@wjarka/cezarion 0.16.0 → 0.17.0

package/dist/workflows/run.d.ts

@@ -1,18 +1,32 @@
-import { type PreviewStopRequest, type PreviewStopResult, type CiWait, type CiWaitRequest, type PreviewServeRequest, type PreviewServeResult } from '../contract/index.js';
+import type { ContinueRunOptions } from './continuation-admission.ts';
+import type { ScheduleTaskAnswer, ScheduleTaskRequest, ScheduledTasksAnswer, ScheduledTasksRequest } from '../contract/index.js';
+import { type CezarAskRequest, type CezarDoneAnswer, type CezarDoneRequest, type CezarWaitRequestInput, type PrWaitEntry, type ProcessWaitEntry, type HumanWaitEntry, type TimerWaitEntry, type WaitVia, type WorkerWaitEntry, type DeadlinedWorkerWaitEntry } from '../contract/index.js';
+import { type PreviewStopRequest, type PreviewStopResult, type PreviewServeRequest, type PreviewServeResult } from '../contract/index.js';
+import { AUTONOMOUS_NUDGE } from './turn-end.ts';
+export { runAccountKey } from './run-scheduling.ts';
 import { type PreviewHostLike } from '../preview/registration.ts';
+import type { CezarToolHandlers } from '../ci-wait/controller.ts';
 import { type WorkerAccountBinding } from '../delegation/execution-identity.ts';
 import type { DelegationProvisioner } from '../delegation/provision.ts';
+import { type AskRequest } from '../core/ask.ts';
 import { type CwdSource } from '../delegation/process-liveness.ts';
 import type { RunnerId } from '../core/agent-runner.ts';
-import { type AgentInput, type WorkerStopResult, type WorkerWait, type WorkerWaitRequest, type RequestWaitRequest } from '../contract/index.js';
-import type { ContentBlock } from '../core/agent-runner.ts';
+import { type AgentInput, type WorkerStopResult, type WorkerWait, type WorkerWaitRequest } from '../contract/index.js';
+import { type RequestWaitRequest } from '../contract/index.js';
+import type { AgentEvent, ContentBlock } from '../core/agent-runner.ts';
 import { type Skill } from '../skills.ts';
 import { type QueuedMessage, type RunRecord, type RunStore } from '../runs/store.ts';
 import { WorkspaceSemaphore, type AccountHolds } from '../workspace/semaphore.ts';
 import type { UiEvent } from '../core/ui-events.ts';
-import { type WorkflowDef } from './types.ts';
+import { type WorkflowDef, type WorkflowStepDef } from './types.ts';
 /** An interactive session that hears nothing from the user closes itself. */
 export declare const IDLE_TIMEOUT_MS: number;
+/** Claude's native scheduler is the backend-level equivalent of the textual
+ * monitoring marker. Keep this recognition here, at the workflow boundary,
+ * so the v1 event protocol stays unchanged and other backends do not acquire
+ * semantics from a coincidentally named tool (#46). Undefined: not the scheduler; null: the
+ * scheduler without a usable `delaySeconds`; otherwise that delay (hearsay-tools/cezarion#1233). */
+export declare function claudeScheduleWakeupDelay(event: AgentEvent, backend: RunnerId): number | null | undefined;
 /**
  * Preserve boundaries between complete assistant text blocks while a turn is
  * accumulated for marker parsing. The runners join these same v1 blocks with
@@ -23,13 +37,46 @@ export declare function appendTurnText(current: string, next: string): string;
 export type TurnTail = 'none' | 'visible' | 'silent';
 /** Last top-level completed item: a non-empty assistant message is a visible tail; reasoning or a tool is silent even after earlier visible text (#544). An empty turn stays `none` and never nudges. */
 export declare function trackTurnTail(tail: TurnTail, event: UiEvent): TurnTail;
+/** What a turn's active `CEZ:ASK` declaration resolves to: the card to raise, and
+ * the notes to persist alongside it. */
+type AskTurnOutcome = {
+    ask: AskRequest | null;
+    /** Emitted in order by the caller, which owns how a note is persisted. */
+    notes: Array<{
+        message: string;
+        tone?: 'danger';
+    }>;
+};
+/** How a turn end reads its turn (`classifyTurnEnd`). */
+type TurnEndRead = AskTurnOutcome & {
+    done: boolean;
+    monitoring: boolean;
+    humanGate: boolean;
+    waitCard: boolean;
+};
+/** One turn-end decision for fresh and Continue, also retained until an input
+ * ACK settles. DONE and human gates take precedence over a quiet
+ * declaration or live workers; a false pending-ASK flag alone proves nothing.
+ * A human wait this turn registered and nobody has seen yet (hearsay-tools/cezarion#1234)
+ * raises its card, or the human gate when it has none, unless DONE wins or a valid ask line
+ * replaces its card; `waitCard` says the card is the wait's own. An accepted `cezar_done` is DONE
+ * whatever the text says, and beats any ask line in it. Only markers and waits count: no prose
+ * raises the gate, and a rejected ask line is a turn end with no wait. */
+export declare function classifyTurnEnd(turnText: string, completedAssistantText: string, options: {
+    sessionOpen: boolean;
+    pendingHumanAsk: boolean;
+    scheduledWake: boolean;
+    liveWorkers: boolean;
+    humanWait?: Pick<HumanWaitEntry, 'questions' | 'context'> | undefined;
+    doneRequested?: boolean | undefined;
+}): TurnEndRead;
 /** Periodic "cezar autosave" commit in the task worktree (spec 006). */
 export declare const AUTOSAVE_INTERVAL_MS = 90000;
 export { CHECK_KILL_GRACE_MS, CHECK_TERMINATION_CONFIRM_MS } from './grouped-command.ts';
-/** The periodic autosave timer is opt-in (#471): off, a task branch carries only the
- *  agent's own commits plus the turn-end/pre-PR flushes — no mid-run "cezar autosave"
- *  noise interleaving PR history. The flushes (`autosaveCommit` at turn end and before
- *  a draft PR) are NOT gated: the branch must still end holding the finished state. */
+/**
+ * Periodic saves are opt-in. Turn-end, finalization and pre-PR flushes remain enabled; only
+ * pre-PR follows a repointed HEAD. Coalesce timer-save evidence in the handoff.
+ */
 export declare function periodicAutosaveEnabled(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Explicitly opt out of the repository-root lease for runs that execute in the
@@ -42,44 +89,45 @@ export declare function repositoryRootLockDisabled(env?: NodeJS.ProcessEnv): boo
 export type DelegationExecutionSettings = {
     cwd: string;
     runner: RunnerId;
-    model?: string;
-    modelIdentity?: string;
-    effort?: string;
+    model?: string | undefined;
+    modelIdentity?: string | undefined;
+    effort?: string | undefined;
     agentProfile: string;
-    accountBinding?: WorkerAccountBinding;
-    systemPrompt?: string;
-    allowedTools?: string[];
-    bashAllowlist?: string[];
-};
-/** What a Continue may carry (`RunManager.continueRun`). */
-type ContinueRunOptions = {
-    text?: string;
-    images?: PastedContent[];
-    runner?: RunnerId;
-    /** Internal configured fallback for an untouched workflow, resolved by the route. */
-    originalRunner?: RunnerId;
-    model?: string;
-    /** Reasoning-effort pin (#45). Omitted keeps the run's pin; empty string clears it. */
-    effort?: string;
-    /** Agent account for the reopened session (spec 2026-07-29-agent-profiles). Omitted = the
-     *  account the run is already on. */
-    agentProfile?: string;
-    /** #505: the parent reply this continuation delivers as the answer to a routed question. */
-    answerInputId?: string;
+    accountBinding?: WorkerAccountBinding | undefined;
+    systemPrompt?: string | undefined;
+    allowedTools?: string[] | undefined;
+    bashAllowlist?: string[] | undefined;
 };
 /** #505: a real steer is read at the harness's next model step; a quiet boundary this long
  * with input still unread means the harness will not read it without help. */
 export declare const UNREAD_INPUT_GRACE_MS = 30000;
 /** #486: recheck a turn-end that deferred close/park only because the harness still held a human follow-up. */
 export declare const HELD_HUMAN_INPUT_RECHECK_MS = 250;
-/** Bound a final-message nudge that is ACKed but never produces a turn (#544).
- *  OpenCode heartbeats re-arm the managed-session no-progress guard, so this is
- *  the DEFAULT-path exit when the agent stays silent. Overridable on RunManager. */
-export declare const FINAL_MESSAGE_NUDGE_REPLY_MS: number;
+/** Bound a no-wait nudge that is ACKed but never produces a turn (#544,
+ *  hearsay-tools/cezarion#1234). OpenCode heartbeats re-arm the managed-session no-progress
+ *  guard, so this is the DEFAULT-path exit when the agent stays silent. Overridable on RunManager. */
+export declare const NO_WAIT_NUDGE_REPLY_MS: number;
+/** The turn-end rule's notes (hearsay-tools/cezarion#1234). */
+export declare const NO_WAIT_NUDGE_NOTE = "no wait or done \u2014 reminding the agent once";
+export declare const NO_WAIT_NOTE = "waiting for you: the agent ended its turn without a wait or done";
+export declare const NO_WAIT_NO_REPLY_NOTE = "no reply to the no-wait nudge \u2014 waiting for you";
+export declare const COMPLETION_NO_REPLY_NOTE = "no reply to the completion nudge \u2014 waiting for you";
+/** A worker's second turn end with no wait or done asks its parent, as a routed open question
+ *  (hearsay-tools/cezarion#1301). */
+export declare const WORKER_FALLBACK_QUESTION: (workerId: string) => string;
+export declare const WORKER_FALLBACK_HEADER = "Worker idle";
+export declare const WORKER_FALLBACK_NOTE = "no wait or done after the nudge \u2014 asking the parent";
+export declare const WORKER_FALLBACK_REPLY_NOTE = "parent answered the idle worker";
+/** A root's done blocked at a turn end is answered with the refusal `cezar_done` gives, as one
+ *  automatic turn (hearsay-tools/cezarion#1301). The nudge adds this sentence when live workers block
+ *  it; the mid-turn answer never does. */
+export declare const COMPLETION_WILL_WAIT = "If you end your turn with done again while these workers are live, Cezar will wait on them for you and wake you when they have all settled.";
+export declare const COMPLETION_NUDGE_NOTE = "completion blocked \u2014 refusal sent to the agent";
+/** An autonomous run's ask line before the budget, which `cezar_ask` would refuse: its questions follow. */
+export declare const AUTONOMOUS_ASK_NOTE = "autonomous \u2014 question not registered; continuing";
 /** Bound one unattended session; an explicit Continue starts a new budget. */
 export declare const MAX_AUTO_CONTINUES = 40;
-export declare const AUTONOMOUS_NUDGE = "Continue working autonomously until the task is fully complete. Do not ask me for confirmation or clarification \u2014 make reasonable assumptions and proceed. When everything is done, end the session with your done signal.";
-export declare const FINAL_MESSAGE_NUDGE = "Your last turn ended without a message to the user. Write your user-facing reply now: what you did, where things stand, and anything you need from the user. If the task goal is fully achieved, end that message with CEZ:DONE.";
+export { AUTONOMOUS_NUDGE };
 /**
  * Auto-resume after a provider usage limit (spec 2026-08-03-auto-resume-after-usage-limit).
  *
@@ -95,6 +143,23 @@ export declare const AUTO_RESUME_GRACE_MS = 30000;
  * enough to sit through a couple of days of five-hour windows.
  */
 export declare const MAX_AUTO_RESUMES = 12;
+/**
+ * Consecutive failed automatic attempts to deliver a run's wait results (hearsay-tools/cezarion#1233):
+ * each is a session that failed, or closed cleanly, while the results were still owed, counted across
+ * the replacement sessions that retry them. At the bound the run settles `failed` and keeps the
+ * results for a human. The count is in memory, per manager, so a restart starts it again, like the
+ * per-session wake budget. A delivery acknowledgement, human input, Continue, Stop, Finish and
+ * cancel reset it; a usage-limit failure is not counted, because its own hold and automatic resume
+ * take it.
+ */
+export declare const MAX_WAKE_DELIVERY_ATTEMPTS = 3;
+export declare const WAKE_DELIVERY_CAP_NOTE = "could not deliver wait results after 3 attempts \u2014 continue this task to retry";
+/** The error of a session that closed cleanly while it still owed wait results. */
+export declare const WAKE_SESSION_CLOSED_ERROR = "the session closed before the wait results were delivered";
+/** Stop on a failed run that held wait results: the results and the open waits are gone. */
+export declare const WAITS_DISCARDED_NOTE = "Stop discarded the waits this task held and their results; the task stays failed";
+/** Stop on a failed run that only owed a completion refusal (hearsay-tools/cezarion#1301). */
+export declare const REFUSAL_DISCARDED_NOTE = "Stop discarded the completion refusal this task still owed; the task stays failed";
 /**
  * How long a missed deadline stays worth acting on. The promise is "we pick this up when the
  * window reopens" — kept across a restart or an overnight close, which is the case the feature
@@ -111,56 +176,48 @@ export declare const AUTO_RESUME_MISSED_WINDOW_MS: number;
  * in-memory checks), unref'd, and it only ever acts when idling has no justification left.
  */
 export declare const QUEUE_WATCHDOG_MS = 60000;
-/**
- * Which agent ACCOUNT a run's work runs on — the thing a provider usage limit actually closes
- * (spec 2026-08-03-auto-resume-after-usage-limit).
- *
- * Backend plus agent account, because those are the two axes a limit is scoped to: a Claude
- * limit must never stall a Codex task, and a second Claude login is a second budget. A record
- * that names no runner has not started yet and will take the configured default, which is what
- * `fallbackRunner` carries; a run that HAS started always carries its resolved runner (execute
- * persists it), and only started runs can be holding.
- */
-export declare function runAccountKey(run: Pick<RunRecord, 'runner' | 'agentProfile'>, fallbackRunner: RunnerId): string;
 export interface StartRunInput {
     task: string;
-    model?: string;
+    model?: string | undefined;
     /** Reasoning-effort pin (#45). Canonical `low`/`medium`/`high`/`xhigh`/`max`.
      *  Unset = harness default. Same class of override as `model`. */
-    effort?: string;
+    effort?: string | undefined;
     /** Agent backend chosen for this task (GUI). Unset = the config default. */
-    runner?: RunnerId;
+    runner?: RunnerId | undefined;
     /** Agent account for this task (spec 2026-07-29-agent-profiles), applying to steps that run
      *  on `runner`. Unset = the project's own selection. Persisted on the record so the choice
      *  survives into resume and Continue, and so the thread can say which account did the work. */
-    agentProfile?: string;
+    agentProfile?: string | undefined;
     /** Attachments pasted into the new-task form — persisted when the run is created and
      *  delivered once, with the first agent step's opening message. Images ride along as blocks the
      *  model can view; a file (#950) only ever reaches the agent as the path it was written to. */
-    images?: PastedContent[];
+    images?: PastedContent[] | undefined;
     /** Per-run system-prompt override (`POST /api/runs`, programmatic callers).
