let session;
         if (this.workerExecutionStopped(runId)) {
@@ -5506,11 +6171,17 @@ export class RunManager {
         state.unreadInputIds = new Set();
         state.consumedBeforeAck = new Set();
         try {
+            const continuationTail = composeSystemPrompt(record?.systemPrompt, delegation?.instructions, artifactInstructions(continueProfile.env.CEZ_ARTIFACTS_DIR), generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS);
             session = startManagedSession(runner, {
-                // The Continue step is a fresh agent session on the same run — the
-                // run's extra system prompt (already resolved at execute time and
-                // echoed on the record) rides along with the handoff contract.
-                systemPrompt: composeSystemPrompt(record?.systemPrompt, delegation?.instructions, artifactInstructions(continueProfile.env.CEZ_ARTIFACTS_DIR), generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS),
+                // Skill body (when resent), then the run's extra system prompt, then
+                // the handoff contract — the same order as the opening session (#790).
+                // In-thread resume omits the skill from systemPrompt; OpenCode's 404
+                // fallback uses resumeFallbackSystemPrompt so the fresh session still
+                // gets the playbook.
+                systemPrompt: composeSystemPrompt(continuationSkillPrompt, continuationTail),
+                ...(skipSkillOnResume ? {
+                    resumeFallbackSystemPrompt: composeSystemPrompt(fallbackSkillPrompt, continuationTail),
+                } : {}),
                 userPrompt: attachments.length
                     ? `${openingPrompt}\n\n${pastedAttachmentsText(attachments)}`
                     : openingPrompt,
@@ -5530,12 +6201,14 @@ export class RunManager {
             }, onEvent, {
                 onUiEvent: (event) => {
                     completedAssistantText = appendCompletedAssistantText(completedAssistantText, event);
+                    turnTail = trackTurnTail(turnTail, event);
                     if (event.type === 'turn.started')
                         this.recordOpeningAccepted(runId, state);
                     this.handleRunnerUiEvent(runId, state, sink, event);
                 },
                 onAgentInputReady: () => this.handleAgentInputReady(runId, state, session),
                 onAgentInputConsumed: (ids) => this.handleAgentInputConsumed(runId, state, session, ids),
+                onPidChange: (pid) => { registerRunProcess(runId, pid); this.recordWorkerProcess(runId, pid); },
             });
         }
         catch (error) {
@@ -5580,7 +6253,7 @@ export class RunManager {
                 this.store.appendEvent(runId, { type: 'lifecycle', message: 'run cancelled' });
                 appendHandoffHeartbeat(this.dataDir, runId, `step "${stepId}" complete — status=cancelled`);
             }
-            else if (!state.idleClosed) {
+            else if (!state.idleClosed && !this.unansweredWorkflowAsk(runId, state)) {
                 this.store.updateStep(runId, stepId, { status: 'done', finishedAt: finishedAt() });
                 this.store.appendEvent(runId, { type: 'step-end', stepId, status: 'done' });
                 const completed = this.store.getRun(runId);
@@ -5589,7 +6262,10 @@ export class RunManager {
                     const waitingStep = completed.workflowDef.steps[waitingIndex];
                     this.store.updateStep(runId, waitingStep.id, { status: 'done', finishedAt: finishedAt() });
                     this.store.appendEvent(runId, { type: 'step-end', stepId: waitingStep.id, status: 'done' });
-                    if (waitingIndex < completed.workflowDef.steps.length - 1) {
+                    // Finish accepts this resumed step before the async settlement gate,
+                    // but must not launch the remaining workflow. A later cancellation
+                    // may cancel still-live steps, never this completed one (R30).
+                    if (!state.finishRequested && waitingIndex < completed.workflowDef.steps.length - 1) {
                         resumeWorkflow = {
                             workflow: completed.workflowDef,
                             startAt: waitingIndex + 1,
@@ -5622,7 +6298,7 @@ export class RunManager {
                 }
             }
             else {
-                await this.settleIdleClosedWorker(runId);
+                await this.settleIdleClosedRun(runId, state);
             }
         }
         catch (err) {
@@ -5696,7 +6372,7 @@ export class RunManager {
             autonomous: input.autonomous === true,
             autoContinues: 0,
         };
-        this.active.set(runId, state);
+        this.activate(runId, state);
         this.starting.delete(runId);
         const emit = (event) => this.store.appendEvent(runId, event);
         // Resolve the agent backend for this run: the task choice (GUI) wins over
@@ -5872,6 +6548,9 @@ export class RunManager {
         const seeded = this.store.getRun(runId);
         if (seeded)
             seedHandoffFile(this.dataDir, seeded);
+        // Worktree setup (#917): before the first step, so the agent starts in a prepared tree. Its
+        // note rides the first agent step's opening message only, like the task's attachments.
+        let startSetupNote = await this.prepareWorktree(runId, state, config.worktreeSetup, emit, 'start');
         const skills = await discoverSkills(this.repoRoot);
         // Every ActiveRun construction site must carry the registry — `runContinuation` builds
         // its own, and the one that skipped this leaked raw `/skill` text to the backend (#811).
