@wjarka/cezarion 0.16.0 → 0.17.0

package/dist/runs/store.js

@@ -1,35 +1,45 @@
+import { defined } from '../core/defined.js';
+import { autosaveCleanupBlocker, clearAutosaveCleanup } from '../autosave-cleanup.js';
 import { EventEmitter } from 'node:events';
 import { workerEvidenceRunIds, workerExecutionSchema } from './worker-execution.js';
 import { agentTmpDirLocations, agentTmpDirMayExist, agentTmpDirOwnershipProven, removeAgentTmpDir } from './agent-tmpdir.js';
 import { removeArtifacts } from '../artifacts/lifecycle.js';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, createHash } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { appendFileSync, closeSync, constants, fstatSync, fsyncSync, lstatSync, openSync, readSync, realpathSync, readdirSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { z } from 'zod';
-import { ciWaitSchema, agentInputSchema, inboxClaimSchema, delegationStateSchema, workerCreationReceiptSchema, workerCollectedResultSchema, workerResultFileSchema, continuationMessageSchema, previewServerSchema, toRunSummary, workerDestroyRetrySchema, runRecordSchema as contractRunRecordSchema, } from '../contract/index.js';
-import { matchesRunQuery, sqlPrefilterTokens } from './run-search.js';
+import { ciWaitSchema } from '../contract/index.js';
+import { workerWaitSchema } from '../contract/index.js';
+import { agentInputSchema, inboxClaimSchema, delegationStateSchema, workerCreationReceiptSchema, workerCollectedResultSchema, workerResultFileSchema, workerDestroyRetrySchema, } from '../contract/index.js';
+import { automationIdOf, stepStateSchema as contractStepStateSchema, queuedMessageSchema, toRunSummary, runRecordSchema as contractRunRecordSchema, runPullRequestSchema, mergedPullRequestSchema, } from '../contract/index.js';
+import { previewServerSchema } from '../contract/index.js';
+import { isUsageLimitHold, waitSchema, LAST_WAITS_LIMIT, TIMER_MAX_SECONDS, TIMER_MIN_SECONDS, WAIT_LIMIT, } from '../contract/index.js';
+import { engineOwnsRun, isSweepable } from '../contract/index.js';
+import { matchesRunSearch, sqlPrefilterTokens } from '../contract/index.js';
 import { storedDelegationStateSchema } from './delegation-state.js';
 import { HistoryCompressor } from './history-compressor.js';
+import { LiveItemSnapshots } from './live-item-snapshots.js';
 import { emptyFacts, stampOf, TranscriptFactsIndex } from './transcript-facts.js';
 import { hasPlainHistory, historyPaths, readHistoryText, readHistoryTextAsync, removeHistory, restoreHistory } from './history-file.js';
 import { workerExecutionIdentitySchema } from '../delegation/execution-identity.js';
-import { reconcileWorkerWait } from '../delegation/wait.js';
 import { capacityError, workerCapacity } from '../delegation/capacity.js';
 import { inspectGeneration, isCurrentProcess, recordedProcessLive, processStartToken } from '../delegation/process-liveness.js';
 import { collectSecretValues, redactDeep, redactSecrets } from '../core/secret-redaction.js';
 // Pure, dependency-free reference helpers — the same sanity bound the marker parser applies.
-import { MAX_REF } from './task-refs.js';
+import { archivePullRequests, pullRequestKey, mergePullRequests } from './pull-requests.js';
+import { extractTaskRefs, MAX_REF } from './task-refs.js';
 // Type-only module (zod + nothing else), so this cannot cycle back into the store.
 import { workflowDefSchema } from '../workflows/types.js';
+import { applyOutcomes } from './outcome-commit.js';
 import { RUNNER_IDS } from '../core/agent-runner.js';
 import { ARCHIVED_ROOT, RUNS_DB_FILE, RUNS_IMPORT_COMPLETE_KEY, RunConflictError, RunDatabase, RunDatabaseBusyError, } from './run-database.js';
+import { restoreLostReferencedPullRequest } from './loaded-run-healing.js';
 import { encodeRunRow, isLiveRecord, isLiveStatus } from './run-row.js';
 import { collectRawExtras, encodeRawRecord } from './raw-record.js';
 import { assertNoLegacyCockpit, assertNoLegacyWriter, backUpLegacyIndex, LEGACY_INDEX_FILE, LegacyWriterError, readLegacyIndex } from './legacy-index.js';
 import { toRunStoreOpenError } from './store-open-error.js';
 import { claimOwnerLive, closeClaimSession, openClaimSession } from './run-claims.js';
-const usageCounterSchema = z.number().finite().nonnegative();
 /**
  * A runner id as it may appear in a PERSISTED record, normalized to the three
  * ids the rest of cezar speaks (#547).
@@ -53,317 +63,346 @@ const usageCounterSchema = z.number().finite().nonnegative();
 const storedRunnerSchema = z
     .enum([...RUNNER_IDS, 'claude-cli'])
     .transform((id) => (id === 'claude-cli' ? 'claude' : id));
-const stepStateSchema = z.object({
-    id: z.string(),
-    name: z.string(),
-    kind: z.enum(['agent', 'check']),
-    status: z.enum(['pending', 'running', 'waiting', 'review', 'done', 'failed', 'cancelled', 'skipped']),
-    iterations: z.number(),
-    /** Durable count of onFail retry loops consumed by this check. */
-    retriesUsed: z.number().int().nonnegative().optional(),
-    tokensUsed: z.number(),
-    inputTokens: usageCounterSchema.optional(),
-    outputTokens: usageCounterSchema.optional(),
-    usageInvocationsStarted: usageCounterSchema.optional(),
-    usageInvocationsObserved: usageCounterSchema.optional(),
-    usageTurnsStarted: usageCounterSchema.optional(),
-    usageTurnsRecorded: usageCounterSchema.optional(),
-    usageInvocationEpoch: usageCounterSchema.optional(),
-    startedAt: z.string().optional(),
-    finishedAt: z.string().optional(),
-    error: z.string().optional(),
-    /** Latest backend-owned session id, used for same-backend Continue. */
-    sessionId: z.string().optional(),
-    /** Backend that owns `sessionId`. Optional so pre-affinity runs.json files still parse;
-     *  `storedRunnerSchema` so a legacy `claude-cli` folds to `claude` instead of failing (#547). */
-    backend: storedRunnerSchema.optional(),
-    /** Agent profile (account) this step actually spawned under — `default`, or a stored profile
-     *  id (spec 2026-07-29-agent-profiles). Recorded rather than re-derived because a session id
-     *  only means something inside the config dir that created it: `sessionId` and `profileId` are
-     *  a PAIR. Without it, changing the project's account would silently make Continue resume
-     *  against the wrong account's session store. Absent = the discovered default. */
-    profileId: z.string().optional(),
-    /** Dollar cost reported by the claude CLI for this step's turns. */
-    costUsd: z.number().optional(),
-    /** Explicit provenance for engine-generated continuation steps. */
-    synthetic: z.literal('continuation').optional(),
-});
-/** One prompt message stacked onto a run while it waits for a free agent slot
- *  (#472). Folded into `{{task}}` at dequeue by `hydrateQueuedInput`; never
- *  delivered as its own turn — a follow-up turn would reach only the first step
- *  of a chain and would race the opening turn. */
-const queuedMessageSchema = z.object({
-    id: z.string(),
-    text: z.string(),
-    /** `/api/v1/runs/:id/images/…` URLs — the base64 never enters `runs.json`. */
-    images: z.array(z.string()).optional(),
-    createdAt: z.string(),
-});
+const stepStateSchema = contractStepStateSchema.extend({ backend: storedRunnerSchema.optional() });
 /** Exported for `./run-index.ts`, the read-only reader of the same records. Nothing else should
  *  parse a stored run — see `reconcileLoadedRun` for why a second parser is a correctness risk. */
-export const runRecordSchema = z.object({
-    id: z.string(),
-    title: z.string(),
-    /** Display title (#389): the auto-derived summary of the first agent turn,
-     *  or the user's inline edit (`PATCH /api/runs/:id` sets it together with
-     *  `title` so edits always win). The UI shows `titleSummary ?? title`. */
-    titleSummary: z.string().optional(),
-    /** `git diff --shortstat` of the worktree vs its base, refreshed on every
-     *  turn-end (#389) — what the quick list / table shows without a git call.
-     *  `repointed` (#751) is optional and only ever written as `true`: it marks the
-     *  runs whose numbers were narrowed to uncommitted work because the agent had
-     *  checked another branch out into the worktree. Optional is load-bearing here —
-     *  `runs.json` is `safeParse`d as one array, so a required addition would
-     *  silently drop every pre-existing run. */
-    diffStat: z
-        .object({
-        adds: z.number(),
-        dels: z.number(),
-        files: z.number(),
-        repointed: z.boolean().optional(),
-    })
-        .optional(),
-    workflow: z.string(),
-    task: z.string(),
-    /** Prompt messages stacked onto this run while it was queued (#472). Optional:
-     *  `undefined` on every pre-#472 record reads as an empty stack. Like `task`,
-     *  `text` is the user's own prompt and is replayed into `{{task}}`, so it is
-     *  deliberately NOT in `redactPatch`'s field list — scrubbing it would corrupt
-     *  the run the same way scrubbing `task` would. */
-    queuedMessages: z.array(queuedMessageSchema).optional(),
-    /** Durable Continue opening message; id is its synthetic step id. No base64 in the index. */
-    continuationMessage: continuationMessageSchema.optional(),
-    /** A malformed explicit ASK must never be collected as worker success. */
-    invalidAsk: z.boolean().optional(),
+export const runRecordSchema = contractRunRecordSchema.extend({
     delegation: storedDelegationStateSchema,
-    /** Non-human input must retain attribution through restart, separately from human answers. */
-    agentInputs: z.array(agentInputSchema).optional(),
-    ciWait: ciWaitSchema.optional(),
-    lastCiWait: ciWaitSchema.optional(),
-    /** Retained recovery observation when previous CI metadata cannot be trusted. */
-    lastCiWaitError: z.string().max(256).optional(),
-    /** Dev servers the agent registered with `cezar_preview_serve` (#781). Optional so old files parse. */
-    previewServers: z.array(previewServerSchema).optional(),
-    /** URLs of images attached to the initial task prompt, for the thread's first bubble
-     *  (#image-display) — persisted like agent screenshots, served from `/images/`. */
-    taskImages: z.array(z.string()).optional(),
-    model: z.string().optional(),
-    /** Reasoning-effort pin (#45). Canonical `low`/`medium`/`high`/`xhigh`/`max`.
-     *  Absent = harness default. Additive: pre-#45 records omit it and still parse. */
-    effort: z.string().max(32).optional(),
-    /** Canonical provider/model identity (#405) — the normalised `provider/model`
-     *  (e.g. `anthropic/claude-opus-4-8`) the run actually used, resolved from the
-     *  free-text `model` against the chosen runner. Additive and optional: pre-#405
-     *  records carry only `model`, and it stays the human/hand-edit surface; this
-     *  is the parseable identity cost attribution and reproducible replay key off.
-     *
-     *  Read in production by the session header's agent badge (#546), which shows it
-     *  whenever it says something `model` does not — so this is no longer a
-     *  write-only field whose next reader has to guess whether it is load-bearing. */
-    modelIdentity: z.string().optional(),
-    /** Agent backend this run used — drives "open in CLI" resume command. `storedRunnerSchema`
-     *  so a legacy `claude-cli` record folds to `claude` instead of failing the whole index (#547). */
+    lastWaitsError: contractRunRecordSchema.shape.lastWaitsError.catch(undefined),
+    automaticWakes: contractRunRecordSchema.shape.automaticWakes.catch(undefined),
+    waitDeliveryFailures: contractRunRecordSchema.shape.waitDeliveryFailures.catch(undefined),
     runner: storedRunnerSchema.optional(),
-    /** Per-task agent-account override from the composer (spec 2026-07-29-agent-profiles), applying
-     *  to steps that run on `runner`. Steps on a DIFFERENT backend still resolve from the project's
-     *  own selection — an override for Claude says nothing about which Codex account a mixed
-     *  workflow's codex step should use. Absent = follow the project. */
-    agentProfile: z.string().optional(),
-    /** Echo of the extra system prompt this run actually used (R2): the
-     *  `POST /api/runs` override, or the `config.json` default it fell back to.
-     *  Deliberately NOT the full composed prompt — skill bodies and the handoff
-     *  contract are derivable from the persisted workflow and would bloat the
-     *  index. Resolved at execute time (a queued run picks up config edits). */
-    systemPrompt: z.string().optional(),
-    /** Per-task follow-up inbox contract (spec 007, #444). Missing on old runs
-     *  means enabled — the historical behavior. */
-    generateFollowups: z.boolean().optional(),
-    /** Effective autonomous mode (#489), set at creation from StartRunInput.autonomous.
-     *  This records the resolved launch mode, not whether a user clicked a checkbox:
-     *  the composer may select it through a skill or workspace default (#458).
-     *  Used by the autonomous nudge and terminal review policy. Continue/recovery
-     *  preserve it; absent on legacy records means non-autonomous. */
-    autonomous: z.boolean().optional(),
-    /** Task webhook opt-in (#589). Absent = off; `POST /runs/:id/notify` flips it at any time. */
     notify: z.boolean().optional().catch(undefined),
-    /** The last task-webhook delivery's outcome (#589), written by `runs/webhook.ts`. */
     webhook: contractRunRecordSchema.shape.webhook.catch(undefined),
-    /** Optional provenance for tasks launched by a project GitHub automation. */
-    automation: z
-        .object({
-        automationId: z.string(),
-        automationRevision: z.number().int().positive(),
-        receiptId: z.string(),
-        event: z.string(),
-        githubUrl: z.string().url(),
-    })
-        .optional(),
-    /** Provenance for a task a scheduled automation launched. Its own key so a pre-schedule cezar
-     *  strips it instead of failing the whole index on a missing `githubUrl`. */
-    automationTrigger: z
-        .object({
-        automationId: z.string(),
-        automationRevision: z.number().int().positive(),
-        receiptId: z.string(),
-        trigger: z.enum(['schedule', 'catch-up', 'manual']),
-        occurrenceAt: z.string(),
-    })
-        .optional(),
-    /** A pending worker destroy's automatic retry state (hearsay-tools/cezarion#879); a malformed one is dropped, never the run. */
     destroyRetry: contractRunRecordSchema.shape.destroyRetry.catch(undefined),
-    status: z.enum(['queued', 'running', 'waiting', 'review', 'done', 'failed', 'cancelled']),
     stopping: contractRunRecordSchema.shape.stopping.catch(undefined),
-    /** Sub-state of `running` (spec 2026-07-18-subagent-monitoring-status, #490):
-     *  `monitoring` while the agent is still working on its own downstream work.
-     *  Optional/absent on old runs; cleared when the run resumes or ends. */
-    activity: z.enum(['monitoring']).optional(),
-    hasPendingHumanAsk: contractRunRecordSchema.shape.hasPendingHumanAsk.catch(undefined),
-    /** Exact server-computed deadline for the next automatic monitoring check. */
-    monitoringWakeAt: z.string().datetime().optional().catch(undefined),
-    /** True only for the live epoch that exhausted all automatic monitoring checks. */
-    monitoringWakeCapReached: z.boolean().optional(),
-    /**
-     * Exact deadline at which a run stopped by a provider USAGE LIMIT resumes itself
-     * (spec 2026-08-03-auto-resume-after-usage-limit) — the reset instant the provider named plus a
-     * short grace. Present only while such a resume is pending: the run is `failed`, the timer is
-     * armed, and the cockpit says so. Deliberately survives a restart (`RunStore.open` keeps it) —
-     * it is what lets `recover()` re-arm a wait that may be hours long.
-     */
+    hasPendingPermission: contractRunRecordSchema.shape.hasPendingPermission.catch(undefined),
     autoResumeAt: z.string().datetime().optional().catch(undefined),
-    /** Consecutive automatic resumes since the last human turn — the safety cap's counter.