      *  Replaces the `config.json` default for this run — see
      *  `resolveExtraSystemPrompt` for the precedence contract. */
-    systemPrompt?: string;
+    systemPrompt?: string | undefined;
     /** Composer opt-out (#worktree-toggle): `false` runs the task in the repo
      *  working tree instead of an isolated worktree. Undefined/`true` keeps the
-     *  default per-task worktree. Ignored for variants (they always isolate). */
-    worktree?: boolean;
+     *  default per-task worktree. */
+    worktree?: boolean | undefined;
     /** Autonomous mode (#autonomous): eligible turn ends auto-continue until done
      *  or the safety cap. Native asks, input delivery and lifecycle waits still apply. */
-    autonomous?: boolean;
+    autonomous?: boolean | undefined;
+    archiveWhenDone?: boolean | undefined;
+    autoMergePr?: boolean | undefined;
     /** Task webhook opt-in (#589). Persisted on the record at creation; read from there after. */
-    notify?: boolean;
-    /** Follow-up inbox generation (spec 007, #444). Omitted means enabled for
-     *  compatibility; the handoff journal runs either way. */
-    generateFollowups?: boolean;
+    notify?: boolean | undefined;
     /** Attachments from the queued prompt stack (#472), re-encoded from disk by
      *  `hydrateQueuedInput` at dequeue. Kept separate from `images` because those
      *  are persisted into `taskImages` by `startRun()` — folding
      *  the stack's (already-persisted) files in there would write duplicate files
      *  and make the task bubble render the stack's images as its own. In-memory
      *  only: rebuilt from the record on every hydration, never persisted. */
-    stackedImages?: ContentBlock[];
+    stackedImages?: ContentBlock[] | undefined;
+    /** Automation provenance (hearsay-tools/cezarion#1465). Written by `createRun` in the row that
+     *  creates the run, so a receipt never points at nothing after a crash. */
+    automation?: RunRecord['automation'];
+    automationTrigger?: RunRecord['automationTrigger'];
 }
 /**
  * The effective "extra" system prompt for a run (spec §protocol v2, R2 2.3):
@@ -245,9 +302,6 @@ export declare function pastedAttachmentsText(attachments: PersistedAttachment[]
 /** Same note as `pastedAttachmentsText`, wrapped as a trailing `ContentBlock`
  *  ready to append to a message's content array. */
 export declare function pastedAttachmentsNote(attachments: PersistedAttachment[]): ContentBlock;
-/** Variant letters + the fixed diversification hints (spec 010). A runs the
- *  task verbatim; B/C get one constant sentence each — zero configuration. */
-export declare const VARIANT_LETTERS: readonly ['A', 'B', 'C'];
 /** Only an original workflow that has never executed may return to its queue. */
 export declare function isUntouchedCancelledRun(run: RunRecord): boolean;
 /** #469: why destroy could not prove a crashed generation's termination. */
@@ -260,6 +314,11 @@ export type WorkerTerminationBlocker = {
     kind: 'processes';
     pids: number[];
 };
+/** hearsay-tools/cezarion#1465: what `startServer` hands a manager for the schedule tools. */
+export type AutomationToolService = {
+    scheduleTask(request: ScheduleTaskRequest): Promise<ScheduleTaskAnswer>;
+    scheduledTasks(request: ScheduledTasksRequest): Promise<ScheduledTasksAnswer>;
+};
 /**
  * The mini workflow engine: executes a `WorkflowDef` against a repo, one step
  * at a time, persisting every event to the RunStore (which the SSE endpoints
@@ -363,12 +422,31 @@ export declare class RunManager {
     private readonly waiting;
     /** Durable monitoring subset. Only the configured number receives the waiting-slot exemption. */
     private readonly monitoring;
-    /** Separate from human waiting: these resumes MUST reacquire scheduler capacity. */
-    private readonly ciWakeQueuedAt;
-    private readonly ciWakeAdmitted;
+    /** A run whose resolved waits wait for a wake (hearsay-tools/cezarion#1233). Separate from
+     *  human waiting: these resumes MUST reacquire scheduler capacity. Keyed by run id. */
+    private readonly waitWakeQueuedAt;
+    private readonly waitWakeAdmitted;
+    /** One CI watch per open CI wait, keyed by wait id. */
     private readonly ciWatches;
+    /** CI lookups in flight, keyed by run id and normalized PR URL: two PRs may register at once. */
     private readonly ciRegistrations;
+    /** A resolution whose checkpoint failed, retried by wait id. */
     private readonly ciRetries;
+    /** Process waits' watches (hearsay-tools/cezarion#1446), by wait id. */
+    private readonly processWatches;
+    private readonly processSupervisor;
+    /** Worker waits whose resolution write failed and is being retried: the warning is said once. */
+    private readonly workerResolveRetries;
+    /** A wake that could not be admitted yet, retried by run id. */
+    private readonly wakeRetries;
+    /** The last "retained; continuation unavailable" note per run: the 1 Hz admission retry writes
+     *  it on the transition into refusal or when the reason changes, never once per retry. */
+    private readonly retainedNotes;
+    /** The wait before the next automatic delivery attempt after a failed one, by run id. */
+    private readonly wakeBackoffs;
+    private wakeRetryBackoff;
+    /** One timer per open timer wait, keyed by wait id. */
+    private readonly waitTimers;
     private readonly ciResources;
     /** #781: the workspace-wide preview host. Absent (`cez run`, tests) means every registration is `headless`. */
     private readonly preview?;
@@ -377,10 +455,9 @@ export declare class RunManager {
     /** #781: cezar's own listening port, which no dev server may register. */
     private readonly cezarPort?;
     private ciSupervisor;
-    private readonly workerWaiting;
-    private readonly workerWakeAdmitted;
-    private readonly workerWakeQueuedAt;
-    private readonly workerWaitTimers;
+    /** Each family's conversation request deadlines. Every worker wait, Cezar's completion wait
+     *  included, parks, wakes and times out through the wait list (hearsay-tools/cezarion#1301). */
+    private readonly requestDeadlineTimers;
     private readonly inboxClaimTimers;
     private reconcilingWorkers;
     private reconcilingFamily;
@@ -390,12 +467,13 @@ export declare class RunManager {
     private recoveryScope;
     /** Settles when the recovery in progress (if any) has finished. */
     private recoveryInFlight;
+    private recoveryFactsPending;
     /** Adoptions of dead processes' runs, one at a time (`adoptOrphanedRun`). */
     private adoptionTail;
     /** Quiet window before unread input is resubmitted or left unconfirmed (#505). */
     private readonly unreadInputGraceMs;
     /** Quiet window after a final-message nudge before a still-silent session parks (#544). */
-    private readonly finalMessageNudgeReplyMs;
+    private readonly noWaitNudgeReplyMs;
     private disposed;
     /** Whether any recovery is in progress: one at a time (`recover`), and `pump` waits for it. */
     private get recovering();
@@ -412,6 +490,9 @@ export declare class RunManager {
      *  explicit user Continue, these are bulk scheduler work and must re-enter
      *  through `pump()` so both workspace and per-project caps are honored. */
     private readonly pendingContinuations;
+    /** The configured default runner as `pump()` last read it, so the sync `oldestWakeAt()` resolves
+     *  a runnerless record's account the same way (hearsay-tools/cezarion#1236). */
+    private configuredDefaultRunner;
     /** Accepted Continues supersede in-flight settlement even before launch or after
      * idle close. Retain these across dropActive/dispose so absence cannot look like
      * the earlier execution again; disposal alone never revokes terminal intent. */
@@ -444,7 +525,7 @@ export declare class RunManager {
      * (#438). `CEZ_DISABLE_REPO_LOCK=1` deliberately bypasses this safety lease.
      */
     private repoRootTail;
-    /** `.ai/cezar` — where the per-task handoff files and todos.json live. */
+    /** `.ai/cezar` — where the per-task handoff files live. */
     private readonly dataDir;
     /** Runs currently being paused by the memory guard — dedupes the ~2 s samples so one breach
      *  triggers one pause, not a burst. Cleared in dropActive when the run leaves the registry. */
@@ -469,9 +550,13 @@ export declare class RunManager {
     constructor(store: RunStore, repoRoot: string, options?: {
         semaphore?: WorkspaceSemaphore;
         unreadInputGraceMs?: number;
-        finalMessageNudgeReplyMs?: number;
-        preview?: PreviewHostLike;
-        cezarPort?: () => number | undefined;
+        noWaitNudgeReplyMs?: number;
+        preview?: PreviewHostLike | undefined;
+        cezarPort?: (() => number | undefined) | undefined;
+        cockpit?: {
+            origin: string;
+            projectId: string;
+        } | undefined;
     });
     /**
      * Release everything this manager owns without touching run records
@@ -492,15 +577,7 @@ export declare class RunManager {
      * no limit is set or the sampler has no data (e.g. `ps`/PowerShell unavailable).
      */
     private enforceMemoryLimit;
-    /** Env the spawned claude gets so the agent can find its handoff file and
-     *  the global inbox (spec 007; the inbox only when the run opted in).
-     *
-     *  `CEZ_TODOS_FILE` is set to `''` rather than omitted when follow-ups are
-     *  off: runners spawn with `{ ...process.env, ...spec.env }`, so omitting the
-     *  key would let a value inherited from *this* process through — a nested
-     *  cezar (an agent running `cez serve`/`cez run`/the test suite) would then
-     *  write follow-ups into the parent's inbox despite the opt-out. Empty is the
-     *  established "absent" spelling — consumers guard with `if (todosFile)`.
+    /** Env for the rolling handoff and artifacts.
      *
      *  `TMPDIR`/`TEMP`/`TMP` (#785) point at this run's own scratch directory
      *  instead of the machine-wide one every agent used to share. Created and
@@ -509,22 +586,9 @@ export declare class RunManager {
      *  turning into empty command output inside a running agent. */
     private agentEnv;
     /**
-     * `agentEnv` plus the agent-account variable for the profile this STEP runs under (spec
-     * 2026-07-29-agent-profiles), and the id it resolved to so the caller can record it.
-     *
-     * Resolved per step, not per run, because a workflow can mix backends: an override naming a
-     * Claude account says nothing about which Codex account a codex step should use. Resolution
-     * order, most specific first:
-     *
-     *   1. the step's ALREADY-RECORDED `profileId` — a resume or Continue must reattach to the
-     *      account that created the session, whatever the project has since been switched to;
-     *   2. the run's composer override, but only for steps on the run's own runner;
-     *   3. the project's stored selection, and failing that the discovered default.
-     *
-     * Read fresh every time. `~/.cezar/config.json` is shared by every cezar process on this
-     * machine, so a cached snapshot is a staleness bug, and one small JSON read is free next to
-     * spawning a CLI. Never throws: an unreadable home degrades to the default profile, which is
-     * exactly the behaviour that predates profiles.
+     * Resolve this step’s account environment from agent-accounts.json and record its id. Ordinary
+     * steps prefer the recorded account, then a matching run override, then project selection and
+     * default. Keep account and session ids paired; owned workers use pinned identity.
      */
     /**
      * Ordinary runs retain mutable discovery; owned runs require explicit durable evidence. With a
@@ -549,24 +613,358 @@ export declare class RunManager {
      */
     private continuationDefStep;
     private agentEnvForStep;
+    /**
+     * The cockpit serving this manager's project, set by `startServer` once it listens (#774).
+     * Every agent env then carries it as `CEZ_COCKPIT_URL`/`CEZ_PROJECT_ID`, which is how
+     * `cez automation` reaches the cockpit without probing ports. A headless `cez run` never
+     * sets it, so it is also the "a cockpit is attached" signal for the automations gate.
+     */
+    private cockpit?;
+    setCockpitAddress(address: {
+        origin: string;
+        projectId: string;
+    } | undefined): void;
+    cockpitAddress(): {
+        origin: string;
+        projectId: string;
+    } | undefined;
+    /**
+     * hearsay-tools/cezarion#1465: the project's one-time schedule service behind
+     * `cezar_schedule_task` and `cezar_scheduled_tasks`, set by `startServer` beside the cockpit
+     * address. Headless `cez run` never sets it, so the tools answer `unavailable` there. The
+     * boot manager recovers runs before the server sets it, and a lazy project's manager recovers
+     * before its context is announced: a resumed session can call a tool in that window. With a
+     * cockpit address the call waits for the service, bounded like the CLI's startup retry.
+     */
+    private automationTools?;
+    private automationToolsWaiters;
+    setAutomationTools(tools: AutomationToolService | undefined): void;
+    private awaitAutomationTools;
+    /** Automations on AND a cockpit attached: the one predicate behind the prompt part and the built-in skill. */
+    private automationsReachable;
+    /** The built-in skills this manager may offer now; empty unless automations are reachable. */
+    builtinSkills(): Skill[];
+    /** The automations part of every session's system prompt, or nothing. */
+    private automationsPart;
+    /** The "Project webhooks" part (#1576): the webhooks this project exposes to agents, read from
+     *  the registry when a session starts. Needs a cockpit to send through; nothing exposed, or an
+     *  unreadable registry, adds nothing. */
+    private agentWebhooksPart;
+    /**
+     * One launch's session-start context (hearsay-tools/cezarion#1584): the run's own handoff,
+     * then the project's `context.yaml` rules for this recipient, read now and rendered once.
+     * Every launch reports its outcome as one lifecycle line. Both launch sites — a fresh step
+     * and `runContinuation` — come here; a live message never does. The prefix goes into the
+     * opening message only, never the system prompt a worker inherits (#778).
+     */
+    private sessionContextFor;
+    /** Every skill lookup in this manager goes through here, so the built-ins reach all of them. */
+    private discoverSkills;
+    /**
+     * Load the run's skill registry: the ONLY writer of `state.skills` (hearsay-tools/cezarion#1806).
+     * `execute` and `runContinuation` both call it, once the run is registered and after the awaits
+     * that precede its first prompt. `'throw'` lets a failed discovery fail the run, as a fresh run
+     * always did; `'ignore'` keeps the registry the run already has, or none, because discovery must
+     * never break a Continue (open-mercato/cezar#811). An empty registry expands no `/skill` (it is not an error).
+     */
+    private loadRunSkills;
+    /**
+     * The run's skill registry minus the project's off-list as it is now (#1494): the ONLY reader of
+     * `state.skills`. The registry is discovered when the run starts or continues, so a team skill
+     * switched off since then is still in `state.skills`; every prompt a step, a Continue or a live
+     * `/name` builds reads this instead. A caller that already read the off-list passes it as
+     * `disabled`, so that both see one list.
+     */
+    private enabledSkills;
+    /**
+     * A live `/name` message already carries the skill's body, and `sendMessage` answers
+     * synchronously, so its files and companions install after the message went out (#1408).