@@ -5943,9 +6622,10 @@ export class RunManager {
                 // The last agent step of the workflow is interactive: after its turn
                 // the session stays open for follow-ups until finish/idle/cancel.
                 const interactive = i === lastAgentIdx && i === workflow.steps.length - 1;
-                const failure = await this.runAgentStep(runId, state, step, input, skills, checkFailure, interactive, emit, startImages, taskBackend, extraSystemPrompt, chainStepNote(workflow.steps, i), startAttachments);
+                const failure = await this.runAgentStep(runId, state, step, input, skills, checkFailure, interactive, emit, startImages, taskBackend, extraSystemPrompt, chainStepNote(workflow.steps, i), startAttachments, startSetupNote);
                 startImages = undefined;
                 startAttachments = [];
+                startSetupNote = undefined;
                 checkFailure = null;
                 // Stale setup cannot finalize a replacement owner. Disposal also clears
                 // active, but must still honor a previously accepted Stop/Finish intent.
@@ -5970,9 +6650,12 @@ export class RunManager {
                     runError = `step "${step.id}" failed: ${failure}`;
                     break;
                 }
-                if (state.idleClosed)
+                if (state.idleClosed || this.unansweredWorkflowAsk(runId, state))
                     break;
                 this.finishStep(runId, step.id, 'done', undefined, emit);
+                // Finish is an explicit stop, not an answer or permission to run checks.
+                if (state.finishRequested)
+                    break;
                 i++;
                 continue;
             }
@@ -6037,8 +6720,8 @@ export class RunManager {
             this.store.updateRun(runId, { status: 'failed', error: runError, finishedAt, currentStepId: undefined });
             emit({ type: 'lifecycle', message: `run failed — ${runError}` });
         }
-        else if (state.idleClosed) {
-            await this.settleIdleClosedWorker(runId);
+        else if (state.idleClosed || this.unansweredWorkflowAsk(runId, state)) {
+            await this.settleIdleClosedRun(runId, state);
             this.dropActive(runId);
             return;
         }
@@ -6056,7 +6739,9 @@ export class RunManager {
     /** Pasted attachments already materialized to disk (#357) — their absolute
      *  paths are appended to `userPrompt` so the agent can operate on the
      *  real files, not just view the inline image blocks. */
-    attachments = []) {
+    attachments = [], 
+    /** Worktree setup's paragraph for the agent (#917) — appended to the opening message. */
+    openingNote) {
         let systemPrompt;
         if (step.skill) {
             const skill = skills.find((s) => s.name === step.skill);
@@ -6117,6 +6802,8 @@ export class RunManager {
         // location of.
         if (attachments.length)
             userPrompt += `\n\n${pastedAttachmentsText(attachments)}`;
+        if (openingNote)
+            userPrompt += `\n\n${openingNote}`;
         const sessionId = randomUUID();
         const backend = step.runner ?? taskBackend;
         this.store.updateStep(runId, step.id, { sessionId, backend });
@@ -6124,6 +6811,7 @@ export class RunManager {
         const startTokens = stepRecord?.tokensUsed ?? 0;
         let turnText = '';
         let completedAssistantText = '';
+        let turnTail = 'none';
         let sawClaudeScheduleWakeup = false;
         let sessionError;
         const sink = this.makeUiSink(runId, step.id);
@@ -6141,6 +6829,8 @@ export class RunManager {
             }
             if (event.type === 'text') {
                 this.clearUnreadInputTimer(state); // real content: the harness is working
+                this.clearHeldHumanInputTimer(state);
+                this.noteFinalMessageNudgeContent(runId, state, event);
                 turnText = appendTurnText(turnText, event.text);
                 const text = stripAskMarker(stripTaskMarkers(stripMonitoringMarker(stripDoneMarker(event.text))), false);
                 if (text)
@@ -6151,8 +6841,11 @@ export class RunManager {
                 this.retireUnreadInputs(runId, state, event.inputIds, true);
                 return;
             }
-            if (event.type === 'tool-call' || event.type === 'tool-result')
+            if (event.type === 'tool-call' || event.type === 'tool-result') {
                 this.clearUnreadInputTimer(state);
+                this.clearHeldHumanInputTimer(state);
+                this.noteFinalMessageNudgeContent(runId, state, event);
+            }
             emit({ ...event, stepId: step.id });
             if (event.type === 'cost')
                 this.recordReportedCost(runId, step.id, state, backend, event.usd);
@@ -6186,37 +6879,45 @@ export class RunManager {
                 sink.flushAll();
                 this.trackTurnEnd(runId, turnText); // titleSummary + diffStat (#389)
                 const sessionOpen = !state.cancelled && state.session?.open;
-                const done = interactive && sessionOpen && DONE_MARKER_RE.test(turnText.trimEnd());
-                // `CEZ:ASK` → the user is blocked; wins over `CEZ:MONITORING`, loses to
-                // `CEZ:DONE` (#473).