-     *  Persisted so a restart cannot reset a loop back to zero. */
     autoResumeAttempts: z.number().int().min(0).optional().catch(undefined),
-    createdAt: z.string(),
-    startedAt: z.string().optional(),
-    finishedAt: z.string().optional(),
-    tokensUsed: z.number(),
-    inputTokens: usageCounterSchema.optional(),
-    outputTokens: usageCounterSchema.optional(),
-    costUsd: z.number().optional(),
-    /** First GitHub PR URL spotted in the transcript (the janitor trick). */
-    pullRequestUrl: z.string().optional(),
-    /** The PR this task is ABOUT (#407, spec 2026-07-16-pr-autodiscovery):
-     *  auto-discovered from conversation references for tasks that work on an
-     *  existing PR (review/continue/merge). Display-only tier — `pullRequestUrl`
-     *  (the PR this task CREATED) always wins, and action gates ignore this. */
-    referencedPullRequestUrl: z.string().optional(),
-    /** The PR/issue number this task is ABOUT (spec 2026-07-17-task-auto-naming):
-     *  regex-extracted from the task prompt, upgradable by the namer's
-     *  cross-checked output. Display tier — never gates actions. */
-    prNumber: z.number().optional(),
-    issueNumber: z.number().optional(),
-    /** Provenance for an `issueNumber` seeded by referenced-issue discovery.
-     *  Persisted so ambiguity can revoke only the janitor's own value, including
-     *  after a restart. Any prompt, namer, or marker write clears this flag. */
-    referencedIssueNumberSeeded: z.boolean().optional(),
-    /** Who owns the display title: `user` (PATCH rename — never auto-overwritten),
-     *  `marker` (agent-declared via `CEZ:TITLE`, spec 2026-07-18-task-ref-markers —
-     *  beats the namer, silences live refresh) or `auto` (namer-owned — a later
-     *  namer result may replace it). Missing on old runs = legacy behavior (auto
-     *  fills only an unset titleSummary). Precedence: user > marker > auto. */
-    titleOrigin: z.enum(['user', 'auto', 'marker']).optional(),
-    /** References the agent itself declared via `CEZ:PR=` / `CEZ:ISSUE=` markers
-     *  (spec 2026-07-18-task-ref-markers). Presence of a kind makes it
-     *  authoritative: the namer may no longer write that kind, and a declared PR
-     *  owns the referenced tier's resolution. */
-    markerRefs: z.object({ pr: z.number().optional(), issue: z.number().optional() }).optional(),
-    /** Distinct PR URLs spotted so far — the referenced tier's working set,
-     *  persisted so a resumed run keeps disambiguating against the full history
-     *  instead of re-adopting the next URL as "the only one". Capped. */
-    referencedPrCandidates: z.array(z.string()).optional(),
-    /** The issue this task is ABOUT (spec 2026-07-21-report-ref-discovery):
-     *  auto-discovered from `github.com/…/issues/N` links in the conversation,
-     *  mirroring the referenced-PR tier. Display-only; never gates actions. */
-    referencedIssueUrl: z.string().optional(),
-    /** Distinct issue URLs spotted so far — the referenced-issue working set,
-     *  persisted like `referencedPrCandidates`. Capped. */
-    referencedIssueCandidates: z.array(z.string()).optional(),
-    /** Explicit execution policy. `false` means the run intentionally uses the repo root;
-     *  absent on older runs and for the default isolated-worktree mode. */
-    worktree: z.literal(false).optional(),
-    /** Task worktree (spec 006) — absent for in-place runs and after explicit cleanup. */
-    worktreePath: z.string().optional(),
-    /** The task's own branch (`cez/<id8>`), created off `baseBranch`. */
-    branch: z.string().optional(),
-    /** Stable baseline for session git views: a worktree's fork ref, or an in-place run's starting commit. */
-    baseBranch: z.string().optional(),
-    /** Set when count-based retention (#483) reclaimed this run's worktree
-     *  *directory* (the `cez/<id8>` branch is kept). Presence means "materialized
-     *  dir gone, recoverable via `git worktree add`"; it excludes the run from the
-     *  retention budget until the dir is re-materialized (resume clears it). */
-    worktreeReclaimedAt: z.string().optional(),
-    /** Worktree setup (#917). An unreadable value drops the field, never the run. */
+    pullRequests: z.preprocess((value) => Array.isArray(value)
+        ? value.flatMap((entry) => {
+            const parsed = runPullRequestSchema.safeParse(entry);
+            return parsed.success ? [parsed.data] : [];
+        })
+        : undefined, z.array(runPullRequestSchema).optional()),
     worktreeSetup: contractRunRecordSchema.shape.worktreeSetup.catch(undefined),
-    /** Parallel variants (spec 010): tasks sharing a groupId are one group. */
-    groupId: z.string().optional(),
-    /** Variant letter within the group — 'A' | 'B' | 'C' (kept as a string). */
-    variant: z.string().optional(),
-    /** Idempotent start (#504): the caller's request id and the hash of the start payload it
-     *  named (`src/runs/client-request.ts`). Absent on every run started without one. */
-    clientRequestId: z.string().optional(),
-    clientRequestHash: z.string().optional(),
-    /** Peak resident memory (bytes) / process count observed across the run's
-     *  agent process trees (#348) — written when a session's telemetry ends.
-     *  Optional: old runs.json files and `ps`-less platforms have neither. */
-    peakRssBytes: z.number().optional(),
-    peakProcCount: z.number().optional(),
     archived: z.boolean().default(false),
-    archivedAt: z.string().optional(),
-    /** Pinned to the top of this project's task list (#935): plain per-task state, the
-     *  same class as `archived` and `seenAt`. Optional with NO default, unlike `archived`:
-     *  absent is what every runs.json written before this carries and it already means
-     *  "not pinned", so nothing needs filling in on parse and an unpin can simply delete
-     *  the key rather than persist a `false` older cezars never wrote. */
-    pinned: z.boolean().optional(),
-    pinnedAt: z.string().optional(),
-    /** Read receipt (#unread-done-items): the ISO time the cockpit last opened this
-     *  run's thread. A finished run reads as "unread" until it has been seen since it
-     *  finished — see `isUnread()` in the cockpit's `lib/read-state.ts`. Absent on old
-     *  runs, on every run not yet opened, and on one `setUnread` put back to unread
-     *  (#775) — the unread rule treats all three alike. */
-    seenAt: z.string().optional(),
-    currentStepId: z.string().optional(),
-    error: z.string().optional(),
-    steps: z.array(stepStateSchema),
-    /** Full workflow definition, persisted so a `queued` run can be re-enqueued
-     *  after a restart (#367) — including ad-hoc "(planned)" chains that exist
-     *  nowhere else.
-     *
-     *  Typed, not `z.record(z.string(), z.unknown())`: this key goes out over the
-     *  wire on every run route, and `unknown` is wider than anything the server
-     *  can serialize — which made the route's own type (hono's `JSONValue`, whose
-     *  index signature admits `object | symbol | undefined`) impossible for the
-     *  contract to describe. `.catch(undefined)` keeps an older or hand-edited
-     *  entry from failing the whole index parse: a def that no longer fits simply
-     *  drops, and `reviveWorkflow` falls back to the catalog by name.
-     *
-     *  That drop is PERMANENT, not per-boot — the index is re-serialized from the
-     *  parsed records (`saveNow`), so the next save writes runs.json back without
-     *  it. Harmless for a catalog workflow, which re-resolves by name; fatal for
-     *  the ad-hoc "(planned)" chain this field exists to preserve, which has no
-     *  catalog entry to fall back to. Nothing written since #367 fails the schema
-     *  (`name`, `source` and `steps` have been on every persisted def), so tighten
-     *  `workflowStepSchema` only with that in mind: a narrowing here silently eats
-     *  queued runs rather than degrading them. */
     workflowDef: workflowDefSchema.optional().catch(undefined),
+    steps: z.array(stepStateSchema),
+    automation: contractRunRecordSchema.shape.automation.unwrap().extend({
+        automationRevision: z.number().int().positive(),
+        githubUrl: z.string().url(),
+    }).optional(),
+    automationTrigger: contractRunRecordSchema.shape.automationTrigger.unwrap().extend({
+        automationRevision: z.number().int().positive(),
+    }).optional(),
+    /** The handoff file's autosave records (hearsay-tools/cezarion#1809); unreadable drops the field. */
+    handoffRecords: contractRunRecordSchema.shape.handoffRecords.catch(undefined),
 });
-/** Salvage CI state identically for live stores and the read-only workspace index. */
+/** The keys an older record used for parks. Schema 4 reads the CI and monitoring ones into
+ *  `waits`; phase 4b (hearsay-tools/cezarion#1236) reads the pending-question summary into a human
+ *  wait. None is written again (spec 2026-10-17-unified-waits, § Compatibility). */
+const LEGACY_WAIT_KEYS = ['ciWait', 'lastCiWait', 'lastCiWaitError', 'monitoringWakeAt', 'monitoringWakeCapReached', 'activity', 'hasPendingHumanAsk'];
+const UNREADABLE_WAIT = 'Wait unavailable — a saved wait is unreadable; register a new wait.';
+/** A stored `waits`/`lastWaits` entry of kind `ci`, the kind `pr` replaced (hearsay-tools/cezarion#1425). */
+const isCiKindEntry = (entry) => !!entry && typeof entry === 'object' && entry.kind === 'ci';
+function hasCiKindEntries(row) {
+    return ['waits', 'lastWaits'].some((key) => Array.isArray(row[key]) && row[key].some(isCiKindEntry));
+}
+function hasLegacyWaitFields(row) {
+    return !!row && typeof row === 'object' && (LEGACY_WAIT_KEYS.some((key) => key in row) || hasCiKindEntries(row) || agentWorkerWaits(row).length > 0 || rootCompletion(row) !== undefined);
+}
+/** A root's stored `delegation.completion` (the old completion gate's marker), which schema 7 reads
+ *  into the list and drops (hearsay-tools/cezarion#1301). */
+function rootCompletion(row) {
+    const delegation = row.delegation;
+    if (!delegation || typeof delegation !== 'object' || delegation.role !== 'root')
+        return undefined;
+    const { completion } = delegation;
+    return completion && typeof completion === 'object' ? completion : undefined;
+}
+/** The worker waits a record still holds in `delegation` (store schemas 6 and 7,
+ *  hearsay-tools/cezarion#1235, #1301), in the order they settled: `lastWait`, then `wait`. The
+ *  completion gate's wait, the one `delegation.completion.waitId` names, is flagged `completion`: it
+ *  was Cezar's own, not the agent's. A value that does not parse is left where it is, for the
+ *  delegation schema to quarantine as it always has. */
+function agentWorkerWaits(row) {
+    const delegation = row.delegation;
+    if (!delegation || typeof delegation !== 'object')
+        return [];
+    const { role } = delegation;
+    if (role !== 'root' && role !== 'worker')
+        return [];
+    const waitId = rootCompletion(row)?.waitId;
+    const found = [];
+    for (const key of ['lastWait', 'wait']) {
+        const parsed = workerWaitSchema.safeParse(delegation[key]);
+        if (parsed.success)
+            found.push({ key, wait: parsed.data, completion: waitId === parsed.data.id });
+    }
+    return found;
+}
+/** A legacy `CiWait` as a wait entry. Its wake input's id was the wait's own (`wakeId`, which
+ *  `run.ts` set to the wait id), so the entry keeps that id and delivery still finds the input. */
+export function ciWaitEntry(wait) {
+    const { wakeId: _wakeId, phase, result, deliveredAt, ...identity } = wait;
+    return {
+        ...identity, kind: 'pr', source: 'agent', via: 'cezar_wait_for_ci',
+        phase: phase === 'registered' || phase === 'parked' ? 'open' : phase === 'wake-pending' ? 'resolved' : phase === 'delivered' ? 'delivered' : 'cancelled',
+        ...(result ? { result, resolvedAt: result.observedAt } : {}),
+        ...(deliveredAt ? { deliveredAt } : {}),
+    };
+}
+/**
+ * A legacy agent `delegation.wait` as a worker wait entry (store schema 6, hearsay-tools/cezarion#1235),
+ * judged from the wait alone: what became of its wake input is `upgradeLegacyWaits`' to apply.
+ * `registered`/`parked` → open; `wake-pending` → resolved with its `outcome`/`timeout` reason, or
+ * cancelled. Undefined for the `message` stand-in, which was never an agent's wait: a message no
+ * longer resolves a wait, and its input still wakes the run on its own.
+ *
+ * Deterministic, never read from the clock: a row is upgraded on every read until open rewrites
+ * it, and two reads must agree. A `WorkerWait` kept no registration time, so `timeoutSeconds` is
+ * the 600 default, `registeredAt` is 600 s before the original deadline (kept as it was), and the
+ * settled stamps come from the wait itself: `resolvedAt` is the latest observation it holds, else
+ * its deadline, and `cancelledAt` is its deadline. `now` is only the fallback for a deadline that
+ * does not read, which the wait schema never admits.
+ */
+export function workerWaitEntry(wait, now) {
+    if (wait.phase === 'wake-pending' && wait.reason === 'message')
+        return undefined;
+    const deadline = Date.parse(wait.deadline);
+    const registeredAt = Number.isFinite(deadline) ? new Date(deadline - 600_000).toISOString() : now;
+    const open = wait.phase !== 'wake-pending';
+    // A pending wait from before reasons were recorded settled on its persisted observations, as
+    // `reconcileWorkerWait` infers it: satisfied by them is an outcome, anything else its deadline.
+    const satisfied = (ids, reported) => wait.mode === 'all' ? ids.every((id) => reported.includes(id)) : reported.length > 0;
+    const inferred = wait.phase === 'wake-pending' && wait.reason === undefined
+        ? (wait.requestIds ? satisfied(wait.requestIds, (wait.requestOutcomes ?? []).map((outcome) => outcome.requestId))
+            : satisfied(wait.workerIds, (wait.outcomes ?? []).map((outcome) => outcome.workerId))) ? 'outcome' : 'timeout'
+        : undefined;
+    const reason = wait.reason === 'outcome' || wait.reason === 'timeout' ? wait.reason : inferred;
+    const observed = [...(wait.outcomes ?? []), ...(wait.requestOutcomes ?? [])].map((outcome) => outcome.observedAt).sort().at(-1);
+    const resolvedAt = reason === 'outcome' && observed ? observed : wait.deadline;
+    return {
+        id: wait.id, kind: 'worker', source: 'agent', via: 'cez-worker-wait', registeredAt, deadline: wait.deadline, timeoutSeconds: 600, turnId: 'upgraded',
+        phase: open ? 'open' : reason ? 'resolved' : 'cancelled',
+        ...(wait.mode ? { mode: wait.mode } : {}),
+        ...(wait.requestIds
+            ? { requestIds: wait.requestIds, requestOutcomes: wait.requestOutcomes ?? [] }
+            : { workerIds: wait.workerIds, revisions: wait.revisions ?? [], outcomes: wait.outcomes }),
+        ...(!open && reason ? { result: { reason }, resolvedAt } : {}),
+        ...(!open && !reason ? { cancelledAt: wait.deadline } : {}),
+    };
+}
+/** Whether a record is a root still parked on its workers: an open or resolved worker wait in the
+ *  list. Such a root has its pending human question re-read from the transcript before a manager
+ *  parks it. Every stored `delegation.wait`, the completion gate's included, is read into the list
+ *  on open (store schema 7, hearsay-tools/cezarion#1301), so the list is the only place to look. */
+export function holdsWorkerWait(run) {
+    if (run.delegation?.role !== 'root')
+        return false;
+    return !!run.waits?.some((wait) => wait.kind === 'worker' && (wait.phase === 'open' || wait.phase === 'resolved'));
+}
+/** A stable id for the timer a legacy monitoring park becomes. The row keeps its legacy JSON
+ *  until it is next written, so every read of it must name the same wait. */
+function legacyTimerId(runId, wakeAt) {
+    return legacyWaitId(`legacy-monitoring-timer:${String(runId)}:${wakeAt}`);
+}
+/** The human wait a stored pending-question summary becomes: one per run, the same on every read. */
+function legacyHumanWaitId(runId) {
+    return legacyWaitId(`legacy-pending-ask:${String(runId)}`);
+}
+/** A name-based (version 5 shaped) UUID, so a row read twice upgrades to the same entry. */
+function legacyWaitId(name) {
+    const hex = createHash('sha256').update(name).digest('hex');
+    const variant = (8 | (Number.parseInt(hex[16], 16) & 3)).toString(16);
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-5${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+/**
+ * Upgrade-on-read (store schema 4, spec 2026-10-17-unified-waits): read a schema-3 record's CI and
+ * monitoring fields into its wait list, then delete them. Mutates `row`, before validation.
+ *
+ * - `ciWait`: `registered`/`parked` → an open `pr` checks wait, `wake-pending` → resolved (resolved when
+ *   its result was observed), `delivered`/`withdrawn` → `lastWaits` as delivered/cancelled.
+ * - `lastCiWait` → `lastWaits`: `delivered` stays delivered, anything else was withdrawn intent and
+ *   reads as cancelled. `lastCiWaitError` → `lastWaitsError`.