+     * When anything new landed, or a team skill's files went to a cache copy the message could not
+     * name, one durable agent input says what and where. Whether a runner's native lookup sees a skill
+     * added mid-session is not relied on: that input is the delivery for every runner. Nothing
+     * new: no input. A run that stopped, or moved to another session, gets none.
+     */
+    private provisionLiveSlashSkill;
+    /**
+     * Provision the step skill and leading registry slash skill for start, Continue, recovery and
+     * live input, and at a step's start every registry skill its prompt names as a typed `/name`
+     * (#1672). Native slashes that are not registry skills install nothing.
+     *
+     * The run's OWN task worktree gets every root and the companions their bodies name
+     * (`provisionSkills`): links to local and global skills, generated `SKILL.md` files, and marked
+     * team copies, in `.claude/skills`, `.agents/skills` and `.cursor/skills`, recorded in the
+     * worktree's git dir and kept out of git by a worktree-local `.gitignore`. The project's
+     * off-list (`disabledTeamSkills`) is read fresh on every pass and applied to the saved
+     * registry, the roots and the team list alike: a team skill switched off for the project is
+     * never installed, not even for a skill that runs it, and a switch-off made after the run
+     * started holds for the next step, a live `/name` and Continue. Copies a pass installed before
+     * the switch stay in the worktree until the task ends: cezar removes nothing mid-task.
+     *
+     * Any other cwd — worktree off, a non-git project, a Continue whose worktree is gone — is the
+     * main checkout or unknown, where those directories are LOCAL skills to `discoverSkills` that
+     * would shadow the team source for every later run. A selected or leading-slash directory team
+     * root gets a per-commit cache copy there instead, and nothing else is installed: a skill only
+     * the prompt names gets nothing there, like a companion. So does a worktree where no copy of
+     * it landed, such as one whose three agent dirs all link out of it; one that took only some
+     * copies names the first that landed, since the runner's own dir may be the one skipped.
+     * Returns the step-start notes and, per team root, the directory its prompt must name.
+     */
+    private provisionRunSkills;
+    /** `cwd` is the run's recorded task worktree, and not the project root. Unresolvable means no. */
+    private isOwnTaskWorktree;
     private delegationProvisioner?;
     setDelegationProvisioner(provisioner: DelegationProvisioner): () => void;
     private provisionSession;
     /** Provision the same capability and descriptor on every start, Continue and recovered launch. */
     private provisionCiSession;
+    /**
+     * The trusted callbacks behind one session's cezar tools (hearsay-tools/cezarion#1233). Both
+     * answers list the waits still open; a coded refusal answers with its fixed message, never the
+     * thrower's text, and anything else is left to the tool server's `unavailable`.
+     */
+    cezarToolHandlers(runId: string, generation: string): CezarToolHandlers;
+    /** The refusals every cezar tool call shares: it must come from the run's current, open session,
+     *  the one `state` was when the call began. */
+    private toolSessionRefusal;
+    /**
+     * `cezar_done` (hearsay-tools/cezarion#1234). Accepted, the run finishes at this turn's end
+     * through the done branch, which cancels every open wait; in a workflow step that is not the
+     * last, that branch completes the step and the next one starts (hearsay-tools/cezarion#1620), and
+     * the answer says which. Refused, the answer says what to do
+     * first. The gate is the completion gate, in order: the session, a root finish, the user's
+     * question, then for a root its workers' questions, live workers and uncollected results. The turn end re-checks it (`deferParentCompletion`).
+     */
+    acceptDone(runId: string, generation: string, request: CezarDoneRequest, signal?: AbortSignal): CezarDoneAnswer;
+    /**
+     * The root checks `cezar_done` makes after the session, root-finish and human-question ones, in
+     * order: its workers' questions, live workers, then uncollected settled results. One text source
+     * for the mid-turn answer and the turn end's refusal nudge (hearsay-tools/cezarion#1301).
+     * `liveWorkerIds` names the live workers that block it, empty when questions block it first.
+     */
+    private completionRefusal;
+    /** The `cezar_done` this session accepted since its last turn end, taken by this turn end: a
+     *  later turn must call it again, as it must repeat the done line. */
+    private takeDoneRequest;
+    /** The boundary a turn end closes on when it is DONE, and what declared it. */
+    private recordDoneAtBoundary;
+    /** Goal achieved (agent contract, #347): the summary `cezar_done` gave as a note, the closing
+     *  event naming what declared it, every open wait cancelled (DONE ranks above every wait), and
+     *  the session closes instead of parking, so the run completes and frees its slot. */
+    private closeAsDone;
     stopPreviewServer(runId: string, request: PreviewStopRequest, signal?: AbortSignal): Promise<PreviewStopResult>;
     /**
      * #781: record a dev server the agent registered. One probe at registration becomes
      * `answeredAtRegistration`; the run is re-validated after it, since the probe awaits.
      */
     registerPreviewServer(runId: string, request: PreviewServeRequest, signal?: AbortSignal): Promise<PreviewServeResult>;
-    /** Trusted capability callbacks supply run identity; the model supplies only a PR and deadline. */
-    registerCiWait(runId: string, request: CiWaitRequest, generation: string, capabilitySignal?: AbortSignal): Promise<CiWait>;
+    /** The checks every wait registration shares: the session that called is the run's current one,
+     *  and no root finish blocks it. Refusals throw `{ code }`. */
+    private registrationGate;
+    /**
+     * `cezar_ask` (hearsay-tools/cezarion#1234): open the run's human wait with its card. A run holds
+     * one: a registration in the turn that opened it replaces its card and keeps its id, and one after
+     * the user saw it returns it unchanged. An autonomous run assumes and continues instead, until
+     * its automatic wakes are spent.
+     */
+    registerAsk(runId: string, request: CezarAskRequest, generation: string, capabilitySignal?: AbortSignal): Promise<HumanWaitEntry>;
+    /**
+     * Open a CI or timer wait (hearsay-tools/cezarion#1233). Trusted capability callbacks supply run
+     * identity; the model supplies only the PR and deadline, or the seconds and note. Refusals throw
+     * `{ code }`. An identical registration (same PR; or same seconds and note in the same turn)
+     * returns the open wait it repeats.
+     */
+    registerWait(runId: string, request: CezarWaitRequestInput, via: WaitVia, generation: string, capabilitySignal?: AbortSignal): Promise<PrWaitEntry | TimerWaitEntry | WorkerWaitEntry | ProcessWaitEntry>;
+    /**
+     * A process wait (hearsay-tools/cezarion#1446, spec § Process wait decisions). Cezar refuses only
+     * what it cannot watch to an end: another user's PID, its own, and an agent session's leader;
+     * the agent's shell can already observe any process of its own, so there is no ownership proof.
+     * A PID already gone is no error: the command was fast, and the wait resolves at once from its
+     * exit file, or as exited.
+     */
+    private registerProcessWait;
+    /** Where a process wait's exit file may sit: the run's worktree (the checkout for a run without
+     *  one) and, unless turned off, the Cezar temp directory its agent gets as `TMPDIR`. */
+    private exitFileRoots;
+    /** Commit, arm and (at a boundary) park on a newly registered wait. */
+    private openWait;
+    /**
+     * The agent's `cezar_cancel_wait`. An open wait is cancelled with its watch or timer, and no
+     * result for it is ever delivered. A resolved wait is already owed: cancelling it is a no-op and
+     * its result arrives with the next wake. A settled or unknown id is `not_found`. A human wait the
+     * user already sees is theirs to answer (`human_question`); one from this turn can be withdrawn.
+     */
+    cancelWait(runId: string, waitId: string, generation: string): {
+        cancelled: true;
+    } | {
+        cancelled: false;
+        code: 'not_found' | 'already_resolved' | 'human_question';
+    };
+    /** Start what resolves an open wait: its CI watch, or its timer from the stored deadline. An
+     *  overdue timer (restart) resolves at once. */
+    private armWait;
+    /**
+     * A worker wait's deadline re-observes its family (hearsay-tools/cezarion#1235): the reconcile
+     * resolves it with `timeout`, keeping any outcome observed by then. A failed checkpoint is
+     * retried every second while the wait is still open, never dropped as an uncaught error. An
+     * outcome whose resolution failed to commit arms the same retry with `firstDelay` 1 second.
+     */
+    private armWorkerDeadline;
+    /** Stop everything that could still resolve this wait. */
+    private disarmWait;
+    /**
+     * Watch a process wait's command (hearsay-tools/cezarion#1446). Like a timer, its wake is the
+     * agent's own arrangement: a stopping, stopped or finishing run takes none, and the wait stays
+     * open for that transition to cancel.
+     */
+    private startProcessWatch;
     private startCiWatch;
-    private retryCiAdmission;
-    private parkCiWait;
-    private queueCiWake;
-    private withdrawCiWait;
+    /** `resolveWait`, retried while its durable checkpoint is unavailable: a failed write may not
+     *  drop the accepted intent or publish a false result. */
+    private settleWait;
+    /** Commit an open wait as resolved together with its lifecycle input (id = wait id, or an
+     *  upgraded worker wait's `wakeInputId`), then queue the run's wake. A worker wait passes the
+     *  entry as reconciled, with its outcomes and `result`. Throws when the checkpoint fails; a wait
+     *  no longer open is ignored. */
+    private resolveWait;
+    /** A worker's current status, as a worker wait's result names it. */
+    private readonly workerStatus;
+    /** A timer or process wait due, or still owed, once the automatic-wake budget is spent wakes
+     *  nothing: it is cancelled with the cap note, and the run keeps whatever else it waits on
+     *  (hearsay-tools/cezarion#1233, hearsay-tools/cezarion#1446). */
+    private cancelAutomaticAtCap;
+    /** A parked run whose last wait was cancelled at the budget without a wake waits on the user: a
+     *  `budget` human wait opens and is shown (hearsay-tools/cezarion#1234), and the run leaves the
+     *  monitoring pool and its slot, as `parkForUser` does. A turn in progress is left to its own
+     *  turn end. */
+    private reparkWithoutWaits;
+    /** The same for a parked run with no live session, as when recovery fires an overdue timer
+     *  before any session exists: once no wait is left, the `budget` human wait opens and is shown,
+     *  and the user's Continue answers it. */
+    private waitOnUserWithoutSession;
+    /**
+     * A session failed, or closed cleanly, while the run still owed wait results
+     * (hearsay-tools/cezarion#1233). Count the failed delivery and decide what the closing path does:
+     * `park` keeps the run waiting and retries after the backoff (or, with nothing resolved, leaves
+     * its open waits to wake it); `settle` fails the run the ordinary way, which a usage limit takes
+     * into its own hold and resume without being counted; `capped` fails it at
+     * `MAX_WAKE_DELIVERY_ATTEMPTS`. Every settled run keeps its results.
+     */
+    private failedWakeDelivery;
+    /** The closing session leaves something undelivered: a resolved wait, or a wake of messages
+     *  alone (`owesWake`), which reopens the run as a resolved wait does and so counts against the
+     *  same bound (hearsay-tools/cezarion#1235). */
+    private owesDelivery;
+    /** A delivery, a human or a terminal path ends a run of failed deliveries and its backoff. */
+    private resetWakeDelivery;
+    private clearWakeBackoff;
+    /** Saves an accepted continuation. A human Continue also answers every human wait, ends failed
+     *  deliveries and restarts the budget, in the same best-effort commit. */
+    private commitContinuation;
+    /** An acknowledged wake turn runs: a retry stops unless a wake is still `owed`. Pool membership
+     *  changes only at a turn end or a terminal path; a worker park's idle timer belongs to the park,
+     *  not to the wake turn. */
+    private spendWakeAdmission;
+    /** `outcomes`, clearing the failure count when they deliver a wait result (`cleared`) or leave one
+     *  of `ids` a message the agent received (hearsay-tools/cezarion#1235). The opening prompt of a wake
+     *  continuation is not one: a session that reads it and fails has delivered nothing it owed, nor
+     *  has a read reported for a message whose submission was never acknowledged. */
+    private withFailuresCleared;
+    /** A lifecycle input no wait names is a wake of its own, a queued refusal among them
+     *  (hearsay-tools/cezarion#1301): `owesDelivery` counts it as owed, so its delivery ends the run
+     *  of failed deliveries, as a message's does. */
+    private isUnnamedLifecycleInput;
+    /** The failure count is on the run record, so a restart keeps it (hearsay-tools/cezarion#1234). */
+    private clearWakeDeliveryFailures;
+    /**
+     * Automatic wakes spent since the user last wrote: timer wakes and autonomous nudges, against
+     * one budget of `MAX_AUTO_CONTINUES` (hearsay-tools/cezarion#1234). The count is on the run
+     * record, so a restart, a scheduler continuation and a usage-limit resume keep it. A timer batch
+     * still awaiting its acknowledgement counts the unit it reserved.
+     */
+    private automaticWakes;
+    /** Spend one automatic wake on the record; returns the count after it. */
+    private chargeAutomaticWake;
+    /** A human message or a human Continue restarts the budget. */
+    private resetAutomaticWakes;
+    private retryWaitAdmission;
+    /**
+     * Park a session on its waits (hearsay-tools/cezarion#1233): `waiting`. A CI or
+     * timer park keeps its slot in the monitoring pool, so its wake starts at once, and needs no idle
+     * timer; a resolved wait with nothing left open is a wake due now and keeps it too. Worker waits
+     * rank above CI and timers (hearsay-tools/cezarion#1235): a park on them holds no slot and arms
+     * the idle timer, so the session closes after `IDLE_TIMEOUT_MS` and the run stays `waiting` for
+     * the next resolution or message to reopen it. Its intent reaches disk before the slot is freed.
+     * An open human wait is shown and parks for the user, with no slot (hearsay-tools/cezarion#1234).
+     */
+    private parkOnWaits;
+    /** Parked on the wait list with `workers` as its top wait (hearsay-tools/cezarion#1235): the park
+     *  holds no slot, so runner activity resumes it as it resumes a monitoring park. */
+    private parkedOnWorkers;
+    /** Leave the monitoring pool. Only a turn end or a terminal path does; a member's slot
+     *  goes back to the workspace. */
+    private leaveMonitoringPool;
+    /**
+     * Queue one wake for every resolved wait of a run and every message it has not received
+     * (`owesWake`). A live session takes it only at a turn boundary: a turn in progress, a native
+     * question included, picks it up at its own turn end. A monitoring-pool member already holds its
+     * slot and is admitted at once; any other live session waits for scheduler admission; a run with
+     * no session reopens through a scheduler-owned continuation. A pending question does not hold the
+     * wake back: the wake turn delivers the results and the messages beside it, and the question
+     * stays answerable (hearsay-tools/cezarion#1235).