-                const askTurn = resolveAskTurn(turnText, completedAssistantText, Boolean((interactive || this.workerWait(runId) || this.store.getRun(runId)?.ciWait) && sessionOpen) && !done);
-                const { ask, notes: askNotes } = askTurn;
-                discardQueuedMessagesOnAsk(state.session, askTurn);
-                const monitoring = !this.parentCompletionAttention(runId) &&
-                    interactive &&
-                    sessionOpen &&
-                    !done &&
-                    !ask &&
-                    !state.pendingHumanAsk &&
-                    (MONITORING_MARKER_RE.test(turnText.trimEnd()) || sawClaudeScheduleWakeup || this.hasLiveWorkers(runId));
+                const turn = classifyTurnEnd(turnText, completedAssistantText, {
+                    sessionOpen: !!sessionOpen, interactive, pendingHumanAsk: !!state.pendingHumanAsk,
+                    completionAttention: this.parentCompletionAttention(runId), scheduledWake: sawClaudeScheduleWakeup,
+                    liveWorkers: this.hasLiveWorkers(runId),
+                    dependencyWait: !!(this.workerWait(runId) || this.store.getRun(runId)?.ciWait),
+                });
+                const { done, monitoring, humanGate, ask, notes: askNotes } = turn;
+                discardQueuedMessagesOnAsk(state.session, turn);
+                const silentTail = turnTail === 'silent';
+                const alreadyFinalMessageNudged = state.finalMessageNudged === state.session;
+                state.finalMessageNudged = undefined;
                 turnText = '';
                 completedAssistantText = '';
+                turnTail = 'none';
                 sawClaudeScheduleWakeup = false;
                 for (const note of askNotes)
                     emit({ type: 'note', stepId: step.id, ...note });
                 this.store.updateRun(runId, { invalidAsk: !ask && askNotes.length > 0 ? true : undefined });
-                if (ask)
+                // Only a newly parsed portable ASK can be overridden. Do this before
+                // prepareHumanAsk latches it; an existing/native ask still blocks the helper.
+                let autoContinued = !!ask && !!sessionOpen && this.tryAutonomousNudge(runId, state, step.id, ask);
+                if (ask && !autoContinued)
                     this.prepareHumanAsk(runId, state);
-                const ciWaitParked = !!sessionOpen && this.parkCiWait(runId, state);
+                if (humanGate && !ask && !state.pendingHumanAsk)
+                    this.prepareProseHumanGate(runId, state);
+                const ciWaitParked = !humanGate && !!sessionOpen && this.parkCiWait(runId, state);
                 const completionBlocked = !ciWaitParked && !!done && this.deferParentCompletion(runId);
-                const workerWaitParked = ciWaitParked || completionBlocked || (!!sessionOpen && this.parkWorkerWait(runId, state));
+                const workerWaitParked = ciWaitParked || completionBlocked || (!humanGate && !!sessionOpen && this.parkWorkerWait(runId, state));
                 state.doneAtBoundary = done ? state.session : undefined;
-                state.parkAfterAck = interactive && sessionOpen && state.session ? { session: state.session, monitoring: !!monitoring } : undefined;
+                state.parkAfterAck = (interactive || humanGate) && sessionOpen && state.session ? { session: state.session, monitoring, humanGate, silentTail, alreadyFinalMessageNudged } : undefined;
                 // #505: input the harness accepted but has not read yet runs as its next turn.
                 // An in-flight submission is settled by its acknowledgement (parkAfterAck), not here.
-                const agentInputDelivered = !ask && !workerWaitParked && (this.flushAgentInputs(runId) || this.harnessOwesInput(state) || !!state.agentInputFlight);
+                const agentInputDelivered = autoContinued || (!ask && !workerWaitParked && (this.flushAgentInputs(runId) || (!humanGate && this.harnessOwesInput(state)) || !!state.agentInputFlight || this.harnessHoldsHumanInput(state)));
                 if (!ask && !workerWaitParked)
                     this.armUnreadInputTimer(runId, state);
+                if (!ask && !workerWaitParked && this.harnessHoldsHumanInput(state))
+                    this.armHeldHumanInputTimer(runId, state);
+                else
+                    this.clearHeldHumanInputTimer(state);
                 if (state.agentInputError)
                     return;
                 if (done && !workerWaitParked && !state.pendingHumanAsk && !agentInputDelivered && !state.agentInputFlight && !this.hasQueuedAgentInputs(runId)) {
@@ -6227,8 +6928,14 @@ export class RunManager {
                     state.session?.end();
                     return;
                 }
-                const waiting = (interactive || !!ask) && sessionOpen && !agentInputDelivered && !workerWaitParked && !this.workerWakeAdmitted.has(runId);
-                if (waiting) {
+                const waiting = (interactive || !!ask || humanGate) && sessionOpen && !agentInputDelivered && !workerWaitParked && !this.workerWakeAdmitted.has(runId);
+                if (waiting && interactive && !ask && !humanGate)
+                    autoContinued = this.tryAutonomousNudge(runId, state, step.id, null);
+                if (waiting && interactive && !autoContinued)
+                    autoContinued = this.maybeFinalMessageNudge(runId, state, step.id, {
+                        ask: !!ask, humanGate, monitoring, silentTail, alreadyNudged: alreadyFinalMessageNudged,
+                    });
+                if (waiting && !autoContinued && state.autonomousNudgePending !== state.session) {
                     // Turn over, session open. Either the ball is in the user's court
                     // (`waiting`) — optionally with a structured `CEZ:ASK` question the
                     // cockpit renders as an ask card (#473) — or the agent declared it is
@@ -6264,7 +6971,7 @@ export class RunManager {
                 }
                 // Cez's own heartbeat — the handoff stays current even when the
                 // agent forgets to write (spec 007).