+ * - `activity: 'monitoring'` on a live run: with `monitoringWakeAt`, an open timer due then
+ *   (`seconds` is what remains, clamped to a timer's bounds); without one, no wait. Either way a
+ *   `running` run parks as `waiting`, its running step with it, as every waiting park writes it.
+ *   On a finished run the fields are stale and only dropped.
+ * - `hasPendingHumanAsk: true` on a `waiting` run with no open human wait (phase 4b,
+ *   hearsay-tools/cezarion#1236): an open `human` wait, `ask-line`, with no `askSeq`. Recovery shows
+ *   it (`surfaceHumanWait`), which attaches it to the question still pending in the transcript
+ *   instead of raising a second card. Anywhere else the summary is dropped: the human wait it stood
+ *   beside since phase 2 already says the same.
+ *
+ * - `delegation.wait`/`lastWait` registered by the agent (store schema 6, hearsay-tools/cezarion#1235)
+ *   → `workerWaitEntry`, then settled by what became of the wake input (`wakeId`, else the wait's own
+ *   id): a wait whose input was delivered reads as delivered, a `wake-pending` one whose input is
+ *   still queued stays resolved and records it as `wakeInputId`, so it is delivered once, and a
+ *   `lastWait` that was never delivered reads as cancelled. The `message` stand-in is dropped. No
+ *   input is added or removed: a cancelled receipt's undelivered wake stays queued and is delivered
+ *   as an ordinary input. The completion gate's wait (store schema 7, hearsay-tools/cezarion#1301) becomes a
+ *   `source: 'cezar'`, `via: 'completion'` entry the same way, and `delegation.completion` is dropped. A current wait
+ *   (the stand-in included) whose wake a provider took on a `waiting` run is the old engine's crash
+ *   between the delivery checkpoint and the resume: the run reads `running`, so recovery resumes
+ *   it. A wake an inbox read acknowledged, or one beside a pending question, resumes nothing.
+ *
+ * - A `waits`/`lastWaits` entry of kind `ci` (hearsay-tools/cezarion#1425) → kind `pr` with
+ *   `until: 'checks'` and `wakeOnConflict: true`, what a `ci` wait did.
+ *
+ * An unreadable legacy CI wait gets the per-entry salvage `parseRunRecords` gives `waits`: it is
+ * dropped, `lastWaitsError` says so, and the status is left alone. A `waiting` run with no open
+ * wait reads as Needs you, which a human can resume.
+ */
+/** A live run and its live step move from `from` to `to` together, as every park and resume writes them. */
+function setLiveStatus(row, from, to) {
+    row.status = to;
+    if (Array.isArray(row.steps))
+        for (const step of row.steps) {
+            if (step && typeof step === 'object' && step.status === from)
+                step.status = to;
+        }
+}
+const resumeParked = (row) => setLiveStatus(row, 'waiting', 'running');
+export function upgradeLegacyWaits(row) {
+    if (!hasLegacyWaitFields(row))
+        return;
+    // Kind `ci` waited for checks and woke on a conflict (hearsay-tools/cezarion#1425).
+    for (const key of ['waits', 'lastWaits']) {
+        if (Array.isArray(row[key]))
+            row[key] = row[key].map((entry) => isCiKindEntry(entry)
+                ? { ...entry, kind: 'pr', until: 'checks', wakeOnConflict: true } : entry);
+    }
+    const opened = [];
+    const settled = [];
+    let unreadable = false;
+    const legacyCi = (value, previous) => {
+        if (value === undefined)
+            return;
+        const parsed = ciWaitSchema.safeParse(value);
+        if (!parsed.success) {
+            unreadable = true;
+            return;
+        }
+        const entry = ciWaitEntry(parsed.data);
+        if (previous && entry.phase !== 'delivered')
+            entry.phase = 'cancelled';
+        (entry.phase === 'open' || entry.phase === 'resolved' ? opened : settled).push(entry);
+    };
+    // The previous wait settled before the current one did, so it goes first.
+    legacyCi(row.lastCiWait, true);
+    legacyCi(row.ciWait, false);
+    const agentWaits = agentWorkerWaits(row);
+    if (agentWaits.length) {
+        // The wait's own stamps decide every time the entry carries (`workerWaitEntry`), not the clock.
+        const now = typeof row.createdAt === 'string' ? row.createdAt : new Date(0).toISOString();
+        const inputs = Array.isArray(row.agentInputs) ? row.agentInputs : [];
+        const current = agentWaits.find((found) => found.key === 'wait');
+        // The old engine retired a delivered wake into `lastWait` with the resume: a current wait whose
+        // wake a provider took on a `waiting` run is a crash between the two, and resumed. An inbox
+        // read starts no provider turn, and a pending question still holds the run, as they did then.
+        const interrupted = (key, input) => key === 'wait' && row.status === 'waiting' &&
+            typeof input?.deliveredAt === 'string' && !input.inboxClaim?.acknowledgedAt && row.hasPendingHumanAsk !== true;
+        for (const { key, wait, completion } of agentWaits) {
+            // A wait that settles has its copy in `lastWait` too: it is the same wait.
+            if (key === 'lastWait' && current?.wait.id === wait.id)
+                continue;
+            const input = inputs.find((candidate) => candidate.id === (wait.wakeId ?? wait.id));
+            const entry = workerWaitEntry(wait, now);
+            // Cezar's completion gate wait is its own: no agent registered it (hearsay-tools/cezarion#1301).
+            // It keeps the deadline it always carried, with the 600 s default registration.
+            if (entry && completion)
+                Object.assign(entry, { source: 'cezar', via: 'completion', mode: 'all' });
+            // The `message` stand-in becomes no entry, but its delivered message may be that crash too.
+            if (!entry) {
+                if (interrupted(key, input))
+                    resumeParked(row);
+                continue;
+            }
+            const deliveredAt = typeof input?.deliveredAt === 'string' ? input.deliveredAt : undefined;
+            if (entry.phase !== 'open' && deliveredAt) {
+                Object.assign(entry, { phase: 'delivered', deliveredAt });
+                if (interrupted(key, input))
+                    resumeParked(row);
+            }
+            else if (key === 'lastWait' && entry.phase !== 'cancelled')
+                Object.assign(entry, { phase: 'cancelled', cancelledAt: wait.deadline });
+            else if (entry.phase === 'resolved' && input)
+                entry.wakeInputId = input.id;
+            (entry.phase === 'open' || entry.phase === 'resolved' ? opened : settled).push(entry);
+        }
+    }
+    const live = row.status === 'running' || row.status === 'queued' || row.status === 'waiting';
+    if (row.activity === 'monitoring' && live) {
+        const wakeAt = row.monitoringWakeAt;
+        // Schema 3 read an unreadable deadline as none (`.catch(undefined)`): no wait.
+        if (typeof wakeAt === 'string' && z.iso.datetime().safeParse(wakeAt).success) {
+            const now = Date.now();
+            const seconds = Math.min(TIMER_MAX_SECONDS, Math.max(TIMER_MIN_SECONDS, Math.round((Date.parse(wakeAt) - now) / 1000)));
+            opened.push({
+                id: legacyTimerId(row.id, wakeAt), kind: 'timer', source: 'agent', via: 'monitoring-line',
+                registeredAt: new Date(now).toISOString(), deadline: wakeAt, phase: 'open', turnId: 'legacy', seconds,
+            });
+        }
+        if (row.status === 'running')
+            setLiveStatus(row, 'running', 'waiting');
+    }
+    const asksHuman = (entry) => !!entry && typeof entry === 'object' && entry.kind === 'human' && entry.phase === 'open';
+    if (row.hasPendingHumanAsk === true && row.status === 'waiting' &&
+        !(Array.isArray(row.waits) && row.waits.some(asksHuman)) && !opened.some(asksHuman)) {
+        opened.push({
+            id: legacyHumanWaitId(row.id), kind: 'human', source: 'agent', via: 'ask-line',
+            registeredAt: typeof row.createdAt === 'string' && z.iso.datetime().safeParse(row.createdAt).success ? row.createdAt : new Date(0).toISOString(),
+            phase: 'open', turnId: 'legacy',
+        });
+    }
+    if (opened.length) {
+        const current = Array.isArray(row.waits) ? row.waits : [];
+        if (row.waits !== undefined && !Array.isArray(row.waits))
+            unreadable = true;
+        row.waits = [...current, ...opened.filter((wait) => !current.some((entry) => entry?.id === wait.id))];
+    }
+    if (settled.length) {
+        const current = Array.isArray(row.lastWaits) ? row.lastWaits : [];
+        if (row.lastWaits !== undefined && !Array.isArray(row.lastWaits))
+            unreadable = true;
+        row.lastWaits = [...settled, ...current].slice(-LAST_WAITS_LIMIT);
+    }
+    if (typeof row.lastCiWaitError === 'string' && row.lastWaitsError === undefined)
+        row.lastWaitsError = row.lastCiWaitError;
+    if (unreadable)
+        row.lastWaitsError = UNREADABLE_WAIT;
+    for (const key of LEGACY_WAIT_KEYS)
+        delete row[key];
+    if (agentWaits.length || rootCompletion(row)) {
+        const delegation = { ...row.delegation };
+        for (const { key } of agentWaits)
+            delete delegation[key];
+        delete delegation.completion;
+        row.delegation = delegation;
+    }
+}
+/** Read legacy wait fields into the wait list and salvage per entry, identically for live stores
+ *  and the read-only workspace index. */
 export function parseRunRecords(raw) {
     if (Array.isArray(raw))
         for (const row of raw) {
             if (!row || typeof row !== 'object')
                 continue;
-            if (row.ciWait !== undefined && !ciWaitSchema.safeParse(row.ciWait).success) {
-                delete row.ciWait;
-                if (['running', 'queued', 'waiting'].includes(row.status)) {
-                    row.status = 'failed';
-                    delete row.activity;
-                    row.error = 'CI wait state is unreadable; continue the task to register a new wait.';
-                }
-            }
-            if (row.lastCiWait !== undefined && !ciWaitSchema.safeParse(row.lastCiWait).success) {
-                delete row.lastCiWait;
-                row.lastCiWaitError = 'CI wait unavailable — saved observation is unreadable; register a new wait.';
+            upgradeLegacyWaits(row);
+            // One unreadable wait must not evict the run, nor its readable siblings.
+            for (const key of ['waits', 'lastWaits']) {
+                if (row[key] === undefined)
+                    continue;
+                const entries = Array.isArray(row[key]) ? row[key] : [];
+                const readable = entries.filter((entry) => waitSchema.safeParse(entry).success);
+                if (!Array.isArray(row[key]) || readable.length !== entries.length)
+                    row.lastWaitsError = UNREADABLE_WAIT;
+                if (readable.length)
+                    row[key] = readable;
+                else
+                    delete row[key];
             }
             // One unreadable registration must not evict the run, nor its readable siblings (#781).
             if (row.previewServers !== undefined) {
@@ -384,11 +423,12 @@ function storedRow({ revision, seq, data, extras }) {
  *  server entry) the runtime has decided to drop, and keeps dropping on the next write, as it always
  *  has; only what the schema does not know is put back. */
 function decodeStoredRecord(raw) {
+    const upgraded = hasLegacyWaitFields(raw);
     const parsed = parseRunRecords([raw]);
     if (!parsed.success)
         return undefined;
     const run = parsed.data[0];
-    return { run, extras: collectRawExtras(raw, run) };
+    return { run, extras: collectRawExtras(raw, run), ...(upgraded ? { upgraded: true } : {}) };
 }
 /** One database row's `data` back into a record and its extras. Undefined when it does not parse:
  *  one unreadable row costs that row only. */
@@ -419,6 +459,9 @@ const OPEN_RETRY_DELAYS_MS = [50, 100, 200, 400, 800, 1600];
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+/** Runs (and conversation roots, one family query each) the open-time facts warm-up enumerates
+ *  per event-loop turn (hearsay-tools/cezarion#949), so each slice stays a few milliseconds. */
+const WARM_IDS_PER_SLICE = 100;
 const MAX_RUNS_KEPT = 300;
 /** How many archived root runs the run lists carry per project (#864): `GET /run-summaries?archived=recent`
  *  and `GET /workspace/runs-index`. Unarchived runs are never cut; older archived runs page in
@@ -442,25 +485,9 @@ function refUrlRepo(url) {
     return owner && name ? `${owner}/${name}`.toLowerCase() : undefined;
 }
 /**
- * May the referenced tier ADOPT this URL as the task's subject? (#945)
- *
- * The tier was text-scoped but never repo-scoped: `PR_URL_RE` matches any
- * `github.com/<owner>/<repo>/pull/N`, so a research task that cites one upstream PR handed the
- * resolver exactly one candidate and it became the task's identity — an `oko` task wearing
- * `supabase/cli#6056`. Nothing compared the URL's repository with the project's own.
- *
- * A foreign URL is adoptable only when the TASK PROMPT corroborates it: the prompt names that
- * `owner/repo`, which a pasted URL does inherently. That is the trust boundary this module already
- * uses elsewhere — the prompt and the agent's own turn text are trusted, scraped tool output is
- * not — and it is what keeps the legitimate cross-repo case working (#819:
- * `om-auto-fix-pr https://github.com/open-mercato/open-mercato/pull/1977` started from cezar).
- *
- * Unknown handle → today's behavior exactly (`AGENTS.md` zero config: degrade, never fail). An
- * unparseable URL is left alone for the same reason — the guard only ever removes an association
- * it can PROVE is foreign.
- *
- * Note what this does not touch: `referenced*Candidates` keep recording every URL as evidence.
- * The fix changes what is *promoted*, never what is *collected* (the #526 rule).
+ * A foreign referenced URL needs task-prompt corroboration of its repository. Unknown project
+ * handles preserve the degraded rule. This check vets the resolved winner, not the candidate
+ * list.
  */
 function isRepoScopedRef(url, task, handle) {
     if (!handle)
@@ -470,6 +497,13 @@ function isRepoScopedRef(url, task, handle) {
         return true;
     if (repo === `${handle.owner}/${handle.name}`.toLowerCase())
         return true;
+    return promptNamesRepo(url, task);
+}
+/** Positive scope evidence for permanent declarations; legacy discovery still fails open. */
+function promptNamesRepo(url, task) {
+    const repo = refUrlRepo(url);
+    if (!repo)
+        return false;
     // Match whole owner/repository segments: naming acme/service2 must not corroborate
     // acme/service. Slashes remain valid boundaries for full URLs and their /pull or /issues path.
     const escapedRepo = repo.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -491,9 +525,30 @@ function isRepoScopedRef(url, task, handle) {
  * an archived run, so a cleared field is the whole cancellation.
  */
 function clearPendingAutoResume(run) {
+    // A withdrawn appointment settles the run failed with its kept error (hearsay-tools/cezarion#1236),
+    // the state a usage-limited run was in before it waited.
+    if (isUsageLimitHold(run)) {
+        run.status = 'failed';
+        run.finishedAt ??= new Date().toISOString();
+    }
     run.autoResumeAt = undefined;
     run.autoResumeAttempts = undefined;
 }
+/**
+ * The write rule (hearsay-tools/cezarion#1496): a resume time is the appointment of a `waiting`
+ * run, so every commit takes it off a record that is not `waiting`. A copy, set to `undefined`
+ * and never deleted: a caller may stage the held record itself. `autoResumeAttempts` stays, since
+ * `MAX_AUTO_RESUMES` counts attempts across resumes.
+ */
+function withoutStaleResumes(input) {
+    let staged;
+    for (const [id, run] of input) {
+        if (run?.autoResumeAt === undefined || isUsageLimitHold(run))
+            continue;
+        (staged ??= new Map(input)).set(id, { ...run, autoResumeAt: undefined });
+    }
+    return staged ?? input;
+}
 /**
  * Archiving is resigning from a task, so it retires the pin too (#935) — a pin on a task the
  * user has filed away is stale by definition, and the archived view collapses into one bucket
@@ -539,22 +594,15 @@ function eventTextFragments(event) {
     return fragments;
 }
 /**
- * Where a CREATION CLAIM may come from — the trust boundary the created tier was missing.
- *
- * `CREATED_PR_RE` used to be matched against everything an event carried, tool OUTPUT included,
- * so a transcript that merely QUOTES a `gh pr create` line handed the run a PR it never opened.
- * Not hypothetical: the task that fixed the reference chips printed another run's stored events
- * while investigating them, and cezar read `"title": "Ran gh pr create --repo …"` out of that
- * dump and adopted a PR from a DIFFERENT repository as its own — permanently, because the first
- * created URL wins and the real `gh pr create` that followed was never looked at.
- *
- * So the claim must come from the agent's own words, or from the tool title cezar itself renders
- * from the command it saw run. Tool output and tool input are the transcript of the world, not a
- * statement about this run. The URL is still read from the whole event — `gh` prints it in the
- * output — because it is the CLAIM that needs a trustworthy source, not the link.