+     */
+    private queueWaitWake;
+    /** Reject only the same durable and manager-level holds before restoring wake inputs. */
+    private canQueueWaitWake;
+    private queueSessionlessWaitWake;
+    /** Is this run's account on a usage-limit hold that keeps its wake in the line? */
+    private wakeHeld;
+    /** The run with the account its next turn runs on (`executionAccount`): a live session's step
+     *  settings, a queued continuation's account, else its latest session step. Both sides of a hold
+     *  read it, so a mixed-runner step is held by the account it ran on (hearsay-tools/cezarion#1236). */
+    private withExecutionAccount;
+    /** A monitoring-pool member's wake waiting in the line: it already holds its slot, so it needs
+     *  no regular one to leave (hearsay-tools/cezarion#1236). */
+    private poolWakeQueued;
+    /** A worker wait the store upgraded from the old engine as already settled may have had no wake input
+     *  queued yet (hearsay-tools/cezarion#1235): the old engine wrote it on its next pass, so its
+     *  result is written here, once, before the wake that delivers it. A full inbox waits. */
+    private restoreWorkerWaitInputs;
+    /**
+     * Messages are not waits (hearsay-tools/cezarion#1235): every conversation input the run has not
+     * received is an owed wake in its own right, beside its waits and beside a pending question. Not
+     * one claimed by an inbox read, one a provider flight or opening already carries, one a resolved
+     * wait carries as its wake, or the parent's answer to a routed question, which goes through the
+     * answer seam (`answerRoutedQuestion`). A lifecycle input no wait carries any more counts as one:
+     * the wake a legacy cancelled worker wait queued before the upgrade, which the wait list keeps as
+     * a cancelled entry and delivers as ordinary input, and a refusal queued for a closed session
+     * (hearsay-tools/cezarion#1301). One a listed wait or a delivered one names is that wait's, never
+     * owed again.
+     */
+    private pendingConversationWakes;
+    /** The parent's reply that answers a worker's pending routed question, still undelivered. */
+    private routedAnswer;
+    /** A wake is owed: a resolved wait, a message, or a parent's answer the run has not received. */
+    private owesWake;
+    /** A live session takes a wake at its turn boundary. A native question is mid-turn and takes one
+     *  input there: the parent's answer to it, through the answer seam (#505). */
+    private takesWake;
+    /** An admitted wake goes to the agent: a parent's answer through the answer seam, everything
+     *  else as one submission. */
+    private deliverAdmittedWake;
+    /** An admitted or queued wake whose messages an inbox read took has nothing left to deliver: the
+     *  run goes back to its park and gives up the slot the admission reserved. */
+    private retireEmptyWake;
+    /**
+     * Cancel every open or resolved wait of a run without waking the agent: stop, Finish, cancel,
+     * deletion, DONE and any terminal status. Human input cancels none (hearsay-tools/cezarion#1233).
+     * A failed commit leaves the record as a crash would and never stops the disarm, so Stop still
+     * reaches the session when the store is closed or broken (hearsay-tools/cezarion#1234).
+     */
+    private cancelOpenWaits;
+    /** Stop every watch, timer, retry and queued wake a run's waits hold in memory. */
+    private disarmRunWaits;
+    /** A deleted run's row is gone with its waits; only what they armed in memory is left. */
+    private readonly onRunDeleted;
     /** Snapshot of the actual active session, never guessed from partial run settings. */
     delegationExecutionSettings(runId: string): DelegationExecutionSettings;
     /**
@@ -578,9 +976,9 @@ export declare class RunManager {
      * running on another login is a billing boundary crossed without anyone choosing it.
      */
     selectDelegationExecutionSettings(runId: string, selection: {
-        backend?: RunnerId;
-        model?: string;
-        effort?: string;
+        backend?: RunnerId | undefined;
+        model?: string | undefined;
+        effort?: string | undefined;
         agentProfile?: string;
     }, validateModel?: (settings: DelegationExecutionSettings) => Promise<void>): Promise<DelegationExecutionSettings>;
     /**
@@ -597,10 +995,7 @@ export declare class RunManager {
     } | {
         conflict: true;
     };
-    startRun(workflow: WorkflowDef, input: StartRunInput, group?: {
-        groupId: string;
-        variant: string;
-    }, clientRequest?: {
+    startRun(workflow: WorkflowDef, input: StartRunInput, clientRequest?: {
         id: string;
         hash: string;
     }): RunRecord;
@@ -614,14 +1009,6 @@ export declare class RunManager {
      * definition refuses execution instead of quietly running quick-task or the edit.
      */
     private ownedWorkflow;
-    /**
-     * Parallel variants (spec 010): N runs of the same workflow on the same
-     * task, sharing a groupId. Variant A gets the task verbatim; B and C get a
-     * fixed one-line approach hint appended to the *task input* (not the step
-     * template), so diversification works with any workflow. The normal queue
-     * applies — with maxParallel=2 a third variant simply waits.
-     */
-    startVariants(workflow: WorkflowDef, input: StartRunInput, count: number): RunRecord[];
     /**
      * Slots this manager holds against the workspace-wide cap. `waiting` runs
      * don't hold a slot (#347): an idle claude process costs memory but no
@@ -637,6 +1024,19 @@ export declare class RunManager {
      *  `queue` is FIFO — `startRun` pushes and `recover()` re-queues by
      *  `createdAt` — so the head is the oldest. */
     private oldestQueuedAt;
+    /** When a queued entry joined the line as a wake of a run already in progress, or undefined for
+     *  a run that has not started (hearsay-tools/cezarion#1236, `nextLineEntry`). */
+    private wakeJoinedAt;
+    /** The oldest wake in this manager's line that an account hold does not keep there, or null:
+     *  the semaphore gives a freed slot to the project holding the oldest such wake before any
+     *  project's unstarted runs. A held wake is left out, or its project would take the slot and
+     *  start a new task ahead of another project's started run (hearsay-tools/cezarion#1236). */
+    private oldestWakeAt;
+    /** Can this queued entry leave the line now, capacity aside? No worktree cleanup, no
+     *  autosave cleanup, no pending root finish, no account hold, and not already admitted
+     *  elsewhere. `pump()` and `oldestWakeAt()` share it, so the workspace order and the project
+     *  order agree (hearsay-tools/cezarion#1236). */
+    private canLeaveLine;
     /**
      * A slot this manager held just came free. Pump the whole WORKSPACE, not
      * just this manager: `maxParallel` is counted across every project, so the
@@ -657,22 +1057,23 @@ export declare class RunManager {
      * root (spec 006 degradation rule), which is always the tighter bound.
      */
     private pump;
+    /** Checkpoint before dequeue, while worker cancellation can still find the queued entry. */
+    private checkpointQueuedWorker;
+    /** A lost runner boundary requeues the wake and ends this pass instead of spinning. */
+    private admitQueuedWaitWake;
+    /** Read and hydrate mutable queued input in the same synchronous tick as dequeue. */
+    private launchQueuedRun;
+    /** Save restart evidence before queue admission or the next startup await. */
+    private checkpointRestartContext;
     /**
-     * Make one `queued` RECORD executable again — the engine half a queued run needs but does not
-     * persist (`pendingJobs` / `pendingContinuations` are process-local, the record is not).
-     *
-     * Two callers, one path: boot recovery re-adopts everything the previous process was holding,
-     * and the queue watchdog re-adopts anything the running process has somehow lost. A queued
-     * record with no work item behind it is invisible to `pump()` and would sit there for good,
-     * which is the worst failure this engine has — the task is neither running nor failed, just
-     * silently never going to happen.
-     *
-     * A continuation is reconstructed first: its executable details are gone, but the pending
-     * `continue-N` step and the session before it are durable, which is enough. Otherwise the
-     * workflow is revived from the record. A run that can be neither is failed loudly rather than
-     * left in the queue as a ghost.
+     * Rebuild executable state for a durable queued record. Shared by recovery and the watchdog;
+     * reconstruct jobs or continuations before pumping.
      */
     private reviveQueuedRun;
+    private reviveQueuedContinuation;
+    /** Match the pinned execution account before considering a persisted session resumable. */
+    private queuedResumeSession;
+    private reviveQueuedWorker;
     /**
      * Startup recovery (#367) — re-adopt runs that were live when the previous
      * cezar process exited (requires the store opened with `keepLive`):
@@ -690,17 +1091,48 @@ export declare class RunManager {
      * worker or root skip their families (#779, plan step 3).
      */
     recover(familyRootId?: string): Promise<void>;
+    /** The workers in scope whose generation a dead controller left `starting`, and the members of
+     *  their families, whose transcript facts recovery prepares before it settles them. */
+    private collectOrphanWorkerGenerations;
+    /** Recovery's first pass over the live set: the input state a dead controller left behind. */
+    private recoverUnreadInputs;
+    /** Settles each orphaned `starting` generation, or re-probes it when its proof does not settle. */
+    private settleOrphanWorkerGenerations;
+    /** Restart sweeps every worker's scratch; an adopted family schedules only its own members. */
+    private recoverWorkerScratch;
     /**
-     * Take over a run whose owning process is gone (#779, plan step 3): a control (Stop, Continue,
-     * archive…) reached a run `runOwnership` calls `orphaned`. Its family is claimed, its live runs
-     * are settled rather than resumed (`settleOrphanedRun`: interrupted, or cancelled before they
-     * began), and the family is recovered as a restart would, which repairs it but finds nothing live
-     * to resume. The control that follows then acts on a run this process now owns — rather than on
-     * a record nobody owns, a dead end until a restart — and only Continue starts agent work, with
-     * the user's own input. With `stop` the control is Stop, which the adoption carries out itself:
-     * `runId` ends cancelled, as an accepted Stop reads, rather than interrupted. False when a live
-     * process holds it after all (or it is gone): the control is refused as another process's.
-     * Adoptions run one at a time, after any recovery already in progress.
+     * One live run of the restart loop. Returns the promise the loop must await (a root finish, a
+     * re-queue or a settlement), else `undefined`.
+     */
+    private recoverLiveRun;
+    /** True when a worker's root takes no more work from it: a closed root cancels the worker, and a
+     *  root in review or finishing leaves it as it is. */
+    private recoveryLeavesWorkerToRoot;
+    /** The run as recovery reads it after it reconciles the run's question state. */
+    private reconcileRecoveredAsk;
+    /** True when the recovered run stays parked: on a human wait, a pending question or its waits. */
+    private parkRecoveredRun;
+    /** Parks a recovered run: `waiting`, with each of its open waits re-armed. */
+    private parkOnOpenWaits;
+    /**
+     * A `waiting` run that did not park. Returns the settlement the loop must await, else
+     * `undefined`.
+     */
+    private recoverClosedWaitingRun;
+    /** A recovered run whose structured question cannot be answered fails with its open steps. */
+    private failRecoveredInvalidAsk;
+    /** A `running` run whose process died mid-turn. */
+    private recoverInterruptedRun;
+    /** True when the interrupted run has no session to continue and goes back to the queue. */
+    private requeueInterruptedRun;
+    /** Delivers the parent replies routed to each worker in scope. */
+    private answerRecoveredRoutedQuestions;
+    /** Re-arms each live run's waits, or queues the wake it owes. */
+    private rearmRecoveredWakes;
+    /**
+     * Adopt a dead owner’s family for a control, then recover the settled family without resuming
+     * work. Stop cancels its target; only Continue starts work. Serialize adoptions after recovery.
+     * False means missing or live-owned.
      */
     adoptOrphanedRun(runId: string, opts?: {
         stop?: boolean;
@@ -711,13 +1143,18 @@ export declare class RunManager {
     /** Shutdown is not completion. Explicit terminal controls retain their precedence. */
     private preserveRunAfterDisposal;
     /**
-     * Register an executing run: the ONE way an `ActiveRun` enters `active`. Both construction
-     * sites (`execute` and `runContinuation`, which serves Continue and restart recovery) call it,
-     * so the store pins every run this manager executes (#779) — its record stays the held object
-     * every turn-end handler reads and writes until `dropActive` lets it go. A second site that set
-     * `active` directly would execute a run the store could evict mid-turn (the #811 shape).
+     * Register an executing run: the ONE way an `ActiveRun` enters `active`. Both callers of
+     * `createActiveRun` (`execute` and `runContinuation`, which serves Continue and restart
+     * recovery) call it, so the store pins every run this manager executes (#779) — its record stays
+     * the held object every turn-end handler reads and writes until `dropActive` lets it go. A site
+     * that set `active` directly would execute a run the store could evict mid-turn (the open-mercato/cezar#811 shape).
      */
     private activate;
+    /** A detail's finish verdict reads the live registries, and a session leaves them after its
+     *  last write (the final autosave), so the cockpit's refetch on that write still saw "no open
+     *  session" and hid Accept. Publish a resting run again once it is out of them
+     *  (hearsay-tools/cezarion#1301). */
+    private republishFinishVerdict;
     /** Remove a run from the live registries — keeps `waiting ⊆ active`. */
     private dropActive;
     private readonly workerScratchCleanup;
@@ -739,7 +1176,8 @@ export declare class RunManager {
      * transcript, because a run that stops resuming itself needs to explain why.
      */
     private scheduleAutoResumeIfLimited;
-    /** Publish the deadline on the record (the cockpit's only source) and arm the timer for it. */
+    /** Publish the deadline on the record (the cockpit's only source) and arm the timer for it. The
+     *  run waits for it (hearsay-tools/cezarion#1236): `waiting`, its error kept for a withdrawal. */
     private armAutoResume;
     /**
      * The window has reopened. Re-check the record synchronously — hours may have passed, and the
@@ -748,17 +1186,8 @@ export declare class RunManager {
      */
     private fireAutoResume;
     /**
-     * Make the armed timers agree with the records and the current setting. Runs on every `pump()`
-     * — which is where a settings change lands (a config PUT refreshes the shared semaphore, which
-     * pumps every manager) — and once from `recover()`.
-     *
-     * It is a RECONCILE rather than a one-shot restore because the deadline is durable state and
-     * the timer is not: a restart, a rebuilt project context, a manager disposed mid-wait, or a
-     * refusal all leave a record promising a resume that no timer is holding. Rebuilding from the
-     * record covers every one of those at once — the alternative is a hint counting down to a time
-     * that has already passed, which is exactly the failure this method exists to make impossible.
-     *
-     * Cheap: an in-memory scan, and arming is skipped for every run already held.
+     * Reconcile process-local resume timers from durable records on pump and recovery. Retire
+     * appointments when disabled or invalid; do not leave a deadline with no wake source.
      */
     private reconcileAutoResumes;
     /**
@@ -776,37 +1205,13 @@ export declare class RunManager {
      */
     private requeueWhileHeld;
     /**
-     * The failsafe: a queue must never be able to wedge.
-     *
-     * Everything else in this file makes an idle queue CORRECT under some condition — a slot cap, a
-     * repo-root lease, and now a usage-limit hold. That is also what makes a wedged queue look
-     * correct, and the hold has already produced one in the field: two resumes fired together, each
-     * holding the account the other was waiting on, and the whole workspace stopped with every task
-     * `queued`. That specific bug is fixed and tested, but "the queue stopped and nothing will ever
-     * restart it" is too expensive a failure mode to leave resting on any single fix being right.