-                appendHandoffHeartbeat(this.dataDir, runId, `turn complete — status=${monitoring ? 'monitoring' : waiting ? 'waiting' : 'running'}`);
+                appendHandoffHeartbeat(this.dataDir, runId, `turn complete — status=${autoContinued ? (state.finalMessageNudged === state.session ? 'running (final message nudge)' : 'running (autonomous nudge)') : state.autonomousNudgePending && state.autonomousNudgePending === state.session ? 'running (awaiting input readiness)' : agentInputDelivered ? 'running' : monitoring ? 'monitoring' : waiting ? 'waiting' : 'running'}`);
             }
         };
         const stepBackend = step.runner ?? taskBackend;
@@ -6326,15 +7033,17 @@ export class RunManager {
         const grants = stepIdentity?.grants ?? {
             allowedTools: allowedToolsForStep(step, stepBackend), bashAllowlist: step.bashAllowlist,
         };
+        // Workers inherit only the extra prompt, never the parent's selected skill (#778).
         state.delegationSettings = { cwd: state.cwd, runner: stepBackend, model: backendModel,
             effort: effectiveEffort,
-            agentProfile: stepProfile.profileId, accountBinding: stepProfile.accountBinding, systemPrompt: composeSystemPrompt(systemPrompt, extraSystemPrompt),
+            agentProfile: stepProfile.profileId, accountBinding: stepProfile.accountBinding, systemPrompt: extraSystemPrompt,
             allowedTools: grants.allowedTools, bashAllowlist: grants.bashAllowlist };
         const runner = createRunner(stepBackend);
         state.agentSessionError = undefined;
         let session;
         const shouldAutoEnd = () => this.active.get(runId) !== state || state.session !== session ||
-            (!this.workerWait(runId) && !this.store.getRun(runId)?.ciWait && !this.parentCompletionPending(runId) &&
+            (state.atTurnBoundary === session && !state.pendingHumanAsk && !this.hasPendingHumanAsk(runId) &&
+                !this.workerWait(runId) && !this.store.getRun(runId)?.ciWait && !this.parentCompletionPending(runId) &&
                 state.workerWakeTurn !== session && state.ciWakeTurn !== session && !state.agentInputFlight &&
                 !this.hasQueuedAgentInputs(runId));
         state.currentStepId = step.id;
@@ -6385,14 +7094,18 @@ export class RunManager {
                 timeoutMs: step.timeoutMs ?? 0,
             }, onEvent, {
                 autoEndAfterFirstTurn: !interactive,
-                // Unread inbox claims must survive this window so release/expiry can replay them.
+                // Questions and unread inbox claims must survive this close window.
+                // Keep the native timer: the answer's completed turn rearms it, and
+                // admission/worker/CI guards retain authority over when it may close.
                 shouldAutoEnd,
                 onUiEvent: (event) => {
                     completedAssistantText = appendCompletedAssistantText(completedAssistantText, event);
+                    turnTail = trackTurnTail(turnTail, event);
                     this.handleRunnerUiEvent(runId, state, sink, event);
                 },
                 onAgentInputReady: () => this.handleAgentInputReady(runId, state, session),
                 onAgentInputConsumed: (ids) => this.handleAgentInputConsumed(runId, state, session, ids),
+                onPidChange: (pid) => { registerRunProcess(runId, pid); this.recordWorkerProcess(runId, pid); },
             });
         }
         catch (err) {
@@ -6517,6 +7230,7 @@ export class RunManager {
     /** Ask precedence also releases an admitted but not yet delivered worker wake.
      * Its durable input/wait remain queued until an actual human answer. */
     prepareHumanAsk(runId, state) {
+        state.autonomousNudgePending = undefined;
         this.withdrawCiWait(runId);
         state.pendingHumanAsk = true;
         this.workerWaiting.delete(runId);
@@ -6527,6 +7241,17 @@ export class RunManager {
                 this.queue.splice(at, 1);
         }
     }
+    /** A prose or rejected-ASK fallback supersedes a registered autonomous wait. Keep the
+     * checkpoint through idle closure/restart and hold worker input until a
+     * successful human delivery, just as for a structured ask. */
+    prepareProseHumanGate(runId, state) {
+        this.store.appendEvent(runId, { type: 'note', stepId: state.currentStepId,
+            code: PROSE_HUMAN_GATE, message: 'waiting for a human response to the assistant’s request' });
+        this.prepareHumanAsk(runId, state);
+        this.withdrawWorkerWait(runId);
+        this.clearUnreadInputTimer(state);
+        this.clearHeldHumanInputTimer(state);
+    }
     /** Native backend asks arrive before turn-end. Persist and park immediately
      * so the cockpit shows attention and the run releases its workspace slot. */
     handleRunnerUiEvent(runId, state, sink, event) {
@@ -6536,7 +7261,13 @@ export class RunManager {
         sink.handle(event);
         if (state.cancelled)
             return;
+        this.noteFinalMessageNudgeContent(runId, state, event);
         if (isRunnerActivity(event)) {
+            if (state.autonomousNudgePending) {
+                state.autonomousNudgePending = undefined;
+                this.clearIdleTimer(state);
+            }
+            this.clearHeldHumanInputTimer(state);
             state.atTurnBoundary = undefined;
             state.doneAtBoundary = undefined;
             state.parkAfterAck = undefined;
@@ -6860,6 +7591,8 @@ export class RunManager {
      * off — settle straight to `done`, leaving the diff in the worktree untouched.