+ * Creation claims come from agent prose or cezar-rendered tool titles, never arbitrary tool
+ * output/input. The claimed URL may still come from the event’s command result.
  */
 function eventCreationClaimFragments(event) {
     const fragments = [];
+    const nested = event.item;
+    if (event.parentItemId !== undefined || (nested && typeof nested === 'object' &&
+        nested.parentItemId !== undefined))
+        return fragments;
     // A `tool-result` event's `result` IS raw command output; on every other event the top-level
     // text is the agent's own.
     if (event.type !== 'tool-result') {
@@ -595,21 +643,9 @@ function eventAgentTextFragments(event) {
     return fragments;
 }
 /**
- * The referenced tier's resolution rule, shared by the PR and issue janitors:
- * a marker-declared number (spec 2026-07-18-task-ref-markers) owns the answer
- * outright — only a candidate URL ending in that number resolves, and a
- * contradiction clears the chip. Without a declaration: one distinct URL is
- * the subject; among several, prefer the exact URL pasted in the prompt, then
- * the one whose number the task prompt names (and
- * only when exactly one matches); otherwise ambiguous — no chip beats a wrong
- * chip.
- *
- * Whatever that produces is then repo-scoped (#945): a winner from another repository that the
- * prompt does not corroborate is vetoed — see `isRepoScopedRef`. The veto is applied to the
- * RESULT rather than to the candidate list on purpose, so the guard stays strictly subtractive:
- * filtering first would let a project-local candidate win a two-candidate race today's rule calls
- * ambiguous, which is a wider behavior change than the defect warrants. As written this function
- * can only ever lose a value, never gain one.
+ * Resolve declarations and prompt-supported candidates without guessing through ambiguity. Apply
+ * repository scope to the winner only; filtering candidates first could promote an otherwise
+ * ambiguous reference.
  */
 function resolveReferencedRef(candidates, task, declared, handle) {
     const resolved = resolveCandidate(candidates, task, declared);
@@ -648,20 +684,8 @@ function refUrlNumber(url) {
     return Number.isInteger(n) && n > 0 && n < MAX_REF ? n : undefined;
 }
 /**
- * The PR declaration the REFERENCED tier is allowed to act on.
- *
- * `CEZ:PR=N` means one of two things depending on when the agent writes it: on the way in it
- * names the PR the task is ABOUT, and once the task has opened a PR of its own the marker
- * contract asks it to re-declare with the new number ("Re-emit with the new number if the subject
- * changes (e.g. you open a PR later in the task)"). A declaration naming the PR this run CREATED
- * is therefore a statement about the CREATED tier, which `pullRequestUrl` already carries — and
- * feeding it to the referenced tier ERASES the about-PR, because `resolveReferencedRef` clears
- * the chip when no candidate matches the declared number (a task on #4326 that opened
- * #5366 dropped from two chips to one the moment it declared #5366).
- *
- * Both tiers stay true instead: the created PR is the created PR, and the reference resolves as
- * if that declaration had not been made — which is exactly what it was before the task opened
- * anything.
+ * Ignore a created-PR declaration when resolving the referenced subject, so a task can retain
+ * both its original subject and its new PR.
  */
 function referencedPrDeclaration(run) {
     const declared = run.markerRefs?.pr;
@@ -669,6 +693,50 @@ function referencedPrDeclaration(run) {
         return undefined;
     return declared === refUrlNumber(run.pullRequestUrl) ? undefined : declared;
 }
+/** Prompt attribution survives declarations of follow-up issues. Bare hashes become issues
+ * only after an issue signal; explicit PR prompts never acquire an invented issue identity. */
+function originatingIssue(run) {
+    // Only an issue-led subject is stable attribution. Mentions inside comparisons or
+    // background instructions remain evidence, but an agent declaration may supersede them.
+    const prompt = run.task.trimStart()
+        .replace(/^(?:please\s+)?(?:(?:can|could|would|will)\s+you\s+|i\s+(?:want|would\s+like)\s+you\s+to\s+)/i, '')
+        .replace(/^(?:please\s+)?(?:fix|resolve|address|implement|investigate|review|work(?:\s+on)?)\s+/i, '');
+    const subject = /^(?:(?:the\s+)?(?:(?:github|fork|upstream)\s+)?issue\s*|(?:fork|upstream)\s+)?(?:https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/issues\/\d+|(?:[\w.-]+\/[\w.-]+)?#?\d+)\b/i.exec(prompt);
+    if (!subject)
+        return undefined;
+    const refs = extractTaskRefs(subject[0]);
+    return refs.issueNumber ?? ((run.issueNumber !== undefined || run.markerRefs?.issue !== undefined)
+        ? refs.ambiguousNumber : undefined);
+}
+function referencedIssueDeclaration(run) {
+    return run.markerRefs?.issue === undefined ? undefined : originatingIssue(run) ?? run.markerRefs.issue;
+}
+function resolveIssueReference(run, handle) {
+    const declared = referencedIssueDeclaration(run);
+    const candidates = run.referencedIssueCandidates ?? [];
+    // Prompt URLs remain evidence even in legacy records without a candidate working set.
+    const promptUrls = [...new Set([...run.task.matchAll(new RegExp(ISSUE_URL_RE.source, 'g'))]
+            .map(match => match[0]).filter(url => refUrlNumber(url) === declared))];
+    if (promptUrls.length > 1)
+        return undefined;
+    if (promptUrls.length === 1)
+        return resolveReferencedRef(promptUrls, run.task, declared, handle);
+    // A number cannot choose between two repositories' issues with that same number.
+    if (declared !== undefined && new Set(candidates.filter(url => refUrlNumber(url) === declared)).size > 1) {
+        return undefined;
+    }
+    return resolveReferencedRef(candidates, run.task, declared, handle);
+}
+function restoreOriginatingIssue(run) {
+    const origin = originatingIssue(run);
+    if (origin === undefined || run.markerRefs?.issue === undefined)
+        return;
+    run.issueNumber = origin;
+    delete run.referencedIssueNumberSeeded;
+    if (run.referencedIssueCandidates !== undefined || refUrlNumber(run.referencedIssueUrl) !== origin) {
+        run.referencedIssueUrl = resolveIssueReference(run);
+    }
+}
 /**
  * The PR URL a creation phrase *introduces*, or undefined. The created URL is
  * the first one at or after the `CREATED_PR_RE` phrase — a PR the same event
@@ -690,6 +758,33 @@ function createdPrUrl(haystack) {
     }
     return before;
 }
+/** Associate one URL per claim; command outputs remain separate from authored claims. */
+function createdPrUrls(claim, haystack, toolOutput) {
+    const phrases = [...claim.matchAll(new RegExp(CREATED_PR_RE.source, 'gi'))];
+    if (!phrases.length)
+        return [];
+    const urls = phrases.flatMap((phrase, index) => {
+        const preceding = claim.slice(index ? phrases[index - 1].index + phrases[index - 1][0].length : 0, phrase.index);
+        const before = [...preceding.matchAll(new RegExp(PR_URL_RE.source, 'g'))].at(-1);
+        // URL-first reports put only punctuation/whitespace between the URL and its claim.
+        // An earlier URL followed by unrelated prose is still context, not a created resource.
+        if (before && /^[\s:—–-]*(?:draft\s+)?$/i.test(preceding.slice(before.index + before[0].length)))
+            return [before[0]];
+        const after = PR_URL_RE.exec(claim.slice(phrase.index, phrases[index + 1]?.index))?.[0];
+        return after ? [after] : [];
+    });
+    if (!urls.length && toolOutput !== undefined) {
+        // gh prints one URL per successful command. Never promote more output links than commands.
+        const outputs = [...toolOutput.matchAll(new RegExp(PR_URL_RE.source, 'g'))];
+        urls.push(...outputs.slice(0, phrases.length).map(match => match[0]));
+    }
+    if (!urls.length && phrases.length === 1) {
+        const url = createdPrUrl(`${claim} ${haystack}`);
+        if (url)
+            urls.push(url);
+    }
+    return [...new Set(urls)];
+}
 /**
  * Reconcile one record just read off disk with the fact that whichever process wrote it is gone.
  *
@@ -704,6 +799,18 @@ function createdPrUrl(haystack) {
  * are marked failed so no ghost stays behind.
  */
 export function reconcileLoadedRun(run, opts) {
+    settleLoadedStop(run);
+    restoreLoadedUsageLimitHold(run);
+    failLoadedInterruptedRun(run, opts);
+    clearLoadedStaleResume(run);
+    restoreLostReferencedPullRequest(run, referencedPrDeclaration, resolveReferencedRef);
+    restoreOriginatingIssue(run);
+    // Repository scoping follows reconciliation: stores arm a handle asynchronously, while
+    // the read-only index applies its cached handle to these fresh records (#97). This ordering
+    // also scopes any referenced PR restored above without filtering candidate evidence first.
+    return run;
+}
+function settleLoadedStop(run) {
     // An accepted Stop is durable intent, never an interrupted run to auto-resume.
     if (run.stopping) {
         run.status = 'cancelled';
@@ -714,13 +821,23 @@ export function reconcileLoadedRun(run, opts) {
         }
     }
     run.stopping = undefined;
+}
+function restoreLoadedUsageLimitHold(run) {
+    // A usage-limited run is waiting for its resume (hearsay-tools/cezarion#1236, phase 4a). Rows a
+    // schema-7 cezar wrote kept it failed with the appointment; they read as the waiting run they are.
+    if (run.status === 'failed' && run.autoResumeAt !== undefined) {
+        run.status = 'waiting';
+        run.finishedAt = undefined;
+    }
+}
+function failLoadedInterruptedRun(run, opts) {
     // A run that was live when the previous process exited can never finish —
     // surface that instead of a forever-"running" ghost. `review` survives
     // restarts on purpose: the gate is pure data (worktree + branch + record)
     // with no live process, so the diff panel, Send back (resume) and Draft PR
     // all still work.
-    if (!opts?.keepLive &&
-        (run.status === 'running' || run.status === 'queued' || run.status === 'waiting')) {
+    // A usage-limit hold runs no process, so no exit interrupted it: its appointment stands.
+    if (!opts?.keepLive && engineOwnsRun(run)) {
         run.status = 'failed';
         run.error = 'interrupted — cezar process exited during the run';
         run.finishedAt = run.finishedAt ?? new Date().toISOString();
@@ -729,44 +846,19 @@ export function reconcileLoadedRun(run, opts) {
                 step.status = 'failed';
         }
     }
-    if (!['running', 'waiting', 'queued'].includes(run.status)) {
-        run.activity = undefined;
-        run.monitoringWakeAt = undefined;
-    }
+}
+function clearLoadedStaleResume(run) {
+    // Open waits are left alone at every status: RunManager cancels them when a run ends (spec
+    // 2026-10-17-unified-waits), and recovery reads the ones a crash left behind.
     // A pending usage-limit resume survives the restart on purpose (the wait can be
     // hours) — `RunManager.recover()` re-arms it from this field. It can only mean
-    // anything on a `failed` run, so anywhere else it is stale bookkeeping.
-    if (run.status !== 'failed')
+    // anything on a `waiting` run, so anywhere else it is stale bookkeeping.
+    if (run.status !== 'waiting')
         run.autoResumeAt = undefined;
-    // The wake counter is intentionally process-local, so a restarted process
-    // starts a fresh epoch instead of displaying a stale cap.
-    run.monitoringWakeCapReached = undefined;
-    // Heal a record written before `referencedPrDeclaration` existed: a task that re-declared
-    // `CEZ:PR` with the PR it had just CREATED cleared the PR it was ABOUT, because no candidate
-    // could match the created number. The evidence is all still on the record — only the
-    // conclusion drawn from it was wrong — so re-resolve without that declaration instead of
-    // asking for a migration. Deliberately one-directional: it only runs on a record that HAS no
-    // referenced PR, so it can never take one away from a record written by an older cezar whose
-    // candidate list no longer explains it. `prNumber` is not recoverable this way (the
-    // declaration overwrote it) and is left alone — the restored URL is what paints the chip.
-    if (run.referencedPullRequestUrl === undefined &&
-        run.markerRefs?.pr !== undefined &&
-        referencedPrDeclaration(run) === undefined) {
-        run.referencedPullRequestUrl = resolveReferencedRef(run.referencedPrCandidates ?? [], run.task, undefined);
-    }
-    // Repository scoping follows reconciliation: stores arm a handle asynchronously, while
-    // the read-only index applies its cached handle to these fresh records (#97). This ordering
-    // also scopes any referenced PR restored above without filtering candidate evidence first.
-    return run;
 }
 /**
- * Settle a live run whose owning process died, when a control adopts it (#779, plan step 3), so
- * that adopting never starts agent work: only Continue may, with the user's own input. A run that
- * never started is cancelled before it began, which Continue restarts as it would after a Stop (the
- * same "untouched" test as `isUntouchedCancelledRun`); any other live run is interrupted, exactly as
- * an open that does not recover settles it, and Continue resumes its last session. With `stop`
- * (the control is Stop, and this is its run) a live run is cancelled instead, as an accepted Stop
- * always reads. Mutates `run`.
+ * Settle an adopted dead owner’s live run without starting work. Untouched runs cancel; started
+ * runs become interrupted. Stop explicitly cancels its target. Mutates run.
  */
 export function settleOrphanedRun(run, opts = {}) {
     if (opts.stop && (run.status === 'queued' || run.status === 'running' || run.status === 'waiting'))
@@ -788,6 +880,19 @@ export function settleOrphanedRun(run, opts = {}) {
  */
 export function rescopeRun(run, handle) {
     let changed = false;
+    if (handle && run.pullRequests) {
+        const entries = run.pullRequests.map(entry => {
+            if (entry.source !== 'declared' || !entry.url || isRepoScopedRef(entry.url, run.task, handle))
+                return entry;
+            // Revoke an uncorroborated URL, preserving the accepted declaration and its order.
+            return { number: entry.number, source: entry.source };
+        });
+        const next = mergePullRequests(undefined, entries, `https://github.com/${handle.owner}/${handle.name}`);
+        if (!isDeepStrictEqual(next, run.pullRequests)) {
+            run.pullRequests = next;
+            changed = true;
+        }
+    }
     if (run.referencedPullRequestUrl &&
         !isRepoScopedRef(run.referencedPullRequestUrl, run.task, handle)) {
         run.referencedPullRequestUrl = undefined;
@@ -809,15 +914,15 @@ export function rescopeRun(run, handle) {
     return changed;
 }
 /**
- * Every field `RunStore.open` may rewrite while loading a record: what `reconcileLoadedRun` and
- * `refreshHumanAskSummary` assign. Compared before and after, it tells open() which rows
- * normalization changed, so it marks those dirty and no others. Edit it together with either
- * function, or a normalized row stays unsaved (the store tests pin each field).
+ * Every field `RunStore.open` may rewrite while loading a record: what `reconcileLoadedRun`
+ * assigns. Compared before and after, it tells open() which rows normalization changed, so it
+ * marks those dirty and no others. Edit it together with that function, or a normalized row stays unsaved (the store tests pin each field).
  */
 function loadNormalizedFields(run) {
     return JSON.stringify([
-        run.stopping, run.status, run.finishedAt, run.error, run.activity, run.monitoringWakeAt, run.autoResumeAt,
-        run.monitoringWakeCapReached, run.referencedPullRequestUrl, run.hasPendingHumanAsk, run.steps.map((step) => step.status),
+        run.stopping, run.status, run.finishedAt, run.error, run.autoResumeAt,
+        run.referencedPullRequestUrl, run.pullRequests,
+        run.issueNumber, run.referencedIssueUrl, run.referencedIssueNumberSeeded, run.hasPendingPermission, run.steps.map((step) => step.status),
     ]);
 }
 /** Test seam (#779): `beforeTransaction` runs once `runs.json` is read and parsed, before the
@@ -859,28 +964,9 @@ function legacyIndexRows(bytes) {
     return { rows: [...rows.values()], skipped, total: raw.length };
 }
 /**
- * Import `runs.json` into a database that has never completed an import (#779, plan step 4).
- *
- * Nothing is read while a live cockpit other than this process owns the project
- * (`assertNoLegacyCockpit`): an older cezar still writes `runs.json` then, and the import could
- * not commit. Otherwise the file is read once, through one descriptor, and parsed; it is checked
- * again before anything is written, so a file that moved while it was parsed costs no write. Then
- * ONE transaction writes every record and the completion marker, or nothing:
- * - the marker is checked again once the transaction holds the write lock, so of two processes
- *   importing at once exactly one writes; the other finds the marker and writes nothing;
- * - right before COMMIT it refuses (`LegacyWriterError`) when an older cezar may still be writing
- *   `runs.json` (`assertNoLegacyWriter`) — the check that decides;
- * - only then are the exact bytes kept beside it (`backUpLegacyIndex`: synced, never half-written,
- *   an existing backup trusted only when it holds the same bytes), and the marker records what
- *   the import read: size, sha256 and the backup's name. A refused attempt leaves no backup;
- * - a crash or refusal leaves no marker, so the next open imports again from the start.