-     *
-     * The test is deliberately about JUSTIFICATION rather than about any particular bug: idling is
-     * legitimate while work is running (here or in another project), or while a real appointment is
-     * still ahead — a scheduled resume that will fire and pump on its own. Anything else is a
-     * queue with work in it, nothing running anywhere, and no event coming to wake it. That gets one
-     * forced sweep, which starts work under the ordinary caps and lets the account's real state
-     * re-assert itself: if the window truly is shut, that task meets the limit and re-establishes an
-     * honest hold, with a real deadline behind it this time.
-     *
-     * Public so a test can drive the wedge directly instead of waiting out the interval.
+     * Repair queued records missing executable state. Rescue an idle queue only when no running work
+     * or future appointment explains it; start through ordinary caps. Public for direct tests.
      */
     rescueStalledQueue(now?: number): Promise<void>;
     /**
-     * The accounts this project is currently holding: one key per run parked on a usage-limit
-     * resume that has not come due yet (spec 2026-08-03-auto-resume-after-usage-limit).
-     *
-     * Published to the shared semaphore so the hold spans PROJECTS — one Claude account can be
-     * driving tasks in three repos, and a limit closes it for all of them. Derived from the
-     * records on every ask rather than tracked as state: a deadline that passes, a resume that
-     * fires, a cancel, an archive and a delete all lift the hold with no bookkeeping.
-     *
-     * Deliberately excludes a deadline that has already passed — that run is about to resume, and
-     * holding the queue for it would only stall the very work the window reopened for.
+     * Derive this project’s future-deadline and in-flight account holds from records for the shared
+     * semaphore. Past deadlines do not block the queue.
      */
     accountHolds(now?: number): AccountHolds;
     /**
@@ -821,6 +1226,14 @@ export declare class RunManager {
     /** Retire a pending resume — timer, deadline and counter. The counter goes too because every
      *  caller is a fresh epoch: a human Continue, or a resume that re-stamps its own count. */
     private clearAutoResume;
+    /**
+     * Withdraw a pending resume without continuing the run: a per-task cancel, the setting switched
+     * off, a missed window, the cap, or a resume that could not start. A run on hold settles
+     * `failed` with the error it kept, the state it was in before it waited (owner,
+     * 2026-10-21). Its waits stay as a failed run's do: open ones armed, resolved ones owed to the
+     * next Continue.
+     */
+    private withdrawAutoResume;
     /** Reclaim finished worktrees beyond the keep-limit (#483) — directory only,
      *  `cez/<id8>` branch kept. Best-effort; a failure never affects run
      *  lifecycle. `review`/live runs are excluded by the selector. */
@@ -828,25 +1241,16 @@ export declare class RunManager {
     /** Last live-refresh namer inputs per run — unchanged inputs skip the call. */
     private lastNamerKey;
     /**
-     * Acquire the one-at-a-time lease for runs executing in `repoRoot`.
-     *
-     * A lease waiter is idle, so it parks in `waiting` and gives its
-     * `maxParallel` slot back (the #347 rule): isolated worktrees keep using
-     * every configured slot while root runs line up. The store status stays
-     * `running` — only the queue's busy count changes, so the GUI never shows a
-     * lease-blocked run as awaiting user input.
-     *
-     * The lease is held for the run's whole lifetime, including the idle
-     * `waiting` parks between agent turns. A parked session is still live and
-     * writes to the working tree the moment it resumes, so handing the tree to
-     * another run there would reintroduce the concurrent-edit bug (#438) this
-     * lease exists to prevent.
-     *
-     * Returns false when the run was cancelled while waiting: the lease was
-     * never granted and the caller must not touch the working tree.
+     * Acquire the exclusive repository-root lease. A waiter releases scheduling capacity but stays
+     * running in the store. Hold the lease across idle turns; false means cancellation before
+     * acquisition and forbids tree access.
      */
     private acquireRepoRoot;
     cancel(runId: string): boolean;
+    private cancelActiveRun;
+    private cancelWorkerExecution;
+    private cancelQueuedRun;
+    private cancelRunWithoutSession;
     isActive(runId: string): boolean;
     /**
      * Claim a run's worktree for a reclaim (#483, issue 08 §B4), or null when it is in use or no
@@ -878,20 +1282,9 @@ export declare class RunManager {
     claimForPublish(runId: string): (() => void) | null;
     claimForBranchCleanup(runIds: readonly string[]): (() => void) | null;
     /**
-     * Fold a queued run's persisted prompt — `run.task` plus everything stacked
-     * onto it (#472) — into the job input that is about to execute.
-     *
-     * Called from `pump()` immediately before `execute()`, which makes the RECORD
-     * the single source of truth for a queued run's prompt. Before this, the
-     * executing copy lived in `pendingJobs` (memory) while the record held a
-     * second one, so an edit that PATCHed the record silently did nothing until a
-     * restart. `recover()` rebuilds through the same helper, so both paths agree.
-     *
-     * **Read-only, and that is load-bearing.** It composes into the in-memory
-     * `input` and never writes the folded string back to `RunRecord.task`; the
-     * task and its stack stay separate on disk for the life of the run. Writing
-     * back would re-append the whole stack on every recovery and compound without
-     * bound — asserted directly by a test.
+     * Fold the persisted task and queued message stack immediately before execution. Keep durable
+     * record state authoritative over pendingJobs. Read-only: never write the composite back to
+     * RunRecord.task; task and stack stay separate.
      */
     private hydrateQueuedInput;
     /** Apply edits and messages made while a restart continuation waits for
@@ -957,31 +1350,95 @@ export declare class RunManager {
      * `ActiveRun` does not exist yet for part of this window.
      */
     deferMessage(runId: string, content: PastedContent[]): boolean;
-    private parentCompletionPending;
-    /** The durable attention phase records a spent completion wait. It only
-     * becomes human attention once no owned worker remains live. */
-    private parentCompletionAttention;
-    private resetParentCompletion;
     private parentCompletionBlockers;
     /** A settled-but-uncollected result is work for the parent, not a live worker.
      * Keep the private termination proof: a public terminal status can precede exit. */
     private hasLiveWorkers;
+    /** Live workers keep a turn end monitoring unless the agent already waits on workers: an open
+     *  worker entry is the wait, so no implicit re-check timer goes beside it (hearsay-tools/cezarion#1235). */
+    private monitorsLiveWorkers;
     private delegationFinishBlockedReason;
     /** The read-only verdict and explicit Finish share this decision. Operational failures
      * (for example a failed durable write) are still handled at execution time. */
     private finishDecision;
     finishBlockedReason(runId: string): string | undefined;
-    /** One durable automatic worker wait per cycle. Further premature DONEs with
-     * live workers use the existing capped monitoring wakes; settled uncollected
-     * results retain attention. Human input starts a fresh completion cycle. */
+    /** A root's done blocked by its workers. In a live session the agent gets the refusal
+     * `cezar_done` gives, as one automatic turn (`settleTurn`, hearsay-tools/cezarion#1301), at its
+     * turn boundary, else at the live turn end; a closed session gets it as a queued lifecycle wake
+     * that reopens it (`queueCompletionRefusal`),
+     * a legacy accepted Finish's settlement included. A pending human question keeps its park. */
     private deferParentCompletion;
+    /** The completion gate for a root's done: `accept`; a refusal a live session takes as its turn
+     *  end's (`settleTurn`); or `held` when the gate settled it itself: a stopped root, a refusal
+     *  queued for a closed session, or a pending human question that parks for the user. */
+    private completionGate;
+    /** The session just took a refusal nudge, live or queued (hearsay-tools/cezarion#1301): its turn is
+     *  the nudge's, and its reply is bounded by the no-wait nudge's reply timer, so a harness that
+     *  reads the refusal and says nothing parks on Cezar's human wait instead of holding the slot. */
+    private awaitCompletionNudgeReply;
+    /**
+     * A blocked done found when the session is gone (`settleSuccess` after its async work, a
+     * restart; hearsay-tools/cezarion#1301): the refusal is queued as one lifecycle input, charged as
+     * the live nudge is, and the scheduler continuation reopens the session to deliver it
+     * (`queueWaitWake`); its delivery marks that turn as the nudge's. Open waits come first: they wake
+     * the run, and the refusal is a note. A spent budget opens Cezar's `budget` human wait, and an
+     * input the full inbox refuses leaves the run waiting for the user. Always true.
+     */
+    private queueCompletionRefusal;
+    /** Stop discards a refusal the run still owes, as it discards its waits: a later Continue must not
+     *  deliver a stale one (hearsay-tools/cezarion#1301). One an inbox read holds is left to it. */
+    private retireCompletionRefusal;
+    /** A refusal `queueCompletionRefusal` queued and the run has not received yet. */
+    private owesCompletionRefusal;
+    /** A closing session leaves the run something to reopen for: an agent wait, or a refusal queued
+     *  for it (hearsay-tools/cezarion#1301). A refusal takes a wait's bounded delivery retry, so a
+     *  session that keeps closing before it is submitted stops at `MAX_WAKE_DELIVERY_ATTEMPTS`
+     *  instead of reaching the success path, which would queue the refusal again. */
+    private holdsClosingWakes;
+    /** A human message or a wake (hearsay-tools/cezarion#1301): the turn it opens or steers no longer
+     *  answers a refusal nudge, so its blocked done gets a fresh nudge rather than the second step. */
+    private startCompletionCycle;
+    /** `cez worker wait`: an alias into the wait list, answered in the legacy `WorkerWait` shape
+     *  (hearsay-tools/cezarion#1235). */
     registerWorkerWait(parentId: string, request: WorkerWaitRequest): WorkerWait;
+    /**
+     * Open a `worker` wait in the list (hearsay-tools/cezarion#1235): on workers the parent owns, or
+     * on replies to requests the run sent. It stands beside CI, timer and human waits, up to
+     * `WAIT_LIMIT` open ones; the same target and mode return the open wait instead. The family is
+     * reconciled at once, so outcomes already in resolve it now, and its deadline is armed.
+     * Refusals throw `DelegationPolicyError`: `incompatible_state`, `denied_scope` or
+     * `capacity_limit`.
+     */
+    registerWorkerListWait(runId: string, request: {
+        workerIds?: string[];
+        requestIds?: string[] | undefined;
+        mode?: WorkerWaitRequest['mode'];
+        timeoutSeconds: number;
+    }, via: 'cezar_wait' | 'cez-worker-wait'): DeadlinedWorkerWaitEntry;
+    /** Scope of a wait on workers: only a parent holding `wait` may select, and only workers it owns. */
+    private assertOwnedWorkerWaitScope;
+    /** Scope of a wait on replies: the caller's own accepted requests, read from its family root's conversation. */
+    private assertRequestWaitScope;
+    /** The entry's target fields: each worker's revision at registration, or the requests with no outcome yet. */
+    private workerWaitTarget;
+    /** The wait as the store now holds it, open or already delivered, with its deadline. */
+    private recordedWorkerWait;
+    /**
+     * Cezar's own worker wait for a root that ignored its refusal nudge (hearsay-tools/cezarion#1301):
+     * `mode: 'all'` on the live workers that block its done, with no deadline and so no timer. The
+     * family is reconciled at once, so workers already settled resolve it now; their settlement wakes
+     * the parent, and their messages wake it beside the open wait.
+     */
+    private registerCompletionWait;
+    /** The states no worker wait registers in: refusals throw `incompatible_state`. Waits stand
+     *  beside CI, timer and human waits and beside each other (hearsay-tools/cezarion#1235). */
     private assertCanRegisterWorkerWait;
     /** An answer already executing in this generation is not an unanswered question.
      * Keep the durable checkpoint at turn-end for crash recovery, and match its exact
      * sequence so it can never hide a newer question. */
     private hasUnansweredHumanAsk;
-    /** Both roles can select their own requests without acquiring worker-management authority. */
+    /** Both roles can select their own requests without acquiring worker-management authority.
+     *  `cez worker wait --request`: an alias into the wait list (hearsay-tools/cezarion#1235). */
     registerRequestWait(runId: string, request: RequestWaitRequest): WorkerWait;
     /** A wait wake is only a pointer. Only provider submission/opening prompts own delivery. */
     private providerOwnsInboxInput;
@@ -1002,6 +1459,28 @@ export declare class RunManager {
      * (#505). The worker still parks on its ask; only the parent's reply, or a human after
      * fallback, answers it. Routing is idempotent: the message ID derives from the ask seq. */
     private routeWorkerQuestion;
+    /**
+     * A worker parked before finishing while its parent waits on it tells the parent why
+     * (hearsay-tools/cezarion#1327): Cezar posts a progress message from the worker, which wakes the
+     * parent and closes no wait. A parked question needs none, since the question itself goes to the
+     * parent. At most one notice per parent wait (`parkNoticeId`), and none when the turn that
+     * parked already messaged the parent, Cezar's own notice included. The message and the parent's
+     * input commit together; a crash before that commit leaves the recovery sweep to post it.
+     */
+    private noticeParkedWorker;
+    /** A worker parked before finishing: waiting, not stopping or complete, with no pending question
+     *  and no queued input. */
+    private parkedBeforeFinishing;
+    /** The ledger and the parent's inbox keep room as `service.send` counts it, beside open
+     *  questions' replies. When either is full, the worker's log says so once per wait. */
+    private parkNoticeAtCapacity;
+    /** Recovery's pass over family members: a question (#505) or a park notice
+     *  (hearsay-tools/cezarion#1327) that a crash caught before or after its commit to the parent
+     *  still reaches it. The worker waits settle between the two, so a notice selects only a wait
+     *  that is still open. */
+    private recoverWorkerMessages;
+    /** `noticeParkedWorker` for every worker a family's root owns. */
+    private noticeParkedWorkers;
     /** A human answering a worker question its parent handed back (#505): the reviewing parent
      * can no longer answer it, so it must not also block the human. */
     private answersFallenBackAsk;
@@ -1010,6 +1489,9 @@ export declare class RunManager {
     /** The parent's reply answers the routed question like a human answer would: through the
      * live session's native answer seam, or by reopening a session that is gone (#505). */
     private answerRoutedQuestion;
+    private pendingRoutedAnswer;
+    private reopenRoutedAnswer;
+    private deliverRoutedAnswer;
     /** A routed question settled without a reply (its worker stopped, a deadline, fallback) can
      * never be answered by the parent any more: hand it to the human on the worker (#505). */
     private retireSettledQuestions;
@@ -1020,9 +1502,17 @@ export declare class RunManager {
     private fallbackRoutedQuestions;
     /** The parent can still read and answer a routed question; answering needs its steer grant. */
     private parentCanReceive;
-    /** Cancel only the wait; persist its settlement before ordinary wake admission. */
+    /** The parent can still read a message from its worker. */
+    private parentTakesMessages;
+    /**
+     * `cez worker cancel-wait`: cancels a worker wait in the list, as `cezar_cancel_wait` does, and
+     * answers the legacy `WorkerWait` shape (hearsay-tools/cezarion#1235). A cancelled wait wakes
+     * nothing. A resolved wait is owed: it is returned as its `wake-pending` receipt and arrives with
+     * the next wake. A settled one returns its receipt; an unknown id is `incompatible_state`.