      */
     async settleSuccess(runId, durableRootFinish = false) {
+        const state = this.active.get(runId);
+        const continuationGeneration = this.continuationGenerations.get(runId);
         if (this.deferParentCompletion(runId))
             return;
         const run = this.store.getRun(runId);
@@ -6872,7 +7605,29 @@ export class RunManager {
             const config = await loadConfig(this.repoRoot);
             review = hasDiff && reviewGateEnabled(config) && run.autonomous !== true;
         }
-        // Diff/config I/O can race a worker's accepted continuation or a new child.
+        // Diff/config I/O can race cancellation or a replacement execution. Re-read
+        // the record before touching steps, and never settle another session's work.
+        const current = this.store.getRun(runId);
+        const active = this.active.get(runId);
+        // Disposal clears active, but cannot revoke an already accepted Finish/Stop.
+        // A different active state is still a replacement, even after disposal.
+        const disposedWithTerminalIntent = this.disposed && active === undefined && (state?.finishRequested || state?.cancelled);
+        if (!current || !['queued', 'running', 'waiting'].includes(current.status) ||
+            this.continuationGenerations.get(runId) !== continuationGeneration ||
+            (active !== state && !disposedWithTerminalIntent))
+            return;
+        if (state?.cancelled) {
+            const finishedAt = new Date().toISOString();
+            for (const step of current.steps) {
+                if (step.status === 'running' || step.status === 'waiting') {
+                    this.store.updateStep(runId, step.id, { status: 'cancelled', finishedAt: step.finishedAt ?? finishedAt });
+                }
+            }
+            this.store.updateRun(runId, { status: 'cancelled', finishedAt, currentStepId: undefined });
+            this.store.appendEvent(runId, { type: 'lifecycle', message: 'run cancelled' });
+            return;
+        }
+        // A worker's accepted continuation or a new child can defer parent completion.
         if (this.deferParentCompletion(runId))
             return;
         if (durableRootFinish) {
@@ -6882,9 +7637,17 @@ export class RunManager {
                 return;
         }
         else {
+            const finishedAt = new Date().toISOString();
+            // An idle-closed Continue remains waiting until the whole task succeeds.
+            // Complete those intermediate steps before publishing terminal run status.
+            for (const step of this.store.getRun(runId)?.steps ?? []) {
+                if (step.status === 'running' || step.status === 'waiting') {
+                    this.store.updateStep(runId, step.id, { status: 'done', finishedAt: step.finishedAt ?? finishedAt });
+                }
+            }
             this.store.updateRun(runId, {
                 status: review ? 'review' : 'done',
-                finishedAt: new Date().toISOString(),
+                finishedAt,
                 currentStepId: undefined,
                 // A run that got all the way to a settled turn is not in a limit loop, so the resume
                 // counter starts over — otherwise a task that legitimately met the limit once a week would
@@ -6899,6 +7662,25 @@ export class RunManager {
                 : 'run finished',
         });
     }
+    /** Called only after session/process settlement. A refused nudge retained its
+     * slot and running status until idle close; ordinary roots must now become
+     * resumable. Previously parked roots and delegated lifecycle policy stay intact. */
+    async settleIdleClosedRun(runId, state) {
+        const run = this.store.getRun(runId);
+        if (run?.delegation?.role === 'worker') {
+            await this.settleIdleClosedWorker(runId);
+            return;
+        }
+        if (!run || !state.autonomousNudgePending || run.ciWait || this.workerWait(runId) || this.hasPendingHumanAsk(runId))
+            return;
+        for (const step of run.steps) {
+            if (step.status === 'running')
+                this.store.updateStep(runId, step.id, { status: 'waiting' });
+        }
+        this.store.updateRun(runId, { status: 'waiting', activity: undefined });
+        appendHandoffHeartbeat(this.dataDir, runId, 'session idle-closed — status=waiting; Continue to resume');
+        this.store.flush();
+    }
     /** An ordinary owned worker cannot accept an inactive Continue. Once its
      * idle-closed process has ended, publish the same terminal outcome recovery
      * would produce so its parent can collect it. Explicit asks and worker waits
@@ -7005,6 +7787,161 @@ export class RunManager {
             return null;
         }
     }
+    /** Shared stop/input/liveness guards for an automatic continuation. */
+    canAutoContinue(runId, state) {
+        const run = this.store.getRun(runId);
+        return !!run && !this.disposed && !run.stopping && !state.cancelled && !state.finishRequested &&
+            !state.agentInputError && !state.pendingHumanAsk && !this.hasPendingHumanAsk(runId) && !!state.session?.open &&
+            !this.workerExecutionStopped(runId) && !this.executionBlockedByRootFinish(run) && !this.parentCompletionPending(runId) &&
+            !this.workerWait(runId) && !run.ciWait && !this.workerWakeAdmitted.has(runId) &&
+            !state.agentInputFlight && !this.harnessOwesInput(state) && !this.hasQueuedAgentInputs(runId);
+    }
+    /**
+     * Both turn-end paths keep a nudged session running, with no user-wait timer or
+     * released slot. The next turn can finish with DONE, nudge again, or park at the
+     * cap (waiting/monitoring with their existing wake/idle rules). Queued/accepted
+     * input, worker/CI waits and parent completion keep priority. Cancel, Finish,
+     * disposal and memory pause stop nudging; provider errors/exits use normal
+     * teardown. Native mid-turn asks still park for an answer (outside this policy).
+     * A refused ordinary nudge waits for readiness at this exact boundary; the idle
+     * timeout bounds a missing readiness signal. New activity/input invalidates it.
+     * A refused portable override falls back to normal question parking.