- * `runs.json` itself is left as it was, and nothing writes it again: an older cezar keeps reading
- * the history as it stood at the upgrade, and what it writes afterwards is never imported.
- *
- * A record that does not parse is skipped and the rest are imported; an index that does not parse
- * at all imports as an empty history. Either way the import that commits says so once, naming the
- * backup: the bytes survive there and in `runs.json`, which used to be overwritten by the next save
- * instead.
+ * Import legacy rows and the completion marker atomically, once. Recheck live-writer evidence
+ * before commit and preserve exact input bytes in a synced backup. Leave runs.json untouched;
+ * invalid entries are skipped and reported.
  */
 function importLegacyIndex(db, dataDir) {
     assertNoLegacyCockpit(dataDir);
@@ -915,13 +1001,23 @@ function importLegacyIndex(db, dataDir) {
 }
 /**
  * Finished rows whose stored summary an open-time normalization would still change: a referenced
- * PR an older cezar's created-PR declaration erased (see `reconcileLoadedRun`). Not live, so not
+ * PR an older cezar's created-PR declaration erased, or issue attribution displaced by a
+ * follow-up declaration (see `reconcileLoadedRun`). Not live, so not
  * in the `live` column; open decodes these few and keeps the ones it actually repaired.
  */
-const LEGACY_REFERENCE_HEAL_SQL = "json_extract(summary, '$.markerRefs.pr') IS NOT NULL AND json_extract(summary, '$.referencedPullRequestUrl') IS NULL";
+const LEGACY_REFERENCE_HEAL_SQL = "(json_extract(summary, '$.markerRefs.pr') IS NOT NULL AND json_extract(summary, '$.referencedPullRequestUrl') IS NULL)" +
+    " OR (NOT EXISTS (SELECT 1 FROM meta WHERE key = 'issue-attribution:' || runs.id AND value = CAST(runs.revision AS TEXT)) AND json_extract(summary, '$.markerRefs.issue') IS NOT NULL)";
+/**
+ * Rows whose record names the automation that launched it while the stored summary does not
+ * (hearsay-tools/cezarion#1332): summaries a cezar wrote before `RunSummary.automationId`
+ * existed. Open rewrites each one's summary once, so the sidebar's Automations tab classifies a
+ * finished task nobody has opened since the upgrade. `instr` keeps the JSON parse off every
+ * other row.
+ */
+const AUTOMATION_ORIGIN_HEAL_SQL = "instr(data, '\"automation') > 0 AND json_extract(summary, '$.automationId') IS NULL" +
+    " AND (json_extract(data, '$.automation.automationId') IS NOT NULL OR json_extract(data, '$.automationTrigger.automationId') IS NOT NULL)";
 /** Mark-all-read's rule (see `RunStore.markAllRead`) over the columns and the stored summary. */
 const MARK_ALL_READ_SQL = "archived = 0 AND status IN ('done', 'failed') AND finished_at IS NOT NULL" +
-    " AND NOT (status = 'failed' AND json_extract(summary, '$.autoResumeAt') IS NOT NULL)" +
     " AND (json_extract(summary, '$.seenAt') IS NULL OR json_extract(summary, '$.seenAt') < finished_at)";
 /** History retention's candidates among the given ids (a JSON array): finished, without
  *  delegation, and not pinned. */
@@ -1089,51 +1185,10 @@ const recordedProcessSchema = z.object({ pid: z.number().int().positive(), start
 const workerProcessRecordSchema = z.object({ generation: z.string().uuid(), controller: recordedProcessSchema,
     processes: z.array(recordedProcessSchema).max(WORKER_PROCESS_CAP) }).strict();
 const startToken = (pid) => { const token = processStartToken(pid); return token === undefined ? {} : { startToken: token }; };
-/** The bulk-archive sweep's one predicate (#780): finished, not archived, not scheduled (a
- *  `failed` run waiting out a usage limit), not an owned worker (those leave with their parent),
- *  then filtered by pin state. Mirrored clause for clause by `isSweepable` in the cockpit's
- *  `lib/tasks-table.ts`. */
-export function isSweepable(run, scope) {
-    if (run.archived || !['done', 'failed', 'cancelled'].includes(run.status))
-        return false;
-    if (run.status === 'failed' && run.autoResumeAt !== undefined)
-        return false;
-    if (run.delegation?.role === 'worker')
-        return false;
-    if (scope === 'unpinned')
-        return !run.pinned;
-    if (scope === 'pinned')
-        return run.pinned === true;
-    return true;
-}
 /**
- * File-backed run store: one row per run in `runs.db` (#779, `./run-database.ts`) plus one
- * append-only NDJSON event file per run. Also the in-process event bus the SSE endpoints
- * subscribe to: emits `('run', RunRecord)` and `('event', { runId, event: RunEvent })`.
- *
- * Only the held set lives in memory (#779, Amendment 2): live runs, the runs a RunManager pins,
- * their delegation families, and runs whose latest write has not settled yet (see `isHeld`).
- * `getRun` answers a held run with the held object, so `commitIndex` still installs into the
- * record a caller holds; any other run is read from `runs.db` as a fresh copy every time (frozen
- * under vitest, so an in-place write throws instead of being lost). Writes to a finished run go
- * through the methods here, which load it, change it and persist the row like any other.
- *
- * Two write paths, both through `writeIndex`:
- * - optimistic: a method changes the held record, marks it dirty and schedules the debounced
- *   save, which writes the dirty rows and deletions only;
- * - durable (`commitIndex`): one transaction with the changed rows AND everything a debounced
- *   save still owes. Only once it commits do the records change in memory, and only then do
- *   subscribers hear about it.
- *
- * Several processes may open one project (`serve` and a headless `cez run`), so a store writes
- * only the delegation families it claims in `run_claims` (#779, plan step 3; `run-claims.ts`).
- * Everything it holds is claimed: open claims the live rows nobody alive owns and leaves the rest
- * alone, and a write to a run not in memory claims its family first, or refuses it while another
- * live process owns it. Claims are released once a family leaves memory, and all of them on
- * `close()`; a crashed owner's are taken over only once it is proven dead. Every write is fenced
- * in its transaction: if a row is not as this store last saw it, or its claim is gone, nothing is
- * written, the evidence goes to `run_conflicts` and this store stops writing that row
- * (`handleConflicts`).
+ * Run rows in runs.db plus append-only NDJSON events and an in-process event bus. Hold live,
+ * pinned, related and unsettled records only. Optimistic writes debounce; durable commits
+ * publish after persistence. Family claims fence every write.
  */
 export class RunStore extends EventEmitter {
     dataDir;
@@ -1189,6 +1244,11 @@ export class RunStore extends EventEmitter {
     compressor;
     /** Transcript facts the delegation paths ask about, so they never re-read a transcript (#880). */
     facts;
+    liveItems = new LiveItemSnapshots();
+    /** Capture both sources on the same synchronous sequence boundary before history IO. */
+    liveReadSnapshot(runId) {
+        return { events: this.liveItems.read(runId), throughSeq: this.seqs.get(runId) ?? Infinity };
+    }
     constructor(dataDir) {
         super();
         this.dataDir = dataDir;
@@ -1219,7 +1279,7 @@ export class RunStore extends EventEmitter {
         const started = Date.now();
         for (let attempt = 0;; attempt++) {
             try {
-                return RunStore.openOnce(dataDir, path, opts?.keepLive === true);
+                return RunStore.openOnce(dataDir, path, opts?.keepLive === true, opts?.maintenance === true);
             }
             catch (error) {
                 const transient = error instanceof RunDatabaseBusyError || (error instanceof LegacyWriterError && error.reason === 'cockpit');
@@ -1230,7 +1290,7 @@ export class RunStore extends EventEmitter {
             }
         }
     }
-    static openOnce(dataDir, path, keepLive) {
+    static openOnce(dataDir, path, keepLive, maintenance) {
         mkdirSync(join(dataDir, 'runs'), { recursive: true });
         const store = new RunStore(dataDir);
         store.keepLive = keepLive;
@@ -1240,8 +1300,10 @@ export class RunStore extends EventEmitter {
                 importLegacyIndex(db, dataDir);
             store.db = db;
             store.owner = openClaimSession();
-            store.loadHeldRows();
-            store.warmTranscriptFacts();
+            if (!maintenance) {
+                store.loadHeldRows();
+                store.warmTranscriptFacts();
+            }
         }
         catch (error) {
             if (store.owner) {
@@ -1316,8 +1378,26 @@ export class RunStore extends EventEmitter {
                 continue;
             const decoded = decode(row);
             // Held only when the repair changed it: the next save writes it, then it leaves.
-            if (decoded)
-                this.adoptLoadedRun(decoded, { keepLive: this.keepLive, onlyIfChanged: true }, row);
+            if (decoded) {
+                // Persist verification once even when legacy issue attribution was already correct.
+                const needsIssueCheck = decoded.run.markerRefs?.issue !== undefined &&
+                    this.db.getMeta(`issue-attribution:${row.id}`) !== String(row.revision);
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive, onlyIfChanged: !needsIssueCheck }, row);
+                if (needsIssueCheck)
+                    this.dirty.add(row.id);
+            }
+        }
+        const stale = this.db.listWhere(AUTOMATION_ORIGIN_HEAL_SQL).filter((row) => !this.held.has(row.id));
+        const restamp = this.claimFamilies(stale.map(rowFamily));
+        for (const row of stale) {
+            if (!restamp.has(rowFamily(row)))
+                continue;
+            const decoded = decode(row);
+            // Nothing in the record changes, only its summary: held dirty, the next save rewrites it.
+            if (decoded) {
+                this.adoptLoadedRun(decoded, { keepLive: this.keepLive }, row);
+                this.dirty.add(row.id);
+            }
         }
         for (const rootId of this.anchoredFamilies())
             this.holdFamily(rootId, decode);
@@ -1327,17 +1407,16 @@ export class RunStore extends EventEmitter {
     }
     /** Normalize a record just read from `row` (see `reconcileLoadedRun`) and hold it. Marks the row
      *  dirty only when normalization changed it, so the next save persists exactly the runs open()
-     *  rewrote. The caller has claimed the row's family. */
-    adoptLoadedRun({ run, extras }, opts, row) {
+     *  rewrote. A row read up from schema-3 wait fields counts as changed: its rewrite drops them
+     *  and recomputes its summary and live column (`upgradeLegacyWaits`). The caller has claimed
+     *  the row's family. */
+    adoptLoadedRun({ run, extras, upgraded }, opts, row) {
         const before = loadNormalizedFields(run);
-        if (run.delegation?.role === 'root' && (run.status === 'waiting' || run.delegation.wait !== undefined)) {
-            this.syncHumanAskSummary(run);
-        }
         if (opts.settle)
             settleOrphanedRun(run, { stop: opts.stop });
         else
             reconcileLoadedRun(run, opts);
-        const changed = loadNormalizedFields(run) !== before;
+        const changed = upgraded === true || loadNormalizedFields(run) !== before;
         if (opts.onlyIfChanged && !changed)
             return;
         this.held.set(run.id, run);
@@ -1492,12 +1571,9 @@ export class RunStore extends EventEmitter {
         return ownership === 'foreign' || ownership === 'orphaned' ? RUN_IN_USE_ELSEWHERE : undefined;
     }
     /**
-     * Take over the delegation family of an `orphaned` run for a control: claim it from its dead
-     * owner (or from nobody), then load it and settle its live rows (`settleOrphanedRun`) — never
-     * keep them for recovery to resume, since only Continue may start agent work. With `stop` the
-     * control is Stop: `id` itself is settled as cancelled rather than interrupted. Returns the
-     * family's root id, or undefined when a live owner holds it after all or it is gone. The caller
-     * runs recovery for that family next (`RunManager.adoptOrphanedRun`), which then repairs it.
+     * Claim an orphaned family and settle its live rows before a control acts. Stop cancels its
+     * target. Return the root id, or undefined for a live owner or missing run; adoption never
+     * resumes work.
      */
     adoptFamily(id, opts = {}) {
         const family = this.db?.familyOf(id);
@@ -1670,6 +1746,14 @@ export class RunStore extends EventEmitter {
         holders.add(holder);
         return run;
     }
+    /** Publish a run's current record again without a write: something read beside the record
+     *  changed, such as the run leaving the manager's live registries, which a detail's finish
+     *  verdict reads (hearsay-tools/cezarion#1301). */
+    republish(id) {
+        const run = this.peek(id);
+        if (run)
+            this.emit('run', run, 'live-release');
+    }
     /** Release `holder`'s pin. The run leaves memory at the next sweep once nothing else holds it. */
     unpin(id, holder) {
         const holders = this.pins.get(id);
@@ -1680,20 +1764,8 @@ export class RunStore extends EventEmitter {
         this.sweepIfSettled([id]);
     }
     /**
-     * Tell the store which repository this project IS (#945), so the referenced tier stops adopting
-     * another repo's PR/issue as the task's subject. See `isRepoScopedRef` for the rule.
-     *
-     * A setter rather than an `open()` option because `open()` is synchronous and the handle costs a
-     * `gh` spawn: callers arm this in the background so boot never waits on the network. `null` is a
-     * first-class answer meaning "cannot be known" (no `gh`, no remote, a non-git root) and leaves
-     * the store in exactly its pre-#945 behavior.
-     *
-     * Arming also HEALS records already poisoned by the un-scoped rule, on the `reconcileLoadedRun`
-     * precedent: the evidence is all still on the record (`referenced*Candidates`), only the
-     * conclusion drawn from it was wrong, so re-deciding beats asking for a migration. It rewrites
-     * values, never the format, and is one-directional by construction — see `rescopeRun`. Held
-     * runs are re-checked in memory; of the rest, only rows whose stored summary references another
-     * repository are decoded, and the healed ones are written, so their summaries heal too.
+     * Set discovered repository identity without blocking boot. Recompute conclusions from retained
+     * evidence, including cold records; null retains unknown-handle behavior.
      */
     setRepoHandle(handle) {
         this.repoHandle = handle;
@@ -1743,7 +1815,7 @@ export class RunStore extends EventEmitter {
     /**
      * The live set, newest first: runs whose record is live (`isLiveRecord`) or that a RunManager
      * pins. Finished runs are not here — read one by id (`getRun`), by an indexed query
-     * (`listWorkersOf`, `findRunByClientRequestId`, `listGroupRuns`, `listRunsWithWorktree`,
+     * (`listWorkersOf`, `findRunByClientRequestId`, `listRunsWithWorktree`,
      * `listBranchOwners`), or as list rows (`listRunSummaries`).
      */
     listRuns() {
@@ -1819,7 +1891,9 @@ export class RunStore extends EventEmitter {
      * One page of archived ROOT runs, newest first (#864): `GET /run-summaries/archived`, the
      * archived runs past the window. Held runs list by their record, as in `listRunSummaries`.
      * `before` is the previous page's `nextCursor`; with `q`, only runs `matchesRunQuery` keeps, and
-     * `total` counts those. A cursor this store did not write answers `{ error }`.
+     * `total` counts those. `automationNames` lets `q` match a task by its automation's name, as the
+     * list's origin line shows it (hearsay-tools/cezarion#1616). A cursor this store did not write
+     * answers `{ error }`.
      *
      * Ranking reads every archived root's key (id, created_at, seq: no record, no summary), so the
      * page and `total` agree with the held overlay; only the page's own rows are read in full.