+     */
     cancelWorkerWait(parentId: string, waitId: string): WorkerWait;
-    private workerWait;
+    /** A turn of this run is executing now: a recovered run's is not, whatever it last recorded. */
+    private isExecutingWorkerWaitTurn;
     private rootFinishRequested;
     private executionBlockedByRootFinish;
     /** Finish can arrive during continuation preflight. Retain its accepted
@@ -1041,27 +1531,49 @@ export declare class RunManager {
      * Recovery's full pass (#661): every family whose root carries a conversation — settled ones
      * too, so a projection or outcome a crash interrupted is repaired — then every live family.
      * Only roots with a conversation are read; a settled family without one has nothing to settle:
-     * every other repair the sweep makes on a finished member (a stale `wait`, a cancelled root's
-     * Finish intent) is a clause of `isLiveRecord`, so open already holds that family.
+     * the other repair the sweep makes on a finished member (a cancelled root's Finish
+     * intent) is a clause of `isLiveRecord`, so open already holds that family.
      * Everything else asks `reconcileWorkerWaits()`, which covers the live families (#779).
      */
+    private reconcileRecoveryWorkerFamilies;
     reconcileAllWorkerFamilies(): void;
     /** Authority and wait live on disk; these collections are admission/timer caches only. One
      *  family by its root's id, or (no id) every family with a live member. */
     reconcileWorkerWaits(familyRootId?: string): void;
     private reconcileWorkerFamily;
-    queueWorkerWake(parentId: string): void;
-    /** Shared turn-end path; asks win, worker waits precede DONE/monitoring/nudges. */
-    private parkWorkerWait;
-    private withdrawWorkerWait;
+    /** The settled outcomes a run's worker waits can observe now: each owned worker whose execution
+     *  is provably complete, and each deleted worker's retained result. */
+    private workerObservations;
+    /** The family conversation's request outcomes, which settle request waits. */
+    private requestOutcomesOf;
+    /**
+     * Reconcile a run's open `worker` entries (hearsay-tools/cezarion#1235): the same observation
+     * rules as the old engine's wait had (an unsettled wait follows a re-run worker's revision; an
+     * observation without current proof is dropped). A satisfied or overdue entry resolves through
+     * `resolveWait`, unless every worker it names was destroyed while the turn that waits on them is
+     * still executing: nothing is left to await, so it is cancelled. Any other entry has its deadline
+     * armed. Messages never resolve one.
+     */
+    private reconcileWorkerEntries;
     /** Durable queue is the single hydration source for fresh, continuing and recovered runs. */
     steerWorker(runId: string, input: AgentInput): 'queued' | 'delivered';
     /** Transcript bubbles include refused sends. Only a successful delivery
      * checkpoint can answer the specific ask observed before that send. */
     private pendingHumanAskSeq;
+    /** An unanswered `ask.requested` with no open human wait (a row written before every ask opened
+     *  one) gets an open agent wait shown as that ask. Answer delivery still reads the transcript.
+     *  Cezar's own wait not shown as that ask is replaced, as the live ask does: a crash between
+     *  saving the ask and replacing it leaves that wait open (review of #1437). */
+    private adoptTranscriptAsk;
+    /** The human wait upgraded from a stored `hasPendingHumanAsk` (`turnId: 'legacy'`, never shown)
+     *  is settled as answered when the transcript's facts are known and hold no unanswered ask: that
+     *  flag was read from the transcript, so its ask was answered after the row was last saved.
+     *  Unknown facts are no evidence, and the wait stays open. */
+    private settleAnsweredLegacyAsk;
     private hasPendingHumanAsk;
     /** Accepted input may be temporarily refused while a backend HTTP ack is
-     * outstanding. That is not an empty queue and must not trigger automatic DONE. */
+     * outstanding. That is not an empty queue and must not trigger automatic DONE. `except` leaves
+     * out inputs already submitted, such as an acknowledgement still in flight. */
     private hasQueuedAgentInputs;
     /** Only the current session's observation writes consumedAt (#505). An ID reported
      * before its acceptance checkpoint lands is applied when that checkpoint commits. */
@@ -1076,8 +1588,19 @@ export declare class RunManager {
     /** The conversation messages the next submission would carry, if nothing but
      * conversation input leads the queue (lifecycle input stays a barrier). */
     private pendingConversationBatch;
-    /** Bundled messages rode the answer's own write: delivered now, read when that turn ends. */
+    /** Bundled messages rode the answer's own write: delivered now, read when that turn ends. The
+     *  answer's own outcomes (`with`: the human waits it answers, its charge) commit with them. A
+     *  refused write that carries a charge retries the whole batch best effort: the session has the
+     *  reply, and the charge never saves apart from it (hearsay-tools/cezarion#1805). Returns why the
+     *  first write was refused. */
     private commitBundledDelivery;
+    /** The fallback reply's charge, the question it answers and the reply it delivers are one commit
+     *  (hearsay-tools/cezarion#1805): no restart reads the charge without the reply. */
+    private commitRoutedAnswer;
+    /** One commit (hearsay-tools/cezarion#1805): the human waits a message answers, the messages bundled
+     *  with it and a deferred message's queue entry. A refused queue entry interrupts the session:
+     *  stdin and disk cannot transact, so it stays for conservative recovery. */
+    private commitAnswer;
     /** The turn that carried bundled messages has ended: the model read them. */
     private readBundledInputs;
     /** #505: the session closed without reporting it read (failure, stop, exit): the input
@@ -1103,6 +1626,8 @@ export declare class RunManager {
     private handleAgentInputReady;
     /** Reservation is synchronous; only an acknowledged transport may checkpoint delivery. */
     private submitAgentInput;
+    /** Apply the acknowledgement's effects only after its outcome commit succeeds. */
+    private applyAcknowledgedInput;
     /** False leaves the durable entry untouched. No human-answer/slash-expansion fallback. */
     private flushAgentInputs;
     private formatAgentInput;
@@ -1114,28 +1639,50 @@ export declare class RunManager {
      * while `waiting`). Returns false when there is no open session — the GUI
      * then offers "Continue" instead.
      */
-    sendMessage(runId: string, content: PastedContent[]): boolean;
+    sendMessage(runId: string, content: PastedContent[], messageId?: string): boolean;
+    /** Only an explicit option from the permission card may answer a native grant. */
+    respondPermission(runId: string, requestId: string, optionId: string): boolean;
     /** Restore active lifecycle/accounting when either Cezar or the backend
      * resumes work in a parked session. */
     private resumeParkedRun;
     /** Shared live-session delivery. Synthetic scheduler prompts reuse lifecycle
      * bookkeeping without masquerading as user-authored transcript messages. */
     private deliverMessage;
+    private prepareMessageContent;
+    private applyHumanMessageDelivery;
     /** Close the open session gracefully — the run then completes as `done`
      *  (or rests at `review` when the worktree holds changes, spec 009).
      *  On a run already resting at `review` (no session — the engine loop is
      *  over), "Finish" is the third review exit: accept the changes without a
      *  PR and flip straight to `done`. */
     finish(runId: string): boolean;
+    /** Finish ends the task, so an unanswered question is closed rather than left answerable on a
+     * finished run (hearsay-tools/cezarion#1260). A root never gets here with one pending: its Finish
+     * is refused until the question is answered. Stop keeps the question, which a human may still
+     * answer to reopen the run (#505). */
+    private closeQuestionOnFinish;
     /** A synthetic continuation can settle only the resumed agent turn. If the
      * original workflow still has steps after the waiting one, that would skip
      * those steps rather than resume the workflow engine. */
     private waitingBeforeFinalWorkflowStep;
     /** A clean process exit cannot complete a workflow still blocked on a question.
-     * Keep its existing durable waiting step so Continue can resume the tail. */
+     * Keep its existing durable waiting step so Continue can resume the tail. Cezar's fallback
+     * question on a worker is not one: the clean exit supersedes it, so the workflow goes on as the
+     * plain park it replaced did (hearsay-tools/cezarion#1301). */
     private unansweredWorkflowAsk;
     /** Locate the original workflow step whose closed session a synthetic Continue is resuming. */
     private waitingWorkflowStepIndex;
+    /** The workflow step after the one a continuation resumes, when that one is not the last: the
+     *  continuation's done completes the resumed step and starts this one (hearsay-tools/cezarion#1620). */
+    /**
+     * Whether a step session closed without its done while a later step waits (hearsay-tools/cezarion#1620).
+     * It reads and clears the done `closeAsDone` recorded. Finish is an explicit stop, settled as before.
+     */
+    private stepLeftOpen;
+    /** A resumed earlier step that closed without a done stays open: its workflow step, not the Continue's own. */
+    private settleIncompleteContinuation;
+    private continuationNextStep;
+    private ciWorkflowResumeStepIndex;
     /**
      * Session ids Cursor will accept on `session/load`. A launch UUID written
      * before `session.started` is only for the step rail (#583).
@@ -1155,10 +1702,262 @@ export declare class RunManager {
         error?: string;
     };
     private admitContinuation;
+    /** Overrides still persist before the execution checkpoint, even if that checkpoint refuses. */
+    private acceptContinuation;
+    private acceptUntouchedContinuation;
+    private acceptResumedContinuation;
+    private checkpointContinuation;
+    private dispatchAcceptedContinuation;
+    /** A Continue whose engine threw: the run fails and leaves the active set (exit `fail-crash`). */
+    private failCrashedContinuation;
     private runContinuation;
+    /** Where a Continue runs: an owned worker's verified workspace, or the task's worktree, which
+     *  retention may have reclaimed (#483), else the repository root. Returns undefined after an
+     *  unavailable owned workspace failed the run. */
+    private continuationWorkspace;
+    /** An owned worker's workspace for a Continue, verified with its parent's context. Returns
+     *  undefined after it failed the run: owned workers never adopt or recreate an unverified resource. */
+    private ownedContinuationWorkspace;
+    /** A Stop that arrived while the Continue resolved its workspace cancels the run before it
+     *  becomes active. */
+    private settleStoppedContinuation;
+    /** The repository-root lease of a Continue that runs in the repository root. Returns undefined
+     *  when no lease is needed, so that path does not yield, else whether the lease was granted. */
+    private continuationRepoRootLease;
+    /** Wait for the repository-root lease; a Stop during the wait cancels the run. */
+    private acquireContinuationRepoRoot;
+    /** Arm autosave, seed the handoff file, and run worktree setup. Returns setup's note for the
+     *  opening message. */
+    private prepareContinuationWorktree;
+    /** Mark the run and the Continue's step as running, then open the step. A Cursor session resumes
+     *  on the transport it was opened with. */
+    private startContinuationStep;
+    /** A Continue's opening message: the checkpoint's agent input with its outcome, its images and
+     *  attachments, and the `user-message` event that shows it. */
+    private continuationOpening;
+    /** A Continue's opening images and attachments. */
+    private continuationImages;
+    /** The human ask a human Continue answers, and the human waits that answer settles. */
+    private openingAnswer;
+    /**
+     * A completed turn acknowledges the opening payload. Until then a restart
+     * must replay it, including a crash after startSession but before delivery.
+     * Returns false when the opening input's checkpoint failed, and the turn end stops there.
+     */
+    private acknowledgeOpeningTurn;
+    /** Latch an agent input error, then interrupt: a transport failure the interrupt causes is secondary. */
+    private latchAgentInputError;
+    /**
+     * What a Continue runs with. Backend + model come off the record: the run's current backend by
+     * default, or the follow-up override that `continueRun` persisted before scheduling (#401).
+     * Returns undefined after a pre-spawn gate failed the turn.
+     */
+    private continuationLaunchSettings;
+    /** Settle this turn as a failure before anything is spawned — the shape every
+     *  pre-spawn gate needs (model identity, #405; temp directory, #785). */
+    private failContinuationBeforeSpawn;
+    /**
+     * The model a Continue runs with, or the model identity error's message.
+     * Apply the SAME canonical-identity gate the first spawn applies (#405, review M1).
+     * A follow-up may switch both runner and model (#401), so without this the record keeps
+     * asserting the identity the run STARTED with while a different model serves the turn —
+     * the exact defect that PR existed to remove — and the raw record string reaches the CLI
+     * in the un-normalised wire form the first step already converted away (`anthropic/opus`
+     * instead of `opus`). Fail loud here too rather than let the backend pick a default.
+     */
+    private continuationModel;
+    /** The effort a Continue runs at, or the message of the error that refuses it: an owned worker's
+     *  pinned effort, else the continued step's authored one, else the run's; unset when the project
+     *  locks agent models. */
+    private continuationEffort;
+    /** Record the Continue's account on its step and the settings its workers inherit. */
+    private applyContinuationSettings;
+    /** The Continue's runner, and whether it resumes into a thread that already holds the skill
+     *  playbook. A resumed Cursor session keeps the transport it was opened with. */
+    private continuationRunner;
+    /** The continued step's skill files and playbook, when the step names a skill or the prompt
+     *  starts with a `/name`. Returns undefined otherwise, so that path does not yield. */
+    private continuationSkills;
+    /** Reinstall the continued step's skill and a leading `/name`'s, and build the playbook. */
+    private provisionContinuationSkills;
+    /** The continued step's skill when the registry did not list it yet. */
+    private awaitContinuedSkill;
+    /** A Stop before the Continue's session spawned: cancel the step and the run. */
+    private settleContinuationPrelaunchCancel;
+    /** A Continue's launch went stale while it provisioned (`launchStale`). A replaced active run
+     *  needs nothing more; a Stop cancels the run; a root Finish holds the Continue in the queue. */
+    private settleStaleContinuationLaunch;
+    /** Start a Continue's session, resuming its own session when it has one. A throw revokes the
+     *  tools this launch was given and propagates to `continueRun`. */
+    private startContinuationSession;
+    /** Wait for a Continue's session to close, then settle the run by how it closed. Teardown always
+     *  revokes the launch's tools, saves the worktree and leaves the active set
+     *  (`releaseContinuationSession`). */
+    private awaitContinuationSession;
+    /** Settle a Continue whose session closed without a fault: undelivered wakes, a Stop, a step left
+     *  open, a done, or an idle close. Returns the settlement to wait for, or undefined when it
+     *  completed without yielding. */
+    private settleClosedContinuation;
+    /** The session closed with wakes it still holds: park the run, or fail it when their delivery
+     *  failed. */
+    private settleClosingWakes;
+    /** A Stop ended the Continue's session: cancel its step and the run. */
+    private settleCancelledContinuation;
+    /** The Continue's step is done: settle the run, or the workflow step it resumed. Returns the
+     *  settlement to wait for, or undefined when it queued the workflow remainder. */
+    private settleDoneContinuation;
+    /** The Continue finished the workflow step it resumed: queue the workflow remainder, or settle
+     *  the run when none is left or Finish was requested. */
+    private settleResumedWorkflowStep;
+    /** Settle the run after a successful Continue. */
+    private succeedContinuation;
+    /** The Continue's session failed, or its settlement threw: fail its step, then park the run
+     *  when it still holds wakes, else fail it. */
+    private settleFailedContinuation;
+    /** A Continue's session teardown: revoke the launch's tools, record the usage peaks, clear the
+     *  timers, save the worktree, leave the active set, then queue the workflow remainder. */
+    private releaseContinuationSession;
     private execute;
+    /**
+     * The launch half of `execute`: the backend, extra system prompt and model identity the run
+     * starts with, recorded on the run as it starts. Undefined when the run was cancelled or went
+     * back to the queue first.