+     */
+    tryAutonomousNudge(runId, state, stepId, ask) {
+        const session = state.session;
+        if (!state.autonomous || !session || !this.canAutoContinue(runId, state))
+            return false;
+        state.autonomousNudgePending = undefined;
+        this.clearIdleTimer(state);
+        if ((state.autoContinues ?? 0) >= MAX_AUTO_CONTINUES) {
+            this.store.appendEvent(runId, { type: 'note', stepId, message: `autonomous — safety cap reached (${MAX_AUTO_CONTINUES}); automatic continuation paused` });
+            return false;
+        }
+        const content = [{ type: 'text', text: AUTONOMOUS_NUDGE }];
+        // sendAgentMessage deliberately refuses portable asks on some native wires.
+        // The existing answer transport clears that marker, but is safe ONLY for this
+        // fresh turn-end ASK: the guards above exclude every pending native/persisted
+        // question. Do not route via deliverMessage, which attributes a human answer.
+        // Ordinary nudges keep #505's acknowledged agent-input failure semantics.
+        const sent = ask ? session.sendMessage(content) : this.submitAgentInput(runId, state, content);
+        if (!sent) {
+            // A portable override uses sendMessage: its POST may still be awaiting ACK
+            // after the next SSE turn ends. It is not an agentInputFlight. Keep this
+            // exact boundary running until onAgentInputReady retries, without charging
+            // the cap or claiming delivery. Missing readiness closes via the idle bound.
+            if (!ask && session.open && !state.agentInputError && !state.agentSessionError) {
+                state.autonomousNudgePending = session;
+                this.armIdleTimer(runId, state);
+            }
+            return false;
+        }
+        if (ask)
+            this.resumeParkedRun(runId, state);
+        state.autoContinues = (state.autoContinues ?? 0) + 1;
+        this.store.appendEvent(runId, {
+            type: 'note', stepId,
+            message: `autonomous — continuing without pausing (${state.autoContinues}/${MAX_AUTO_CONTINUES})`,
+        });
+        // The marker is stripped from visible text. Retain the question as a note,
+        // never an ask card or a fabricated human-input-delivered acknowledgement.
+        if (ask)
+            this.store.appendEvent(runId, {
+                type: 'note', stepId,
+                message: `autonomous — question overridden by the auto-continue nudge: ${ask.questions.map(question => question.question).join(' | ')}`,
+            });
+        return true;
+    }
+    /** Shared silent-tail conditions for the one-shot visible-message nudge. Callers must
+     *  invoke this only when nothing else already continued. */
+    maybeFinalMessageNudge(runId, state, stepId, turn) {
+        if (turn.ask || turn.humanGate || turn.monitoring || !turn.silentTail || turn.alreadyNudged)
+            return false;
+        if (state.autonomousNudgePending === state.session)
+            return false;
+        return this.tryFinalMessageNudge(runId, state, stepId);
+    }
+    /** One-shot visible-message nudge when a turn ends on reasoning or a tool (#544, #119).
+     *  Liveness: this path has no inputIds, so #505's unread-input timer does not apply, and
+     *  resumeParkedRun / clearIdleTimer drop the user-wait idle bound. Do not re-arm idle until
+     *  content arrives — some harnesses omit `turn.started` and still run (N8); idle would then
+     *  kill a live turn. OpenCode heartbeats re-arm the managed-session no-progress guard without
+     *  opening a turn, so an ACK that stays silent is bounded by FINAL_MESSAGE_NUDGE_REPLY_MS:
+     *  parent-level v1 content (text, tool-call, tool-result) and UiEvent items count at any time,
+     *  including before the timer is armed; `turn.started` counts after arm or while
+     *  `finalMessageNudgeParked` matches the session (OpenCode/Cursor emit a synthetic one inside
+     *  sendAgentMessage). Nested `item.*` with `parentItemId` is ignored.
+     *  Expiry parks `waiting` and latches `finalMessageNudgeParked`; a late reply from that session
+     *  resumes. User-authored delivery resets the one-shot latch; expiry does not. */
+    tryFinalMessageNudge(runId, state, stepId) {
+        if (state.finalMessageNudged === state.session || !this.canAutoContinue(runId, state))
+            return false;
+        state.finalMessageNudgeSawContent = false;
+        const sent = this.submitAgentInput(runId, state, [{ type: 'text', text: FINAL_MESSAGE_NUDGE }]);
+        if (!sent)
+            return false;
+        state.finalMessageNudged = state.session;
+        this.clearIdleTimer(state);
+        this.armFinalMessageNudgeReplyTimer(runId, state);
+        this.store.appendEvent(runId, { type: 'note', stepId, message: 'no final message — asking the agent for a visible reply' });
+        return true;
+    }
+    /** Heartbeats and nested subagent items are not a reply. OpenCode/Cursor synthetic `turn.started` inside `sendAgentMessage` cannot false-resume after expiry because a later send goes through `submitAgentInput` → `resumeParkedRun`. */
+    isFinalMessageNudgeReply(state, event) {
+        if (event.type === 'turn.started')
+            return state.finalMessageNudgeReplyTimer !== undefined || state.finalMessageNudgeParked === state.session;
+        if (event.type === 'text' || event.type === 'tool-call' || event.type === 'tool-result')
+            return true;
+        if (event.type === 'item.delta' || !event.type.startsWith('item.'))