@@ -1832,6 +1906,16 @@ export class RunStore extends EventEmitter {
                 return { error: 'before is not a cursor this server wrote' };
         }
         const q = options.q?.trim() ?? '';
+        const ranked = this.rankArchivedRows(q, options.automationNames);
+        this.overlayHeldArchived(ranked, q, options.automationNames);
+        const ordered = [...ranked.entries()].sort(([, a], [, b]) => newestFirst(a, b));
+        return this.archivedPage(ordered, after, options.limit);
+    }
+    /** The archived roots in `runs.db`, each by its key: every one without `q` (no record, no
+     *  summary read), and with `q` the searched rows `matchesRunSearch` keeps, which carry the summary
+     *  the search read. A deleted, held or unreadable run's row is left out; a held run joins in
+     *  `overlayHeldArchived`. */
+    rankArchivedRows(q, automationNames) {
         const skipped = (id) => this.deleted.has(id) || this.held.has(id) || this.unreadable.has(id);
         const ranked = new Map();
         if (q === '') {
@@ -1840,30 +1924,33 @@ export class RunStore extends EventEmitter {
                     ranked.set(key.id, key);
         }
         else {
-            for (const row of this.db?.searchRootSummaries(sqlPrefilterTokens(q)) ?? []) {
+            for (const row of this.db?.searchRootSummaries(sqlPrefilterTokens(q, { automationNames })) ?? []) {
                 if (skipped(row.id))
                     continue;
                 const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
-                if (summary?.archived && matchesRunQuery(summary, q))
+                if (summary?.archived && matchesRunSearch(summary, q, { automationNames }))
                     ranked.set(row.id, { ...row, summary });
             }
         }
+        return ranked;
+    }
+    /** Lay the held archived roots over `ranked`, each by its record: it replaces its stored row
+     *  (already left out of `ranked`), and with `q` it must match. A held worker never lists. */
+    overlayHeldArchived(ranked, q, automationNames) {
         for (const [id, run] of this.held) {
             if (!run.archived || run.delegation?.role === 'worker')
                 continue;
             const summary = toRunSummary(run);
-            if (q === '' || matchesRunQuery(summary, q))
+            if (q === '' || matchesRunSearch(summary, q, { automationNames }))
                 ranked.set(id, { ...this.listOrder(run), summary });
         }
-        const ordered = [...ranked.entries()].sort(([, a], [, b]) => newestFirst(a, b));
+    }
+    /** The page of `ordered` after the cursor `after`: its summaries, the cursor of the next page,
+     *  and `total`, the count of all of `ordered`. */
+    archivedPage(ordered, after, limit) {
         const rest = after ? ordered.filter(([, key]) => newestFirst(key, after) > 0) : ordered;
-        const page = rest.slice(0, options.limit);
-        const cold = new Map((this.db?.getSummaries(page.filter(([, key]) => !key.summary).map(([id]) => id)) ?? [])
-            .map((row) => [row.id, parseStoredSummary(row.summary) ?? this.coldSummary(row.id)]));
-        const runs = page.flatMap(([id, key]) => {
-            const summary = key.summary ?? cold.get(id);
-            return summary ? [summary] : [];
-        });
+        const page = rest.slice(0, limit);
+        const runs = this.hydrateArchivedPage(page);
         const last = page.at(-1)?.[1];
         return {
             runs,
@@ -1871,8 +1958,19 @@ export class RunStore extends EventEmitter {
             total: ordered.length,
         };
     }
+    /** The page's summaries: a ranked key's own, else its stored one, read for the rows that have
+     *  none in a single query. A row whose stored summary does not fit the contract is projected from
+     *  its record; a row that cannot be read at all is left out. */
+    hydrateArchivedPage(page) {
+        const cold = new Map((this.db?.getSummaries(page.filter(([, key]) => !key.summary).map(([id]) => id)) ?? [])
+            .map((row) => [row.id, parseStoredSummary(row.summary) ?? this.coldSummary(row.id)]));
+        return page.flatMap(([id, key]) => {
+            const summary = key.summary ?? cold.get(id);
+            return summary ? [summary] : [];
+        });
+    }
     /**
-     * The ROOT runs, archived or not, that match `query` (`matchesRunQuery`), newest first: at most
+     * The ROOT runs, archived or not, that match `query` (`matchesRunSearch`), newest first: at most
      * `limit`, and whether more matched. The owned half of the workspace search (#864); held runs
      * match by their record.
      */
@@ -1884,7 +1982,7 @@ export class RunStore extends EventEmitter {
             if (this.deleted.has(row.id) || this.held.has(row.id) || this.unreadable.has(row.id))
                 return true;
             const summary = parseStoredSummary(row.summary) ?? this.coldSummary(row.id);
-            if (summary && matchesRunQuery(summary, query))
+            if (summary && matchesRunSearch(summary, query))
                 matched.set(row.id, [summary, row]);
             return matched.size <= limit;
         });
@@ -1892,7 +1990,7 @@ export class RunStore extends EventEmitter {
             if (run.delegation?.role === 'worker')
                 continue;
             const summary = toRunSummary(run);
-            if (matchesRunQuery(summary, query))
+            if (matchesRunSearch(summary, query))
                 matched.set(id, [summary, this.listOrder(run)]);
         }
         const runs = sortNewestFirst(matched.values());
@@ -1986,6 +2084,61 @@ export class RunStore extends EventEmitter {
         }
         return [...ids];
     }
+    /** All retained tasks this automation started, including variants, finished and archived runs.
+     * Logs and receipts may compact independently. Read only matching keys in SQLite and overlay
+     * held records so a debounced provenance update or deletion is reflected immediately. */
+    countAutomationRuns(automationId) {
+        const where = "json_extract(data, '$.automation.automationId') = ? OR " +
+            "json_extract(data, '$.automationTrigger.automationId') = ?";
+        const ids = new Set((this.db?.listKeysWhere(where, [automationId, automationId]) ?? [])
+            .map((key) => key.id));
+        for (const id of this.deleted)
+            ids.delete(id);
+        for (const [id, run] of this.held) {
+            if (run.automation?.automationId === automationId || run.automationTrigger?.automationId === automationId)
+                ids.add(id);
+            else
+                ids.delete(id);
+        }
+        return ids.size;
+    }
+    /** First non-archived task referencing a project issue, including secondary references. */
+    findNonArchivedRunByIssue(repo, number) {
+        const url = `https://github.com/${repo}/issues/${number}`.toLowerCase();
+        const matches = (run) => {
+            if (run.archived)
+                return false;
+            const urls = [run.referencedIssueUrl, ...(run.referencedIssueCandidates ?? []),
+                ...(run.automation?.event.startsWith('issue.') ? [run.automation.githubUrl] : []),
+                ...[...run.task.matchAll(new RegExp(ISSUE_URL_RE.source, 'gi'))].map((match) => match[0])]
+                .filter((value) => value !== undefined)
+                .map((value) => value.replace(/\/+$/, '').toLowerCase())
+                .filter((value) => value.endsWith(`/issues/${number}`));
+            // The legacy issueNumber is display-only and cannot establish repository identity.
+            // Explicit task markers remain project-scoped unless a qualified URL contradicts them.
+            return urls.includes(url) || (urls.length === 0 && run.markerRefs?.issue === number);
+        };
+        for (const run of this.held.values())
+            if (matches(run))
+                return run.id;
+        // Secondary references are record-only: query them in SQLite rather than hydrating every
+        // finished transcript or relying on the slim summary's primary issue number.
+        const where = `archived = 0 AND (
+      json_extract(data, '$.issueNumber') = ? OR json_extract(data, '$.markerRefs.issue') = ?
+      OR lower(rtrim(json_extract(data, '$.referencedIssueUrl'), '/')) = ?
+      OR EXISTS (SELECT 1 FROM json_each(data, '$.referencedIssueCandidates') WHERE lower(rtrim(value, '/')) = ?)
+      OR (json_extract(data, '$.automation.event') LIKE 'issue.%' AND lower(rtrim(json_extract(data, '$.automation.githubUrl'), '/')) = ?)
+      OR instr(lower(json_extract(data, '$.task')), ?) > 0
+    )`;
+        for (const key of this.db?.listKeysWhere(where, [number, number, url, url, url, url]) ?? []) {
+            if (this.held.has(key.id) || this.deleted.has(key.id) || this.unreadable.has(key.id))
+                continue;
+            const run = this.getRun(key.id);
+            if (run && matches(run))
+                return key.id;
+        }
+        return undefined;
+    }
     /**
      * The runs automation receipts launched, by receipt id (`automation.receiptId` or
      * `automationTrigger.receiptId`). Memory answers first; a receipt it does not know costs one
@@ -2041,10 +2194,6 @@ export class RunStore extends EventEmitter {
             ids.add(id);
         return [...ids];
     }
-    /** The members of one parallel-variant group (spec 010), in no particular order. */
-    listGroupRuns(groupId) {
-        return this.queryRuns(this.db?.listByGroup(groupId) ?? [], (run) => run.groupId === groupId).map(([run]) => run);
-    }
     /** Runs with a materialized worktree directory (`worktreePath`, not reclaimed), most recently
      *  finished first, then newest first: worktree retention and the worktrees panel. */
     listRunsWithWorktree() {
@@ -2138,13 +2287,16 @@ export class RunStore extends EventEmitter {
             effort: input.effort,
             runner: input.runner,
             agentProfile: input.agentProfile,
-            generateFollowups: input.generateFollowups,
             autonomous: input.autonomous,
+            archiveWhenDone: input.archiveWhenDone,
+            autoMergePr: input.autoMergePr,
             ...(input.notify ? { notify: true } : {}),
             worktree: input.worktree,
             groupId: input.groupId,
             variant: input.variant,
             ...(input.clientRequestId === undefined ? {} : { clientRequestId: input.clientRequestId, clientRequestHash: input.clientRequestHash }),
+            ...(input.automation ? { automation: input.automation } : {}),
+            ...(input.automationTrigger ? { automationTrigger: input.automationTrigger } : {}),
             status: 'queued',
             createdAt: new Date().toISOString(),
             tokensUsed: 0,
@@ -2181,31 +2333,13 @@ export class RunStore extends EventEmitter {
         }
         this.commitIndex(staged);
     }
-    /** Observable atomic input checkpoint: a failed write publishes nothing. */
-    /** Accepted input the harness will never read returns to the queue (#505): only its
-     * delivery and consumption receipts are cleared; order and identity are kept. */
-    requeueUnconsumedAgentInputs(id, ids) {
-        const run = this.peek(id);
-        if (!run?.agentInputs || !ids.length)
-            return;
-        this.commitAgentInputs(id, run.agentInputs.map(input => {
-            if (!ids.includes(input.id))
-                return input;
-            const { deliveredAt: _delivered, consumedAt: _consumed, awaitingRead: _awaiting, ...queued } = input;
-            return queued;
-        }));
-    }
-    /** Model consumption observed by the current session (#505). Never un-sets deliveredAt. */
-    commitAgentInputsConsumed(id, ids, at) {
-        const run = this.peek(id);
-        if (!run?.agentInputs || !ids.length)
-            return;
-        this.commitAgentInputs(id, run.agentInputs.map(input => {
-            if (!ids.includes(input.id) || !input.deliveredAt || input.consumedAt)
-                return input;
-            const { awaitingRead: _awaiting, ...read } = input;
-            return { ...read, consumedAt: at };
-        }));
+    /** Crash recovery (#505): input a harness accepted but was never seen reading goes
+     * back to the queue. Returns the requeued IDs. */
+    requeueAwaitingReadInputs(id) {
+        const ids = (this.peek(id)?.agentInputs ?? []).filter(input => input.awaitingRead && input.deliveredAt && !input.consumedAt).map(input => input.id);
+        if (ids.length)
+            this.commitOutcome(id, { kind: 'requeued', inputIds: ids });
+        return ids;
     }
     /** Delivered, but the harness never confirmed reading it (#505): stop awaiting a read. */
     commitAgentInputsUnconfirmed(id, ids) {
@@ -2219,18 +2353,18 @@ export class RunStore extends EventEmitter {
             return unconfirmed;
         }));
     }
-    /** Crash recovery (#505): input a harness accepted but was never seen reading goes
-     * back to the queue. Returns the requeued IDs. */
-    requeueAwaitingReadInputs(id) {
-        const ids = (this.peek(id)?.agentInputs ?? []).filter(input => input.awaitingRead && input.deliveredAt && !input.consumedAt).map(input => input.id);
-        this.requeueUnconsumedAgentInputs(id, ids);
-        return ids;
-    }
-    commitAgentInputs(id, inputs, openingContinuationInputId) {
+    /** Observable atomic input checkpoint for the queue itself: enqueue, retire, reorder. Delivery
+     *  and reads are outcomes (`commitOutcome`). */
+    commitAgentInputs(id, inputs) {
         const run = this.peek(id);
         if (!run)
             throw new Error('missing agent input target');
         const agentInputs = inputs.map(input => agentInputSchema.parse(input));
+        // Receipts are outcomes (hearsay-tools/cezarion#1805): only `commitOutcome` writes them.
+        const stored = new Map((run.agentInputs ?? []).map(input => [input.id, input]));
+        if (agentInputs.some(input => input.deliveredAt !== stored.get(input.id)?.deliveredAt || input.consumedAt !== stored.get(input.id)?.consumedAt)) {
+            throw new Error('agent input receipts change only through commitOutcome');
+        }
         const now = new Date().toISOString();
         for (const input of run.agentInputs ?? []) {
             const claim = input.inboxClaim;
@@ -2241,10 +2375,7 @@ export class RunStore extends EventEmitter {
                 throw new Error('live inbox receipt changed');
             }
         }
-        if (openingContinuationInputId && (run.continuationMessage?.agentInputId !== openingContinuationInputId ||
-            !agentInputs.some(input => input.id === openingContinuationInputId && input.deliveredAt)))
-            throw new Error('opening agent input checkpoint changed');
-        this.commitIndex(new Map([[id, { ...run, agentInputs, ...(openingContinuationInputId ? { continuationMessage: undefined } : {}) }]]));
+        this.commitIndex(new Map([[id, { ...run, agentInputs }]]));
     }
     /** Reserve only unread conversation inputs in one durable index replacement. */
     claimInboxInputs(runId, ids, claim) {
@@ -2292,8 +2423,7 @@ export class RunStore extends EventEmitter {
         if (matching.some(input => input.deliveredAt || input.inboxClaim?.acknowledgedAt || input.inboxClaim.expiresAt <= at)) {
             throw new Error('inbox receipt expired or displaced');
         }
-        this.commitIndex(new Map([[runId, { ...run, agentInputs: run.agentInputs.map(input => input.inboxClaim?.receiptId === receiptId
-                        ? agentInputSchema.parse({ ...input, deliveredAt: at, inboxClaim: { ...input.inboxClaim, acknowledgedAt: at } }) : input) }]]));
+        this.commitOutcome(runId, { kind: 'inbox-acknowledged', receiptId, at });
         return 'acknowledged';
     }
     releaseInboxInputs(runId, receiptId, generation) {
@@ -2328,67 +2458,102 @@ export class RunStore extends EventEmitter {
                         return agentInputSchema.parse(unclaimed);
                     }) }]]));
     }
-    /** CI intent and its wake entry share one atomic index replacement. */
-    commitCiWait(id, wait, input) {
+    /**
+     * A wait and its wake input share one atomic index replacement (spec 2026-10-17-unified-waits).
+     * Upserts `wait` by id into `waits` and clears `lastWaitsError`; `input` is appended once (an
+     * input whose id is already queued stays as it is). Only an open or resolved wait is committed
+     * here: settling is an outcome (`commitOutcome`). A new open wait
+     * past `WAIT_LIMIT` open ones is refused, so the list stays bounded whatever the caller checked.