+     */
+    private startExecution;
+    /**
+     * Canonical provider/model identity (#405) — the normalised `provider/model`
+     * the task ran with, persisted for cost attribution / reproducible replay
+     * beside the free-text `model`. Best-effort here (a per-step `runner`/`model`
+     * can still override it); the authoritative fail-loud gate is at spawn.
+     */
+    private taskModelIdentity;
+    /**
+     * Worktree per task (spec 006): the agent works on its own branch in
+     * `.ai/cezar/worktrees/<id>`, never in the user's working tree. A Git task
+     * that requests isolation fails closed if the worktree cannot be
+     * established; only explicit opt-out and non-Git modes run in place.
+     * False when the run stopped here.
+     */
+    private prepareExecutionWorktree;
+    /**
+     * Fork from the configured base branch (config.json `baseBranch`, e.g.
+     * `develop`) — also the target of the eventual draft PR. Unresolvable
+     * (typo, not fetched) → note + the currently checked-out branch.
+     *
+     * A task that already recorded a fork point keeps it: its worktree is
+     * reused as-is, and re-resolving against a since-changed config would
+     * silently re-anchor the `merge-base` every diff/shortstat is measured
+     * from, shifting "what did this task change" under an existing task.
+     */
+    private executionBaseRef;
+    /** Opens the task's worktree and prepares it for the first step. False when the worker stopped
+     *  first, or when the worktree could not be established, which fails the run. */
+    private createExecutionWorktree;
+    /** The task's worktree: an owned worker's verified workspace, or a new worktree forked from `base`. */
+    private openExecutionWorktree;
+    /**
+     * The task's attachments for the first agent step's opening message, and its image blocks.
+     * Both are empty once an agent step of this workflow has run.
+     */
+    private openingInputs;
+    /**
+     * The step loop of `execute`, from `startAt`. Returns its outcome for `settleExecution`, or
+     * undefined when the run left this execution: parked, back in the queue, or held by another
+     * owner.
+     */
+    private runWorkflowSteps;
+    /**
+     * What the step loop does once an agent step's session ended: start the next step, settle the
+     * run, or leave the run to what holds it now (another owner, the queue, or a park). Synchronous,
+     * like the loop body it came from, so the loop yields only where it awaits the step itself.
+     */
+    private nextAfterAgentStep;
+    /**
+     * An authored step deadline bounds the whole step, its question included (#427 Q8, #470 T3):
+     * once it has passed, the step's human waits expire with it and the failure settles as it
+     * did before questions were waits. CI and timer waits still park the failure
+     * (`settleAgentStepWakes`). The clock starts before session setup, so a failure that close to
+     * the deadline counts as it.
+     */
+    private expireStepDeadlineWaits;
+    /**
+     * Records a failed agent step, then settles what the run's closing wakes need. True when the
+     * run parked to deliver them; a capped delivery fails the step and marks the loop capped.
+     */
+    private settleAgentStepWakes;
+    /**
+     * A check step's result: a pass goes on to the next step, a failure loops back to its
+     * `onFail.retry` step while retries remain, and otherwise fails the run. Returns the index the
+     * step loop continues from, or undefined when the run fails.
+     */
+    private settleCheckStep;
+    /**
+     * Settles the run once the step loop of `execute` ended: the final autosave, then the
+     * cancelled, failed, incomplete-step, idle-closed or success settlement.
+     */
+    private settleExecution;
+    /** The cancelled settlement: the run and its running and waiting steps become cancelled. */
+    private settleCancelledRun;
+    /** The failed settlement. A capped wake delivery adds the cap's note. */
+    private settleFailedRun;
     /** Returns an error message, or null on success. */
     private runAgentStep;
+    /** A fresh step's opening message, before the open-waits footer and the session-start context,
+     *  and the selected skill's playbook for its system prompt. */
+    private stepOpening;
+    /** Shutdown left this delegated run to restart recovery: its session's events are dropped, and an
+     *  error still interrupts the session. */
+    private disposedSessionEvent;
+    /** A session's fault: the first one stands, an agent input error recorded before it wins, and the
+     *  session is interrupted. */
+    private recordSessionFault;
+    /** The session reached a turn end: retire the inputs it left unread, read the bundled inputs, and
+     *  open the turn boundary with a fresh CI turn id. */
+    private markTurnBoundary;
+    /**
+     * The model and effort a fresh step runs with. Normalise the selected model to canonical
+     * `provider/model` and back to the backend's own wire form via the ONE shared mapper (#405).
+     * Fail-loud: an unresolvable model (e.g. a bare id on opencode) returns the step error
+     * instead of letting the backend silently substitute its default.
+     */
+    private stepModel;
+    /** The effort a fresh step runs at: an owned worker's pinned effort, else the step's authored one,
+     *  else the run's; unset when the project locks agent models. An invalid authored effort throws
+     *  `DelegationPolicyError`. */
+    private stepEffort;
+    /**
+     * The account a step's session spawns under, resolved together with the temp-directory preflight
+     * (#785): the step fails with a named, actionable error instead of spawning a backend whose shell
+     * would return empty output. An account that would open another folder than its own fails the
+     * same way (#1283). Returns the profile, or that error's message.
+     */
+    private stepProfileFor;
+    /**
+     * Pre-launch revalidation (hearsay-tools/cezarion#1632). Stop, a stopped execution, a replaced
+     * active run or a root Finish can arrive while provisioning awaits. Then this launch's CI tools
+     * and delegation are revoked, and the run state forgets each one only while it is still this
+     * launch's. The caller settles the run.
+     */
+    private launchStale;
+    /** A launch's opening message (hearsay-tools/cezarion#1632): the body, the open-waits footer, the
+     *  resume context of a Continue's checkpoint, then the session-start context in front. */
+    private launchOpening;
+    /** Start a fresh step's session. A throw revokes the tools this launch was given and returns its
+     *  message as the step's error. */
+    private startStepSession;
+    /**
+     * The system prompt after the skill playbook (hearsay-tools/cezarion#1632): the run's extra
+     * prompt, the delegation instructions, the automations and project webhooks parts, the artifact
+     * contract, then the handoff contract.
+     */
+    private launchSystemTail;
+    /** Wait for a fresh step's session to close. Returns the step's error, or null. Teardown always
+     *  revokes the launch's tools and clears the session's state (`releaseStepSession`). */
+    private awaitStepSession;
+    /** A fresh step's session teardown: revoke the launch's tools, record the usage peaks, and clear
+     *  what its turns left on the run state: the idle timer, the monitoring and waiting marks, the
+     *  turn boundary, the park intents and the session itself. */
+    private releaseStepSession;
     /** Some adapters return assistant text only in their final result. Preserve that
      * evidence for collection without duplicating an already persisted transcript. */
     private persistWorkerAssistantResult;
@@ -1172,16 +1971,63 @@ export declare class RunManager {
      * item-shape cache are session-scoped, like the mapper state feeding them.
      */
     private makeUiSink;
-    /** Ask precedence also releases an admitted but not yet delivered worker wake.
-     * Its durable input/wait remain queued until an actual human answer. */
+    /** Ask precedence: the question is pending, and no autonomous nudge goes beside it. Durable
+     *  input and waits stay queued until an actual human answer. */
     private prepareHumanAsk;
-    /** A prose or rejected-ASK fallback supersedes a registered autonomous wait. Keep the
-     * checkpoint through idle closure/restart and hold worker input until a
-     * successful human delivery, just as for a structured ask. */
-    private prepareProseHumanGate;
+    /** The human gate a human wait without a card raises (the monitoring line with re-checks off):
+     * `PROSE_HUMAN_GATE` names it in the transcript. Keep the checkpoint through idle closure/restart
+     * and hold worker input until a successful human delivery, just as for a structured ask. */
+    private raiseHumanGate;
+    /** The open human wait nobody has shown the user yet (hearsay-tools/cezarion#1234): one this
+     *  turn registered, or one a failure, close or crash caught before its turn end. */
+    private unsurfacedHumanWait;
+    /** The human wait this turn end raises: one nobody has seen yet. One registered while a question
+     *  is pending waits on that question instead, and raises nothing. */
+    private turnEndHumanWait;
+    /** An alias's human wait, or the one already open: a run holds one. A full list opens none. */
+    private openHumanAlias;
+    /** Record which question a human wait is shown as: the pending card or gate, whose answer settles
+     *  it. A card shown in place of the wait's own replaces it. A wait already shown is left alone. */
+    private markHumanWaitSurfaced;
+    /**
+     * Show a human wait outside its turn end (hearsay-tools/cezarion#1234): at a boundary, at the
+     * budget, or from the failure, close and recovery paths, where no turn end will. A card raises
+     * `ask.requested` and goes to a worker's parent; a wait without one raises the human gate. A
+     * question already pending is the one it waits on. A wait already shown is left alone. Cezar's
+     * own wait is shown as its note instead (`showCezarHumanWait`).
+     */
+    private surfaceHumanWait;
+    /**
+     * Cezar's own human wait (`no-wait`, `budget`) is shown as a note, recorded as its `askSeq`, and
+     * raises no human gate (hearsay-tools/cezarion#1234). The agent asked nothing: the run waits for
+     * the user as the plain park did before these waits, so worker messages still wake it and its
+     * wait registrations, `cezar_done` and the user's Finish are not refused. The user's message
+     * settles it, and the agent's own wait or question replaces it (`withdrawCezarHumanWaits`).
+     */
+    private showCezarHumanWait;
+    /** Cezar waited on the user only because the agent had nothing to wait on: the agent's own wait
+     *  or question replaces that wait (hearsay-tools/cezarion#1234). It also ends with the session
+     *  that opened it, so a close, an idle close or a failure settles as the plain park did. */
+    private withdrawCezarHumanWaits;
+    /** Whether a closing session leaves the run waits to park on. Cezar's own human waits end with the
+     *  session, even when the store refused their cancellation (`withdrawCezarHumanWaits`). */
+    private holdsAgentWaits;
+    /** A valid ask line replaces the card of the human wait its turn registered. It is saved
+     *  before the turn end can re-enter a boundary (Cursor print's ready callback from
+     *  `discardQueuedMessages`), so a wait shown there shows the later card. */
+    private latchAskLineCard;
+    /** Read fresh: a boundary the turn end re-enters (Cursor print's ready callback from
+     *  `discardQueuedMessages`) may have shown the wait already, and its card stands. */
+    private humanWaitShown;
+    /** The turn end raised a card or the gate: record the human wait it shows. A turn that registered
+     *  none opens the ask line's. */
+    private recordTurnEndQuestion;
     /** Native backend asks arrive before turn-end. Persist and park immediately
      * so the cockpit shows attention and the run releases its workspace slot. */
     private handleRunnerUiEvent;
+    private handlePermissionRequested;
+    private handlePermissionResolved;
+    private handleNativeAskRequested;
     /** Persist the invocation checkpoint before launching a runner. A throw or
      * process exit before `turn.started` therefore leaves a durable mismatch. */
     private beginUsageInvocation;
@@ -1257,6 +2103,21 @@ export declare class RunManager {
      * off — settle straight to `done`, leaving the diff in the worktree untouched.
      */
     private settleSuccess;
+    /**
+     * Whether a successful run rests at `review`: its worktree holds a diff, the review gate is
+     * on, and the run is not autonomous. A root finish cannot settle without a diff, so a failed
+     * diff throws for it.
+     */
+    private successNeedsReview;
+    /** True when the success settlement must not write: the run is no longer live, a newer
+     *  continuation started, or another execution replaced the one that began settling. */
+    private successSuperseded;
+    /** A Stop accepted while the success settlement read the diff: the run and its running and
+     *  waiting steps become cancelled, and a step keeps a finish time it already has. */
+    private settleCancelledSuccess;
+    /** The ordinary success path (not a root finish): the steps that settle as done, then the run
+     *  as `review` or `done`. */
+    private commitOrdinarySuccess;
     /** Called only after session/process settlement. A refused nudge retained its
      * slot and running status until idle close; ordinary roots must now become
      * resumable. Previously parked roots and delegated lifecycle policy stay intact. */
@@ -1266,6 +2127,14 @@ export declare class RunManager {
      * would produce so its parent can collect it. Explicit asks and worker waits
      * remain durable attention states. */
     private settleIdleClosedWorker;
+    /**
+     * An earlier workflow step whose session closed without a done: a clean exit, an idle close, or
+     * a Continue that resumed it and closed the same way (hearsay-tools/cezarion#1620). The step stays
+     * `waiting` and the tail never starts. A root waits for Continue, which resumes the step. An owned
+     * worker settles as a single-step task's close does, so its parent can collect it; the step stays
+     * `waiting`, and a parent resume re-enters it. A question still pending keeps either one waiting.
+     */
+    private settleIncompleteStep;
     /**
      * Persist every attachment a user message carries — images and files alike (#950) — into the
      * run's own attachment folder, in the order they were attached. The returned paths are what the
@@ -1297,36 +2166,174 @@ export declare class RunManager {
      * teardown. Native mid-turn asks still park for an answer (outside this policy).
      * A refused ordinary nudge waits for readiness at this exact boundary; the idle
      * timeout bounds a missing readiness signal. New activity/input invalidates it.
-     * A refused portable override falls back to normal question parking.
+     * `ask` is this turn's ask line, which an autonomous run does not register before the budget
+     * (hearsay-tools/cezarion#1234). A wire that refuses the nudge registers it after all.
      */
+    /** `text` is the turn-end rule's nudge; an ask line's nudge scopes the same one itself (hearsay-tools/cezarion#1620). */
     private tryAutonomousNudge;
-    /** Shared silent-tail conditions for the one-shot visible-message nudge. Callers must
-     *  invoke this only when nothing else already continued. */
-    private maybeFinalMessageNudge;
-    /** One-shot visible-message nudge when a turn ends on reasoning or a tool (#544, #119).