+            return false;
+        return event.item?.parentItemId === undefined;
+    }
+    noteFinalMessageNudgeContent(runId, state, event) {
+        if (!this.isFinalMessageNudgeReply(state, event))
+            return;
+        state.finalMessageNudgeSawContent = true;
+        this.clearFinalMessageNudgeReplyTimer(state);
+        if (state.finalMessageNudgeParked !== state.session || !this.waiting.has(runId))
+            return;
+        if (state.pendingHumanAsk || this.hasPendingHumanAsk(runId))
+            return;
+        this.resumeParkedRun(runId, state);
+        state.finalMessageNudgeParked = undefined;
+    }
+    armFinalMessageNudgeReplyTimer(runId, state) {
+        this.clearFinalMessageNudgeReplyTimer(state);
+        if (state.finalMessageNudgeSawContent)
+            return;
+        const session = state.session;
+        if (!session?.open)
+            return;
+        const timer = setTimeout(() => {
+            state.finalMessageNudgeReplyTimer = undefined;
+            if (this.disposed || this.active.get(runId) !== state || state.session !== session || !session.open ||
+                state.cancelled || state.finishRequested || this.waiting.has(runId) || this.monitoring.has(runId))
+                return;
+            state.finalMessageNudgeParked = session;
+            this.store.appendEvent(runId, {
+                type: 'note', stepId: state.currentStepId,
+                message: 'no reply to the final-message nudge — waiting for you',
+            });
+            this.store.updateRun(runId, { status: 'waiting', activity: undefined });
+            if (state.currentStepId)
+                this.store.updateStep(runId, state.currentStepId, { status: 'waiting' });
+            this.store.flush();
+            this.waiting.add(runId);
+            this.armIdleTimer(runId, state);
+            this.releaseSlot();
+            appendHandoffHeartbeat(this.dataDir, runId, 'turn complete — status=waiting');
+        }, this.finalMessageNudgeReplyMs);
+        timer.unref?.();
+        state.finalMessageNudgeReplyTimer = timer;
+    }
+    clearFinalMessageNudgeReplyTimer(state) {
+        if (state.finalMessageNudgeReplyTimer) {
+            clearTimeout(state.finalMessageNudgeReplyTimer);
+            state.finalMessageNudgeReplyTimer = undefined;
+        }
+    }
     armIdleTimer(runId, state) {
         this.clearIdleTimer(state);
         state.idleClosed = false;
@@ -7025,6 +7962,7 @@ export class RunManager {
             clearTimeout(state.idleTimer);
             state.idleTimer = undefined;
         }
+        this.clearFinalMessageNudgeReplyTimer(state);
     }
     reconcileMonitoringWakeTimers() {
         for (const runId of this.monitoring) {
@@ -7136,114 +8074,94 @@ export class RunManager {
             state.autosaveTimer = undefined;
         }
     }
-    runCheckStep(state, step, emit) {
+    /**
+     * Worktree setup (#917, spec `.ai/specs/2026-10-07-worktree-setup.md`): run the project's
+     * `worktreeSetup` commands in this run's isolated worktree when it needs them, and return the
+     * paragraph for the agent's opening message. `start` is a new task or worker, `rematerialized`
+     * a Continue that rebuilt a reclaimed directory, and `resume` any other Continue, which only
+     * finishes a setup a restart interrupted. In-place and non-Git runs never get setup: that tree
+     * is the user's own checkout.
+     */
+    async prepareWorktree(runId, state, raw, emit, trigger) {
+        const record = this.store.getRun(runId);
+        if (!record || state.cwd === this.repoRoot)
+            return undefined;
+        const plan = resolveWorktreeSetup(raw);
+        const interrupted = record.worktreeSetup?.status === 'running';
+        if (plan.kind === 'none') {
+            // A restart interrupted setup the project has since removed: nothing is left to finish.
+            if (interrupted)
+                this.store.updateRun(runId, { worktreeSetup: undefined });
+            return undefined;
+        }
+        const fresh = trigger === 'start' && record.worktreeSetup === undefined &&
+            !record.steps.some((step) => step.kind === 'agent' && step.iterations > 0);
+        if (!interrupted && !fresh && trigger !== 'rematerialized')
+            return undefined;
+        const startedAt = new Date().toISOString();
+        let outcome;
+        if (plan.kind === 'invalid') {
+            outcome = { status: 'invalid', issue: plan.issue };
+        }
+        else {
+            // Durable before the first command: recovery reads `running` to requeue a run a restart
+            // interrupted here, instead of failing it with no agent session to resume.