+     */
+    commitWait(id, wait, input) {
         const run = this.peek(id);
         if (!run)
-            throw new Error('missing CI wait target');
-        const ciWait = ciWaitSchema.parse(wait);
-        const entry = input ? agentInputSchema.parse(input) : undefined;
-        this.commitIndex(new Map([[id, { ...run, ciWait, lastCiWaitError: undefined, ...(entry ? { agentInputs: run.agentInputs?.some(row => row.id === entry.id)
-                            ? run.agentInputs : [...(run.agentInputs ?? []), entry] } : {}) }]]));
-    }
-    /** Retire the wait and precisely its pending wake, optionally accepting human input. */
-    commitCiWaitWithdrawal(id, acceptedHumanMessage) {
+            throw new Error('missing wait target');
+        const entry = waitSchema.parse(wait);
+        if (entry.phase !== 'open' && entry.phase !== 'resolved')
+            throw new Error('a settled wait is committed through its delivery or cancellation');
+        const waits = run.waits ?? [];
+        const known = waits.some((row) => row.id === entry.id);
+        if (!known && entry.phase === 'open' && waits.filter((row) => row.phase === 'open').length >= WAIT_LIMIT) {
+            throw new Error(`open wait limit reached (${WAIT_LIMIT})`);
+        }
+        const agentInput = input ? agentInputSchema.parse(input) : undefined;
+        this.commitIndex(new Map([[id, { ...run, waits: known ? waits.map((row) => row.id === entry.id ? entry : row) : [...waits, entry], lastWaitsError: undefined,
+                    ...(agentInput ? { agentInputs: run.agentInputs?.some((row) => row.id === agentInput.id)
+                            ? run.agentInputs : [...(run.agentInputs ?? []), agentInput] } : {}) }]]));
+    }
+    /** A park that gives up its slot (hearsay-tools/cezarion#1235): the run and its step read
+     *  `waiting`, committed at once instead of on the debounced save, so a refused write throws with
+     *  nothing changed and the caller keeps the slot. */
+    commitParked(id, stepId) {
         const run = this.peek(id);
-        if (!run?.ciWait)
+        if (!run)
             return;
-        const { ciWait, ...rest } = run;
-        const lastCiWait = { ...ciWait, phase: 'withdrawn' };
-        this.commitIndex(new Map([[id, { ...rest, ciWait: undefined, lastCiWait,
-                    ...(run.agentInputs ? { agentInputs: run.agentInputs.filter(input => input.id !== ciWait.wakeId || input.deliveredAt) } : {}),
-                    ...(acceptedHumanMessage ? { queuedMessages: [...(run.queuedMessages ?? []), queuedMessageSchema.parse(acceptedHumanMessage)] } : {}),
-                }]]));
+        this.commitIndex(new Map([[id, { ...run, status: 'waiting', activity: undefined,
+                    ...(stepId ? { steps: run.steps.map((step) => step.id === stepId ? { ...step, status: 'waiting' } : step) } : {}) }]]));
     }
-    /** Provider acceptance and receipt retirement have one delivery checkpoint. */
-    commitCiWaitDelivery(id, inputId) {
+    /** A usage-limit appointment withdrawn, committed at once instead of on the debounced save
+     *  (hearsay-tools/cezarion#1236): a crash right after the withdrawal must not find it on disk,
+     *  or recovery re-arms work the user cancelled. A run held for its resume settles `failed`. */
+    commitAutoResumeWithdrawal(id) {
         const run = this.peek(id);
-        if (!run?.ciWait || run.ciWait.wakeId !== inputId)
+        if (!run || (run.autoResumeAt === undefined && run.autoResumeAttempts === undefined))
             return;
-        const { ciWait, ...rest } = run;
-        const deliveredAt = new Date().toISOString();
-        this.commitIndex(new Map([[id, { ...rest, ciWait: undefined, lastCiWait: { ...ciWait, phase: 'delivered', deliveredAt },
-                    agentInputs: (run.agentInputs ?? []).map(input => input.id === inputId ? { ...input, deliveredAt } : input), }]]));
+        const held = isUsageLimitHold(run);
+        this.commitIndex(new Map([[id, { ...run, autoResumeAt: undefined, autoResumeAttempts: undefined,
+                    ...(held ? { status: 'failed', finishedAt: new Date().toISOString() } : {}) }]]));
+    }
+    /** Legacy CI checkpoint over `commitWait`, kept until its callers move (unified waits, Task 4). */
+    commitCiWait(id, wait, input) {
+        this.commitWait(id, ciWaitEntry(ciWaitSchema.parse(wait)), input);
     }
-    /** Retain the settled receipt and retire exactly one wait together with any human message that superseded it. */
-    commitWorkerWaitWithdrawal(id, waitId, acceptedHumanMessage) {
+    /** A human message beside a run's waits (hearsay-tools/cezarion#1235): accepted durably, and
+     *  every wait stays. A lifecycle opening becomes
+     *  the human's and keeps its wake text, so the message opens the continuation (and answers a
+     *  pending question) and the owed results still reach the agent. */
+    commitHumanMessageBesideWaits(id, acceptedHumanMessage) {
         const run = this.peek(id);
-        if (!run?.delegation || run.delegation.role === 'invalid' || run.delegation.wait?.id !== waitId) {
-            throw new Error('worker wait changed before withdrawal');
-        }
-        const { wait, ...delegation } = run.delegation;
-        const message = acceptedHumanMessage ? queuedMessageSchema.parse(acceptedHumanMessage) : undefined;
-        this.commitIndex(new Map([[id, { ...run, delegation: { ...delegation, lastWait: wait.phase === 'wake-pending'
-                            ? reconcileWorkerWait(wait, [], new Date().toISOString())
-                            : { ...wait, phase: 'wake-pending', reason: wait.reason ?? 'cancelled', wakeId: wait.wakeId ?? wait.id } },
-                    // An adopted agent input belongs to its sender, even when it carries the wait receipt.
-                    ...(run.agentInputs ? { agentInputs: run.agentInputs.filter(input => input.id !== wait.wakeId || input.deliveredAt || input.source === 'agent') } : {}),
-                    ...(message ? {
-                        queuedMessages: [...(run.queuedMessages ?? []), message],
-                        ...(run.continuationMessage ? { continuationMessage: {
-                                ...run.continuationMessage, origin: 'human',
-                                text: run.continuationMessage.origin === 'lifecycle' ? '' : run.continuationMessage.text,
-                            } } : {}),
-                    } : {}),
+        if (!run)
+            throw new Error('missing queued message target');
+        this.commitIndex(new Map([[id, { ...run, queuedMessages: [...(run.queuedMessages ?? []), queuedMessageSchema.parse(acceptedHumanMessage)],
+                    ...(run.continuationMessage ? { continuationMessage: { ...run.continuationMessage, origin: 'human' } } : {}),
                 }]]));
     }
-    /** Successful deferred human delivery consumes only its persisted queue ID.
-     * A crash before this checkpoint may replay that same message on recovery. */
-    commitQueuedMessageDelivery(id, messageId) {
+    /**
+     * The one write of a run outcome (hearsay-tools/cezarion#1805): an input or wait delivered, a wake
+     * charged, a wait settled, a question answered, staged by `applyOutcomes` with what it depends on
+     * (`deps`) and committed in one transaction, with every pending row. A crash keeps all of it or
+     * none. Nothing changes: nothing is written. Needs no live session: it reads the stored record.
+     *
+     * A refused write throws with nothing changed. `bestEffort` is for a cleanup path, which must
+     * never stop on it: it warns and applies the change in memory for the debounced save to retry.
+     * A conversation request outcome is the other sanctioned write: `commitConversation`.
+     */
+    commitOutcome(id, outcomes, deps = {}, opts = {}) {
         const run = this.peek(id);
         if (!run)
-            throw new Error('missing queued message target');
-        this.commitIndex(new Map([[id, { ...run, queuedMessages: (run.queuedMessages ?? []).filter(message => message.id !== messageId) }]]));
+            return { committed: false, answered: [] };
+        const staged = applyOutcomes(run, Array.isArray(outcomes) ? outcomes : [outcomes], deps);
+        if (!staged.changed)
+            return { committed: false, answered: [] };
+        try {
+            this.commitIndex(new Map([[id, staged.next]]));
+        }
+        catch (error) {
+            if (!opts.bestEffort)
+                throw error;
+            console.warn(`[cez] outcome checkpoint failed: ${error instanceof Error ? error.message : String(error)}`);
+            const live = this.record(id);
+            if (!live)
+                return { committed: false, answered: staged.answered };
+            for (const key of Object.keys(live))
+                if (!(key in staged.next))
+                    delete live[key];
+            Object.assign(live, staged.next);
+            this.touch(live);
+            return { committed: false, answered: staged.answered };
+        }
+        return { committed: true, answered: staged.answered };
     }
     /** An acknowledged inactive-root Finish must survive the async diff and restart. */
     commitRootFinishIntent(id) {
@@ -2419,7 +2584,7 @@ export class RunStore extends EventEmitter {
         const { finishRequestedAt: _intent, ...delegation } = run.delegation;
         const finishedAt = new Date().toISOString();
         this.commitIndex(new Map([[id, { ...run, delegation, status, finishedAt, currentStepId: undefined, autoResumeAttempts: undefined,
-                    activity: undefined, monitoringWakeAt: undefined, monitoringWakeCapReached: undefined,
+                    activity: undefined,
                     steps: run.steps.map(step => step.status === 'waiting' || step.status === 'running'
                         ? { ...step, status: 'done', finishedAt: step.finishedAt ?? finishedAt } : step),
                 }]]));
@@ -2664,16 +2829,12 @@ export class RunStore extends EventEmitter {
         return run;
     }
     /**
-     * The durable write: `staged` holds the records this operation replaces (`null` deletes one),
-     * in the order subscribers hear about them. The transaction is the durability boundary;
-     * flush() is deliberately best-effort.
-     *
-     * One transaction carries the staged rows and every row a debounced save still owes, so the
-     * database never holds a commit without the optimistic writes made before it. If it fails,
-     * nothing changed anywhere: the held records, the database, the pending dirty rows and the
-     * subscribers all see the store as it was.
+     * Durably replace or delete staged rows together with pending dirty rows. Persist before
+     * changing held objects or notifying subscribers. On failure retain all pending state; flush()
+     * remains best-effort.
      */
-    commitIndex(staged, source) {
+    commitIndex(input, source) {
+        const staged = this.prepareCompletionActions(withoutStaleResumes(input));
         if (!this.db)
             throw this.openFailure ?? new Error('runs database unavailable: nothing can be saved');
         this.assertWritable(staged);
@@ -2687,8 +2848,13 @@ export class RunStore extends EventEmitter {
             }
             this.committing.add(id);
             const current = this.held.get(id);
-            if (current)
+            if (current) {
+                for (const key of Object.keys(current)) {
+                    if (!(key in next))
+                        delete current[key];
+                }
                 Object.assign(current, next);
+            }
             else
                 this.held.set(id, next);
         }
@@ -2706,6 +2872,107 @@ export class RunStore extends EventEmitter {
                 this.committing.delete(id);
             this.sweepIfSettled(staged.keys());
         }
+        for (const [id, next] of staged)
+            if (next?.archived)
+                this.compressor.enqueue(id);
+    }
+    /** Completion and its intent/archive share the same committed rows, including root Finish. */
+    prepareCompletionActions(input) {
+        const staged = new Map(input);
+        for (const [id, candidate] of input) {
+            if (!candidate)
+                continue;
+            const previous = this.peek(id);
+            let next = candidate;
+            const changed = candidate.status === 'done' && !candidate.archived && (previous?.status !== 'done' ||
+                Boolean(previous.archiveWhenDone) !== Boolean(candidate.archiveWhenDone) ||
+                Boolean(previous.autoMergePr) !== Boolean(candidate.autoMergePr));
+            if (changed && (candidate.archiveWhenDone || candidate.autoMergePr)) {
+                next = { ...candidate, completionAction: { id: randomUUID(), phase: 'pending' } };
+                staged.set(id, next);
+                if (next.archiveWhenDone && !next.autoMergePr) {
+                    const blocker = this.completionArchiveBlocker(next);
+                    next.completionAction = { ...next.completionAction, phase: blocker ? 'blocked' : 'complete', ...(blocker ? { message: blocker } : {}) };
+                    if (!blocker)
+                        this.stageArchive(staged, next, true);
+                }
+            }
+            else if (candidate.status !== 'done' || (!candidate.archiveWhenDone && !candidate.autoMergePr)) {
+                if (candidate.completionAction)
+                    staged.set(id, { ...candidate, completionAction: undefined });
+            }
+        }
+        return staged;
+    }
+    completionArchiveBlocker(root) {
+        const family = [root, ...this.listWorkersOf(root.id)];
+        for (const run of family) {
+            const facts = this.facts.peek(run.id);
+            if (!facts || !['done', 'review', 'failed', 'cancelled'].includes(run.status) || run.waits?.some(wait => wait.phase === 'open') ||
+                run.hasPendingPermission || facts.pendingAsk !== undefined)
+                return 'Task or worker work still needs attention. Open the task or archive manually.';
+            if (run.delegation?.role === 'invalid' || (run.delegation?.role === 'worker' && this.readWorkerExecution(run.id)?.phase !== 'complete'))
+                return 'Worker execution has not settled. Open the worker or archive manually.';
+        }
+        return undefined;
+    }
+    /** One archive write for manual actions, merge observations, completion, and sweeps.
+     * Archiving files history away; it never stops a process or removes a worktree. */
+    stageArchive(staged, root, archived) {
+        const ids = root.delegation?.role === 'worker' ? [root.id] :
+            [root.id, ...new Set([...(this.db?.listIdsByParent(root.id) ?? []), ...this.listWorkersOf(root.id).map(run => run.id)])];
+        const now = new Date().toISOString();
+        for (const id of ids) {
+            const member = staged.get(id) ?? this.peek(id);
+            if (!member)
+                continue;
+            if (!archived) {
+                this.compressor.cancel(id);
+                restoreHistory(this.dataDir, id);
+            }
+            const next = { ...member, archiveBlocker: undefined };
+            archiveFields(next, archived, now);
+            staged.set(id, next);
+        }
+    }
+    /** A bounded persisted queue also covers projects without a live RunManager. */
+    listCompletionCandidates(afterSeq = 0, limit = 32) {
+        return this.db?.listCompletionCandidates(afterSeq, limit) ?? [];
+    }
+    canCompleteAction(id, token) {
+        const run = this.record(id);
+        return Boolean(run && run.status === 'done' && !run.archived && (run.autoMergePr || run.archiveWhenDone) &&
+            run.completionAction?.id === token && run.completionAction.phase !== 'complete' && !this.writeRefusal(id));
+    }
+    claimCompletionAction(id, token) {
+        if (!this.canCompleteAction(id, token))
+            return false;
+        const run = this.record(id);
+        this.assertWritable(new Map([[id, run]]));
+        // A normal write may defer its claim until the transaction. A remote mutation
+        // needs the committed claim now, and must not act on a stale row read before it.
+        const claim = this.db?.getClaim(familyKey(run));
+        return Boolean(claim && claim.session === this.owner?.session &&
+            claim.generation === this.claimed.get(familyKey(run)) &&
+            this.db?.get(id)?.revision === this.base.get(id)?.revision);
+    }
+    completeAction(id, token, phase, message) {
+        const run = this.record(id);
+        if (!run || !this.canCompleteAction(id, token))
+            return false;
+        if (run.completionAction?.phase === phase && run.completionAction.message === message)
+            return true;
+        const next = { ...run, completionAction: { id: token, phase, ...(message ? { message } : {}) } };
+        const staged = new Map([[id, next]]);
+        if (phase === 'complete' && next.archiveWhenDone) {
+            const blocker = this.completionArchiveBlocker(next);
+            if (blocker)
+                next.completionAction = { id: token, phase: 'blocked', message: blocker };
+            else
+                this.stageArchive(staged, next, true);
+        }
+        this.commitIndex(staged);
+        return true;
     }
     /**
      * Refuse (throwing, with nothing changed) a commit that stages a quarantined run, or a run whose
@@ -2754,18 +3021,17 @@ export class RunStore extends EventEmitter {
             delete run.referencedIssueNumberSeeded;
         }
         const normalized = { ...patch };
-        if (normalized.status && !['running', 'waiting', 'queued'].includes(normalized.status)) {
-            normalized.activity = undefined;
-            normalized.monitoringWakeAt = undefined;
-            normalized.monitoringWakeCapReached = undefined;
-        }
-        // …and the mirror image for the usage-limit resume (spec
-        // 2026-08-03-auto-resume-after-usage-limit): it is a promise made ABOUT a failed run, so a
-        // run coming back to life — the resume itself, a user Continue, a re-queue — retires it.
-        // The manager's timer re-checks the record before it fires, so a cleared field is enough.
-        if (normalized.status && ['running', 'waiting', 'queued'].includes(normalized.status)) {
-            normalized.autoResumeAt = undefined;
+        if (normalized.pullRequestUrl !== undefined) {
+            this.accumulatePullRequests(run, [run.pullRequestUrl, normalized.pullRequestUrl].flatMap((url) => {
+                const number = refUrlNumber(url);
+                if (number === undefined)
+                    return [];
+                const parsed = runPullRequestSchema.safeParse({ number, url, source: 'created' });
+                return parsed.success ? [parsed.data] : [];
+            }));
         }
+        // Waits are not cleared here: RunManager cancels them explicitly when a run ends (spec
+        // 2026-10-17-unified-waits), so a terminal patch never retires one as a side effect.
         const archived = Object.prototype.hasOwnProperty.call(normalized, 'archived')
             ? Boolean(normalized.archived)
             : undefined;
@@ -2776,7 +3042,22 @@ export class RunStore extends EventEmitter {
         // Restore before mutating so a throw leaves status and archived unchanged (#818 S3).
         if (archived === false)
             restoreHistory(this.dataDir, id);
+        // Opted-in completion and the handoff's records (the file shows only committed ones) take this
+        // transaction. Default-off Finish keeps its best-effort write so a locked database cannot stop cleanup.