-     *  Liveness: this path has no inputIds, so #505's unread-input timer does not apply, and
-     *  resumeParkedRun / clearIdleTimer drop the user-wait idle bound. Do not re-arm idle until
-     *  content arrives — some harnesses omit `turn.started` and still run (N8); idle would then
-     *  kill a live turn. OpenCode heartbeats re-arm the managed-session no-progress guard without
-     *  opening a turn, so an ACK that stays silent is bounded by FINAL_MESSAGE_NUDGE_REPLY_MS:
-     *  parent-level v1 content (text, tool-call, tool-result) and UiEvent items count at any time,
-     *  including before the timer is armed; `turn.started` counts after arm or while
-     *  `finalMessageNudgeParked` matches the session (OpenCode/Cursor emit a synthetic one inside
-     *  sendAgentMessage). Nested `item.*` with `parentItemId` is ignored.
-     *  Expiry parks `waiting` and latches `finalMessageNudgeParked`; a late reply from that session
-     *  resumes. User-authored delivery resets the one-shot latch; expiry does not. */
-    private tryFinalMessageNudge;
-    /** Heartbeats and nested subagent items are not a reply. OpenCode/Cursor synthetic `turn.started` inside `sendAgentMessage` cannot false-resume after expiry because a later send goes through `submitAgentInput` → `resumeParkedRun`. */
-    private isFinalMessageNudgeReply;
-    private noteFinalMessageNudgeContent;
-    private armFinalMessageNudgeReplyTimer;
-    private clearFinalMessageNudgeReplyTimer;
+    /**
+     * A turn end on the runner's own signal, shared by the fresh step's and the Continue's turn-end
+     * handlers (hearsay-tools/cezarion#1525): read what the turn said, keep it for an acknowledgement
+     * that lands after the turn end (`parkAfterAck`), then settle it (`settleTurn`). Nothing reads the
+     * turn's prose beyond its markers.
+     */
+    private endTurn;
+    /** Prepare the turn's ask before the turn end settles (`endTurn`): its notes, the `invalidAsk`
+     *  flag, and the ask or human gate the run parks on. True when the autonomous nudge went instead
+     *  of the ask line. */
+    private prepareTurnAsk;
+    /** The turn end an entry settles after it (`settleIdleBoundary`, `handleAgentInputReady`), and
+     *  the completion gate's live refusal: what `parkAfterAck` kept of it. */
+    private boundaryTurn;
+    /**
+     * Settle a turn end (hearsay-tools/cezarion#1525). Every entry goes through it: the turn end
+     * itself (`turn-end`, a fresh step or a Continue), an acknowledgement that lands after it
+     * (`ack`), input readiness for a refused autonomous nudge (`ready`), and the completion gate's
+     * refusal of a live session's done outside a turn end (`gate`). It takes a done to the completion
+     * gate, gathers the facts, lets the pure rule (`decideTurnEnd`) decide and carries out the
+     * decision. False when nothing was settled: the done closed the session, or the input checkpoint
+     * failed.
+     */
+    private settleTurn;
+    /** The completion gate held the done (`settleTurn`). A stopped root, or a question that parked
+     *  for the user: the done stays at the boundary. False when the input checkpoint failed. */
+    private settleHeldTurn;
+    /** The ask line's autonomous nudge went instead of the question (`settleTurn`): its turn is the
+     *  next one. False when the input checkpoint failed. */
+    private settleAskNudgedTurn;
+    /** What the turn-end rule decides for a settled turn (`settleTurn`): the timer alias the rule
+     *  reads, the first decision and the done it keeps, then the owed input a `take-input` decision
+     *  tries and the decision after it. `tried` is true when that input was tried. */
+    private decideSettledTurn;
+    /** The facts the turn-end rule reads for a settled turn (`decideSettledTurn`). `session` is the
+     *  session `settleTurn` found. */
+    private turnEndFacts;
+    /** The monitoring line and `ScheduleWakeup` open their timer before the rule reads the waits, as
+     *  the `cezar_wait` timer they alias. An autonomous nudge waiting for readiness keeps precedence. */
+    private openTurnTimerAlias;
+    /** The done the first decision keeps at the boundary (`decideSettledTurn`): a turn end records
+     *  it, and an acknowledgement drops a refused done the rule does not keep. */
+    private keepSettledDone;
+    /** The owed input a `take-input` decision tries (`decideSettledTurn`). True when input was taken.
+     *  #505: input the harness accepted but has not read yet runs as its next turn. An in-flight
+     *  submission is settled by its acknowledgement (parkAfterAck), not here. */
+    private takeOwedInput;
+    /** A turn end's own steps after the rule decided (`settleTurn`): the unread and held input timers,
+     *  then the `CEZ:ASK` card. False when the input checkpoint failed. */
+    private settleTurnEndInput;
+    /** Carry out what the turn-end rule decided, and report how it left the run. A refusal the
+     *  decision follows is noted first; then the decision kind's own method runs (`turnEndCarriers`). */
+    private carryOutTurnEnd;
+    /** The method for each decision kind (`carryOutTurnEnd`). A closed session settles elsewhere, and
+     *  owed input runs as the session's next turn: the run keeps running. */
+    private readonly turnEndCarriers;
+    /** Every park returns this once it is carried out, so a worker's park notice goes here whichever
+     *  decision parked it (hearsay-tools/cezarion#1327). */
+    private parkedOutcome;
+    /** A refused autonomous nudge waits for readiness at this boundary, bounded by the idle timer. */
+    private carryOutDefer;
+    private carryOutDone;
+    /** A human wait is shown and parks for the user; CI and timer waits keep their slot. A question
+     *  with no wait parks for the user, and the freed slot can start a queued run. */
+    private carryOutPark;
+    /** One nudge per cycle: Cezar waits on the live workers for the agent, then parks as `park` does. */
+    private carryOutCompletionWait;
+    /** The completion cause's human wait: the refusal is its note, and Cezar's own wait shows it. */
+    private carryOutCompletionHumanWait;
+    /** The no-wait and budget human waits. A refusal that settles the turn end opens the budget wait. */
+    private carryOutHumanWait;
+    /** The completion cause's nudge: the refusal message, which names the worker wait when live
+     *  workers block the done. A nudge that cannot go parks for the user. */
+    private carryOutCompletionNudge;
+    /** The no-wait cause's nudge. One the wire refuses waits for input readiness when it is
+     *  autonomous, else opens Cezar's no-wait human wait. */
+    private carryOutNoWaitNudge;
+    /** The outcome a settled turn reached, for the parity cells that prove which path ran
+     *  (hearsay-tools/cezarion#1809, which removed the handoff heartbeat line that recorded it). No
+     *  outcome for the completion gate's refusal outside a turn end, nor while input readiness waits. */
+    private settledTurnOutcome;
+    /** The nudge a turn end with no wait or done gets: one automatic turn, charged to the
+     *  automatic-wake budget. The autonomous wording repeats; the no-wait one is sent once and is
+     *  bounded by its reply timer (#544's liveness). */
+    private sendTurnEndNudge;
+    /** Cezar's own human wait at a turn end (hearsay-tools/cezarion#1234): the cause as a note, the
+     *  wait shown as Needs you, and the run parked for the user. A worker's `no-wait` fallback at its
+     *  turn end (`turnEnd`) asks its parent instead (`askParentForWorker`, hearsay-tools/cezarion#1301);
+     *  any other worker fallback stays a plain park. */
+    private openTurnEndHumanWait;
+    /**
+     * A worker that ended a second turn with no wait or done after its no-wait nudge
+     * (hearsay-tools/cezarion#1301): Cezar's `no-wait` human wait carries one open question, raised
+     * as `ask.requested` so `routeWorkerQuestion` takes it to the parent as a request. The parent's
+     * reply resumes the worker through the answer seam, charged to the worker's budget; a parent that
+     * cannot receive leaves it with the human (`worker-question-fallback`). A full wait list opens
+     * none and the worker parks as before.
+     */
+    private askParentForWorker;
+    /** The worker's pending question is the one `askParentForWorker` raised. */
+    private isWorkerFallbackAsk;
+    /** The worker's pending question is Cezar's fallback question. */
+    private pendingWorkerFallback;
+    /** The parent's reply to a worker's fallback question resumed it: one automatic wake, so a
+     *  parent and worker cannot go back and forth past the budget (hearsay-tools/cezarion#1301). */
+    private chargeWorkerFallbackReply;
+    /**
+     * Cezar's fallback question is Cezar's, not the worker's (hearsay-tools/cezarion#1301): what the
+     * plain park it replaced let through still goes through. A parent's input, a Continue or a closed
+     * session supersedes it: its routed request gets an outcome, so it no longer holds the parent's
+     * done, the parent's unread copy is retired, and only then does the question close unanswered
+     * (`human-ask-closed`, `superseded`) and Cezar's wait go. Each step is idempotent and the close
+     * comes last, so a failed write leaves the question pending and the next supersession, or
+     * recovery, finishes it. A question the worker asked itself is never superseded. True when it
+     * closed.
+     */
+    private supersedeWorkerFallback;
+    /** The parent no longer owes an answer to a superseded fallback question: one it has not read is
+     *  retired, so neither a wake nor a restart's replay of unread input delivers it. One a provider
+     *  or an inbox read already holds is left to them. */
+    private retireUnreadParentQuestion;
+    /** Heartbeats and nested subagent items are not a reply. A `turn.started` counts only while the
+     *  reply timer runs or after it expired on this session: OpenCode and Cursor emit a synthetic one
+     *  inside `sendAgentMessage`, and a later send goes through `submitAgentInput`, which resumes. */
+    private isNoWaitNudgeReply;
+    /** A reply to the nudge clears its bound. One that arrives after the bound parked the run resumes
+     *  it, as the final-message nudge's did (#544); its turn end then decides, and a run still on
+     *  Cezar's no-wait wait parks on it again. */
+    private noteNoWaitNudgeContent;
+    /** A no-wait nudge the harness acknowledged but never answered (an OpenCode heartbeat keeps the
+     *  session alive without a turn): at the bound Cezar opens the no-wait human wait and the run
+     *  waits for the user. A reply that arrives after it runs, and the run stays on that question. */
+    private armNoWaitNudgeReplyTimer;
+    private clearNoWaitNudgeReplyTimer;
+    /** Every run status `run.ts` writes comes from the run state table (hearsay-tools/cezarion#1804). */
+    private move;
     private armIdleTimer;
     private clearIdleTimer;
-    private reconcileMonitoringWakeTimers;
-    private armMonitoringWakeTimer;
-    private clearMonitoringWakeTimer;
-    /** Keep the active/execution guard until autosave proves its processes exited. */
+    /** The turn-end tail's park for the user: `waiting` with the idle timer, no slot. A result
+     *  already in (a pending question beside a resolved wait) still queues its wake. */
+    private parkForUser;
+    /**
+     * The monitoring line and Claude's `ScheduleWakeup` open a timer in the wait list
+     * (hearsay-tools/cezarion#1233): the line for the configured interval, `ScheduleWakeup` for its
+     * `delaySeconds` clamped to 60–3,600 (the interval without one). Idempotent per `via`: while one
+     * is open the alias registers nothing and the timer keeps its deadline. The line is only a
+     * fallback: any open non-human wait suppresses its registration (hearsay-tools/cezarion#1268),
+     * including the off/budget human fallback. With timers off and no such wait it opens
+     * a `monitoring-line` human wait instead, and with the automatic-wake budget spent a `budget` one
+     * (hearsay-tools/cezarion#1234); the park shows it. An autonomous run's nudge keeps precedence
+     * over the line.
+     */
+    private openTimerAlias;
+    /** The save may finish execution while its strict writer proof remains pending. */
+    private readonly autosaveTasks;
+    /** Cleanup evidence survives manager disposal and store close/reopen. */
+    autosaveCleanupBlocker(runId: string): string | undefined;
+    /** Keep a separate maintenance hold until autosave proves all its processes exited.
+     *  Commits only while HEAD is the run's recorded branch (hearsay-tools/cezarion#1004), and
+     *  records a commit or a skip in the run store, shown in the handoff's records block, and as a
+     *  note; a periodic save records only a commit, with no note, merged with the
+     *  periodic commits right before it. A run with no recorded branch keeps committing on
+     *  whatever HEAD is. */
     private saveWorktree;
     /** Autosave-commit the worktree every 90 s while the run lives (spec 006).
      *  Opt-in via CEZ_AUTOSAVE=1 (#471) — see periodicAutosaveEnabled. */
@@ -1344,6 +2351,9 @@ export declare class RunManager {
     private runCheckStep;
     private finishStep;
 }
+/** How `cezar_done` names the step its done starts: the rail's name, else the id. A workflow file
+ *  may give a step an empty name, and the done answer's `next_step` must not be empty. */
+export declare function stepLabel(step: WorkflowStepDef): string;
 /**
  * Immediate title shown while a run is queued. The namer's `titleSummary`
  * replaces it once the model answers; this is the honest, permanent fallback
@@ -1361,10 +2371,14 @@ export declare function makeRunTitle(task: string, workflow: WorkflowDef): strin
  * worse, reads a stale copy materialized from the team-repo cache. The path
  * resolves against the MAIN project root (`discoverSkills(repoRoot)`), i.e. the
  * current `npx skills`-installed copy, so a worktree agent and the main
- * checkout read the exact same, up-to-date files. Team skills are omitted here:
- * they are materialized into the worktree separately (see the call site).
+ * checkout read the exact same, up-to-date files. A team skill's `path` is not
+ * on disk: its files are materialized per run (`RunManager.provisionRunSkills`).
+ * Inside the run's task worktree they need no pointer; a run without one, or
+ * whose worktree took no copy, gets a per-commit cache copy, passed here as
+ * `teamFilesDir` (#1024). A worktree that took only some of its copies passes
+ * the first one it did take.
  */
-export declare function skillSystemPrompt(skill: Pick<Skill, 'name' | 'description' | 'body'> & Partial<Pick<Skill, 'path' | 'source'>>): string;
+export declare function skillSystemPrompt(skill: Pick<Skill, 'name' | 'description' | 'body'> & Partial<Pick<Skill, 'path' | 'source'>>, teamFilesDir?: string): string;
 /**
  * Expand a registry-backed slash skill in one prompt string before it reaches a
  * backend. Claude otherwise intercepts an unknown leading slash command, and
@@ -1378,7 +2392,11 @@ export declare function skillSystemPrompt(skill: Pick<Skill, 'name' | 'descripti
  * `expandRegistrySlashSkill`, and fresh or continuation opening prompts, which
  * become the session's `userPrompt` without passing through `deliverMessage`.
  */
-export declare function expandRegistrySlashSkillText(text: string, skills: readonly Skill[]): string;
+export declare function expandRegistrySlashSkillText(text: string, skills: readonly Skill[], 
+/** Per team skill, the cache or partial copy its prompt names (#1118). */
+teamFilesDir?: ReadonlyMap<string, string>): string;
+/** The `name` of a prompt's leading `/name` slash command, else undefined. */
+export declare function leadingSlashSkillName(text: string): string | undefined;
 /**
  * `expandRegistrySlashSkillText` over a live chat message: only the first text
  * block is eligible, and an unchanged block returns the caller's array