+            this.store.updateRun(runId, { worktreeSetup: { status: 'running', startedAt } });
+            this.store.flush();
+            emit({ type: 'note', message: worktreeSetupStartNote(plan.commands.length) });
+            let tmpEnv = {};
+            try {
+                tmpEnv = agentTmpEnv(this.dataDir, runId);
+            }
+            catch (err) {
+                if (!(err instanceof AgentTempDirError))
+                    throw err;
+            }
+            outcome = await runWorktreeSetup({
+                plan,
+                cwd: state.cwd,
+                env: worktreeSetupEnv({ projectRoot: this.repoRoot, runId, tmpEnv }),
+                setInterrupt: (stop) => { state.interrupt = stop; },
+                isCancelled: () => state.cancelled,
+                onCommandResult: (result) => emit({
+                    type: 'check-output',
+                    command: result.command,
+                    text: result.output,
+                    exitCode: result.exitCode ?? -1,
+                }),
+            });
+        }
+        const finishedAt = new Date().toISOString();
+        const error = worktreeSetupRecordError(outcome);
+        this.store.updateRun(runId, {
+            worktreeSetup: {
+                status: outcome.status === 'done' ? 'done' : 'failed',
+                startedAt,
+                finishedAt,
+                durationMs: 'durationMs' in outcome ? outcome.durationMs : 0,
+                ...(error !== undefined ? { error } : {}),
+            },
+        });
+        const endNote = worktreeSetupEndNote(outcome);
+        emit({ type: 'note', message: endNote });
+        appendHandoffHeartbeat(this.dataDir, runId, endNote);
+        return worktreeSetupAgentNote(outcome);
+    }
+    async runCheckStep(state, step, emit) {
         const command = step.command;
         emit({ type: 'note', stepId: step.id, message: `$ ${command}` });
-        return new Promise((resolve) => {
-            // Check steps run in the same cwd as the agent steps — the worktree.
-            // Own process group (POSIX): Stop signals the group we created, never a
-            // recycled pid or an unrelated process.
-            const grouped = process.platform !== 'win32';
-            const child = spawn('bash', ['-lc', command], { cwd: state.cwd, env: process.env, detached: grouped });
-            const pid = child.pid;
-            let output = '';
-            let finished = false;
-            let stopping = false;
-            let killTimer;
-            let stopAt = 0;
-            const signalGroup = (signal) => {
-                if (finished || !pid)
-                    return;
-                try {
-                    if (grouped)
-                        process.kill(-pid, signal);
-                    else
-                        child.kill(signal);
-                }
-                catch { /* already gone */ }
-            };
-            const groupAlive = () => {
-                if (!grouped || !pid)
-                    return false;
-                try {
-                    process.kill(-pid, 0);
-                    return true;
-                }
-                catch (err) {
-                    return err.code === 'EPERM';
-                }
-            };
-            const finish = (code) => {
-                if (finished)
-                    return;
-                finished = true;
-                if (killTimer)
-                    clearTimeout(killTimer);
-                state.interrupt = () => undefined;
-                child.stdout?.destroy();
-                child.stderr?.destroy();
-                const trimmed = output.trim() || '(no output)';
-                emit({ type: 'check-output', stepId: step.id, command, text: trimmed, exitCode: code ?? -1 });
-                resolve({ ok: code === 0, output: trimmed });
-            };
-            // After Stop: the KILL timer escalates; resolve only once the group is
-            // confirmed gone (or the confirmation bound passes, reported honestly).
-            let reaping = false;
-            const confirmTermination = async (code) => {
-                if (reaping)
-                    return;
-                reaping = true;
-                const deadline = stopAt + CHECK_KILL_GRACE_MS + CHECK_TERMINATION_CONFIRM_MS;
-                while (groupAlive() && Date.now() < deadline)
-                    await new Promise((r) => setTimeout(r, 25));
-                if (groupAlive()) {
-                    output += '\n… (process group did not confirm termination)';
-                }
-                finish(code);
-            };
-            state.interrupt = () => {
-                if (stopping || finished)
-                    return;
-                stopping = true;
-                stopAt = Date.now();
-                signalGroup('SIGTERM');
-                killTimer = setTimeout(() => signalGroup('SIGKILL'), CHECK_KILL_GRACE_MS);
-                killTimer.unref?.();
-                // Leader already gone but a descendant holds the pipes: no `exit` will follow.
-                if (child.exitCode !== null || child.signalCode !== null)
-                    void confirmTermination(child.exitCode);
-            };
-            const collect = (chunk) => {
-                if (output.length < CHECK_OUTPUT_CAP) {
-                    output += chunk.toString('utf8');
-                    if (output.length >= CHECK_OUTPUT_CAP)
-                        output += '\n… (output truncated)';
-                }
-            };
-            child.stdout.on('data', collect);
-            child.stderr.on('data', collect);
-            child.on('error', (err) => {
-                finished = true;
-                if (killTimer)
-                    clearTimeout(killTimer);
-                state.interrupt = () => undefined;
-                const message = `failed to spawn: ${err.message}`;
-                emit({ type: 'check-output', stepId: step.id, command, text: message, exitCode: -1 });
-                resolve({ ok: false, output: message });
-            });
-            // A descendant can hold the inherited pipes open, so `close` may never
-            // fire after Stop. `exit` of the leader is the signal to reap the group.
-            child.on('exit', (code) => {
-                if (stopping)
-                    void confirmTermination(code);
-            });
-            child.on('close', (code) => {
-                if (stopping)
-                    void confirmTermination(code);
-                else
-                    finish(code);
-            });
+        // Check steps run in the same cwd as the agent steps — the worktree — in their own process
+        // group, shared with worktree setup (#917).
+        const result = await runGroupedCommand({
+            command,
+            cwd: state.cwd,
+            env: process.env,
+            setInterrupt: (stop) => { state.interrupt = stop; },
+            keep: 'head',
+            cap: CHECK_OUTPUT_CAP,
         });
+        emit({ type: 'check-output', stepId: step.id, command, text: result.output, exitCode: result.exitCode ?? -1 });
+        return { ok: result.exitCode === 0, output: result.output };
     }
     finishStep(runId, stepId, status, error, emit) {
         this.store.updateStep(runId, stepId, {