+        if ((normalized.status === 'done' && (run.archiveWhenDone || run.autoMergePr)) || normalized.handoffRecords !== undefined ||
+            normalized.archiveWhenDone !== undefined || normalized.autoMergePr !== undefined) {
+            const next = { ...run, ...this.redactPatch(normalized) };
+            if (archived !== undefined)
+                archiveFields(next, archived, new Date().toISOString());
+            this.commitIndex(new Map([[id, next]]));
+            return this.record(id);
+        }
         Object.assign(run, this.redactPatch(normalized));
+        // The usage-limit resume is the appointment of a `waiting` run (hearsay-tools/cezarion#1236),
+        // so a run coming back to life or settling retires it. `commitIndex` applies the same rule to
+        // every commit (`withoutStaleResumes`); this debounced path mutates the held record without it.
+        if (run.status !== 'waiting')
+            run.autoResumeAt = undefined;
         if (normalized.task !== undefined)
             this.resolveEditedTaskRefs(run);
         if (archived !== undefined)
@@ -2798,7 +3079,7 @@ export class RunStore extends EventEmitter {
             run.referencedPullRequestUrl = resolveReferencedRef(run.referencedPrCandidates, run.task, referencedPrDeclaration(run), this.repoHandle);
         }
         if (run.referencedIssueCandidates !== undefined) {
-            run.referencedIssueUrl = resolveReferencedRef(run.referencedIssueCandidates, run.task, run.markerRefs?.issue, this.repoHandle);
+            run.referencedIssueUrl = resolveIssueReference(run, this.repoHandle);
             const number = refUrlNumber(run.referencedIssueUrl);
             if (run.referencedIssueNumberSeeded) {
                 // We may change only the number this janitor owns, including clearing an ambiguous one.
@@ -2893,6 +3174,123 @@ export class RunStore extends EventEmitter {
         run.costUsd = run.steps.some((step) => step.costUsd !== undefined) ? cost : undefined;
         this.touch(run);
     }
+    listArchiveOnMergeCandidates(afterSeq = 0, limit = 32) {
+        return this.db?.listArchiveOnMergeCandidates(afterSeq, limit) ?? [];
+    }
+    /** Use unnormalized persisted evidence: cold reads must not turn interrupted work into safety. */
+    archiveFamily(id, isActive) {
+        const ids = [id, ...new Set([...(this.db?.listIdsByParent(id) ?? []), ...this.listWorkersOf(id).map(run => run.id)])];
+        if (ids.length > 1025)
+            return undefined;
+        const family = [];
+        const block = (message, runId = id) => { this.setArchiveBlocker(id, { message, runId }); return undefined; };
+        for (const memberId of ids) {
+            const row = this.db?.get(memberId);
+            const raw = row ? JSON.parse(row.data) : this.held.get(memberId);
+            const decoded = decodeRunRow(JSON.stringify(raw));
+            if (!decoded)
+                return block('Task history is unavailable. Open the task or archive it manually.', memberId);
+            // Do not let the runtime schema's per-entry salvage hide malformed PR authority.
+            if (raw && typeof raw === 'object' && 'pullRequests' in raw &&
+                (!Array.isArray(raw.pullRequests) || raw.pullRequests.some(entry => !runPullRequestSchema.safeParse(entry).success)))
+                return block('PR associations are invalid. Check the task PRs or archive manually.', memberId);
+            const run = this.held.get(memberId) ?? decoded.run;
+            if (row && !this.held.has(memberId))
+                this.decodeCold(row); // records the synchronous write fence
+            if (this.deleted.has(memberId) || this.quarantined.has(memberId) || this.writeRefusal(memberId))
+                return block('Task history is owned elsewhere or cannot be changed. Retry after its owner stops.', memberId);
+            if (this.pins.has(memberId) || isActive(memberId) || isLiveRecord(run) || row?.live ||
+                !['review', 'done', 'failed', 'cancelled'].includes(run.status))
+                return block('Task work is still active. Wait for it to finish or archive manually.', memberId);
+            if (run.waits?.some(wait => wait.kind === 'human' && wait.phase === 'open') || run.hasPendingPermission)
+                return block('Task needs an answer or permission. Open it to respond, or archive manually.', memberId);
+            if (run.delegation?.role === 'invalid')
+                return block('Worker ownership is invalid. Inspect the task or archive manually.', memberId);
+            const facts = this.facts.peek(memberId);
+            if (!facts || facts.pendingAsk !== undefined)
+                return block('Task has an unanswered question or unread history. Open it to respond, or archive manually.', memberId);
+            if (run.delegation?.role === 'worker' && this.readWorkerExecution(memberId)?.phase !== 'complete')
+                return block('Worker execution has not settled. Open the worker or archive manually.', memberId);
+            // Process and scratch cleanup evidence protects deletion, not reversible filing.
+            family.push(run);
+        }
+        if (family[0]?.delegation?.role === 'worker' || family[0]?.archived)
+            return undefined;
+        return family;
+    }
+    /** Blockers are feedback, never archive authority or cleanup permission. */
+    setArchiveBlocker(id, blocker) {
+        const run = this.record(id);
+        if (!run || run.archived || isDeepStrictEqual(run.archiveBlocker, blocker))
+            return;
+        this.commitIndex(new Map([[id, { ...run, archiveBlocker: blocker }]]));
+    }
+    archiveMergeBlocker(snapshot, missing, repoBase) {
+        const url = `https://github.com/${missing.owner}/${missing.repo}/pull/${missing.number}`;
+        const family = [snapshot.rootId, ...(this.db?.listIdsByParent(snapshot.rootId) ?? [])].flatMap(id => {
+            const run = this.peek(id);
+            return run ? [run] : [];
+        });
+        const member = family.find(run => archivePullRequests([run], repoBase)?.some(pr => pullRequestKey(pr) === pullRequestKey(missing)));
+        this.setArchiveBlocker(snapshot.rootId, { message: `PR ${missing.owner}/${missing.repo}#${missing.number} is not confirmed merged. Check the PR association or archive manually.`,
+            runId: member?.id ?? snapshot.rootId, pullRequestUrl: url });
+    }
+    hasArchiveOnMergeAssociations(id) {
+        return this.db?.archiveFamilyHasPullRequests(id) ?? false;
+    }
+    async prepareArchiveOnMerge(id) {
+        const ids = [id, ...(this.db?.listIdsByParent(id) ?? [])];
+        if (ids.length > 1025)
+            return;
+        for (const memberId of ids)
+            await this.facts.ready(memberId);
+    }
+    archiveOnMergeSnapshot(id, repoBase, isActive = () => false) {
+        const family = this.archiveFamily(id, isActive);
+        if (!family)
+            return undefined;
+        return this.archiveSnapshot(family, repoBase);
+    }
+    archiveSnapshot(family, repoBase) {
+        const pullRequests = archivePullRequests(family, repoBase);
+        if (!pullRequests) {
+            this.setArchiveBlocker(family[0].id, { message: 'PR associations cannot be resolved. Check task and worker PRs, or archive manually.' });
+            return undefined;
+        }
+        const fingerprint = archiveDigest(pullRequests);
+        if (family[0].autoArchive?.fingerprint === fingerprint)
+            return undefined;
+        return { rootId: family[0].id, fingerprint, pullRequests, token: archiveDigest(family.map(({ archiveBlocker: _blocker, ...run }) => run)) };
+    }
+    /** No await between final revalidation and the fenced, all-or-nothing cascade. */
+    archiveAfterMerge(snapshot, observations, repoBase, isActive = () => false) {
+        const family = this.archiveFamily(snapshot.rootId, isActive);
+        if (!family)
+            return false;
+        const current = this.archiveSnapshot(family, repoBase);
+        if (!current || current.token !== snapshot.token || current.fingerprint !== snapshot.fingerprint)
+            return false;
+        const parsed = observations.map(observation => mergedPullRequestSchema.safeParse(observation));
+        if (parsed.some(result => !result.success))
+            return false;
+        const merged = parsed.flatMap(result => result.success ? [result.data] : []);
+        const byKey = new Map(merged.map(pr => [pullRequestKey(pr), pr]));
+        if (byKey.size !== current.pullRequests.length || current.pullRequests.some(pr => !byKey.has(pullRequestKey(pr))))
+            return false;
+        const restoredAt = Math.max(0, ...family.map(run => run.manualUnarchivedAt ? Date.parse(run.manualUnarchivedAt) : 0));
+        if (restoredAt && merged.every(pr => Date.parse(pr.mergedAt) <= restoredAt))
+            return false;
+        const now = new Date().toISOString();
+        if (merged.some(pr => Date.parse(pr.mergedAt) > Date.parse(now)))
+            return false;
+        const staged = new Map();
+        this.stageArchive(staged, family[0], true);
+        staged.get(snapshot.rootId).autoArchive = { reason: 'pull-requests-merged', archivedAt: now, fingerprint: current.fingerprint, pullRequests: merged };
+        this.commitIndex(staged);
+        for (const id of staged.keys())
+            this.compressor.enqueue(id);
+        return true;
+    }
     setArchived(id, archived) {
         const run = this.record(id);
         if (!run)
@@ -2902,30 +3300,23 @@ export class RunStore extends EventEmitter {
     }
     /** Parent + owned workers; returns how many records flipped `archived`. */
     applyArchivedCascade(run, archived) {
+        const staged = new Map();
+        this.stageArchive(staged, run, archived);
         let changed = 0;
-        if (this.applyArchived(run, archived))
-            changed++;
-        // Owned workers nest under their parent only while both share Active/Archived (#250).
-        // Cascade from the parent only — archiving one worker stays independent.
-        if (run.delegation?.role !== 'worker') {
-            for (const { id } of this.listWorkersOf(run.id)) {
-                const child = this.record(id);
-                if (child && this.applyArchived(child, archived))
-                    changed++;
-            }
+        for (const [id, next] of staged) {
+            if (next && this.peek(id)?.archived !== archived)
+                changed++;
+            if (next)
+                next.completionAction = undefined; // an explicit filing/restoration retires pending work
         }
+        this.commitIndex(staged);
         return changed;
     }
     applyArchived(run, archived) {
         const changed = run.archived !== archived;
         // Transcript first: a restore throw aborts with the record unchanged (#818 S3).
         this.syncTranscriptForm(run.id, archived);
-        run.archived = archived;
-        run.archivedAt = archived ? new Date().toISOString() : undefined;
-        if (archived) {
-            clearPendingAutoResume(run);
-            clearPin(run);
-        }
+        archiveFields(run, archived, new Date().toISOString());
         this.touch(run);
         return changed;
     }
@@ -3021,17 +3412,18 @@ export class RunStore extends EventEmitter {
     /** Bulk-archive finished runs (#780). `isSweepable` decides which; `archived` counts every
      *  record that flipped (cascaded workers included), `ids` lists the top-level runs picked and
      *  `pinnedIds` the subset that carried a pin before `clearPin` dropped it. */
-    archiveFinished(scope) {
+    archiveFinished(scope, automation) {
         let archived = 0;
         // Snapshot first: cascade may archive still-live workers, mutating the held set, and the pin
         // has to be read before `applyArchived` clears it. Runs not in memory are picked off their
         // stored summary, which carries every field `isSweepable` reads.
-        const picked = [...this.held.values()].filter((run) => isSweepable(run, scope)).map((run) => [run, this.listOrder(run)]);
+        const picked = [...this.held.values()].filter((run) => isSweepable({ ...run, automationId: automationIdOf(run) }, scope, automation))
+            .map((run) => [run, this.listOrder(run)]);
         for (const row of this.db?.listWhere("archived = 0 AND status IN ('done', 'failed', 'cancelled') AND parent_run_id IS NULL") ?? []) {
             if (this.held.has(row.id) || this.deleted.has(row.id))
                 continue;
             const summary = parseStoredSummary(row.summary);
-            if (summary && isSweepable(summary, scope))
+            if (summary && isSweepable(summary, scope, automation))
                 picked.push([summary, row]);
         }
         // Another process's runs are not this store's to archive (#779, plan step 3): they stay out.
@@ -3082,31 +3474,13 @@ export class RunStore extends EventEmitter {
         this.touch(run);
         return run;
     }
-    /** Bulk mark-read: stamp every currently-unread finished run; returns the count.
-     *  "Unread" here is the same rule the cockpit paints (`isUnread` in read-state.ts),
-     *  clause for clause:
-     *   - a `done` or `failed` run that finished and has not been seen since;
-     *   - cancelled runs are never unread — you stopped them yourself;
-     *   - archived ones never are either, since archiving is a stronger "done with this"
-     *     than reading;
-     *   - and a `failed` run with a pending `autoResumeAt` is not a done item AT ALL
-     *     (`isScheduledResume`, spec 2026-08-03-auto-resume-after-usage-limit): it has an
-     *     appointment to pick the work back up, so there is no outcome to have missed.
-     *
-     *  Keeping the two rules identical is what makes the returned count the number the
-     *  cockpit's unread badge was showing. The `autoResumeAt` clause is the one that drifted
-     *  (#803): `isUnread` gained it with auto-resume and this sweep did not, so a task waiting
-     *  out a usage limit was uncounted by the badge but stamped read by the sweep — and this
-     *  comment asserted an invariant the code no longer held.
-     *
-     *  This rule lives in two languages of the same repo, which is why it has now drifted
-     *  once. The cockpit cannot import it (`packages/web` does not depend on the service, and
-     *  should not), so a single definition would have to move to `packages/contract` — the one
-     *  package both sides already import. Worth doing; deliberately not done here, because
-     *  widening the contract package's remit from "shapes" to "behavior" is a design change
-     *  that deserves its own review rather than riding along in a bug fix. Until then: EDIT
-     *  BOTH, and the case-table tests on either side are what catch you if you don't. */
-    markAllRead() {
+    /**
+     * Stamp unread finished runs in bulk and return the count. Keep the rule aligned with cockpit
+     * isUnread: done/failed, finished since seen, not archived; cancelled and usage-limit waiting
+     * runs are excluded. `automation` narrows it to one origin, as in `archiveFinished`
+     * (hearsay-tools/cezarion#1616); absent stamps both.
+     */
+    markAllRead(automation) {
         const now = new Date().toISOString();
         let count = 0;
         // Runs not in memory are picked by the same rule over their stored summary, then re-checked
@@ -3123,11 +3497,12 @@ export class RunStore extends EventEmitter {
         for (const run of candidates) {
             const unread = !run.archived &&
                 (run.status === 'done' || run.status === 'failed') &&
-                !(run.status === 'failed' && run.autoResumeAt !== undefined) &&
                 run.finishedAt !== undefined &&
                 (run.seenAt === undefined || run.seenAt < run.finishedAt);
             if (!unread)
                 continue;
+            if (automation !== undefined && (automationIdOf(run) !== undefined) !== automation)
+                continue;
             run.seenAt = now;
             this.touch(run);
             count++;
@@ -3146,7 +3521,7 @@ export class RunStore extends EventEmitter {
         // Scrub credentials before the event touches disk or the live wire (#427):
         // tool-result output is persisted verbatim and served back over the API, so
         // a secret in an agent's command output would otherwise land in `.ai/cezar/`.
-        const full = this.redact({ ...event, seq, ts: new Date().toISOString() });
+        const full = this.redact(defined({ ...event, seq, ts: new Date().toISOString() }));
         // Sync append keeps event order without a write queue; local NDJSON
         // appends at agent-event rates are effectively free.
         if (!hasPlainHistory(this.dataDir, runId))
@@ -3155,9 +3530,7 @@ export class RunStore extends EventEmitter {
         appendFileSync(this.eventsPath(runId), line, 'utf8');
         this.facts.append(runId, full, Buffer.byteLength(line));
         this.maybeEnqueueHistoryCompress(run);
-        if ((full.type === 'ask.requested' || full.type === 'human-input-delivered') &&
-            this.syncHumanAskSummary(run))
-            this.touch(run);
+        this.liveItems.observe(runId, full, false);
         this.emit('event', { runId, event: full });
         // The janitor trick: agents print the PR URL after `gh pr create` — the
         // first one spotted in the transcript becomes the run's PR link. Scans v1
@@ -3174,23 +3547,31 @@ export class RunStore extends EventEmitter {
         const claim = eventCreationClaimFragments(full).join(' ');
         if (haystack.length > 0) {
             let changed = false;
-            if (!run.pullRequestUrl) {
-                const created = CREATED_PR_RE.test(claim) ? createdPrUrl(`${claim} ${haystack}`) : undefined;
-                if (created) {
-                    this.updateRun(runId, { pullRequestUrl: created });
-                    // Adopting the created tier can RELEASE a declaration the referenced tier was holding
-                    // (see `referencedPrDeclaration`), so re-resolve here too: the about-PR must come back
-                    // whether the marker arrived before the creation evidence or after it.
-                    const resolved = resolveReferencedRef(run.referencedPrCandidates ?? [], run.task, referencedPrDeclaration(run), this.repoHandle);
-                    if (resolved !== run.referencedPullRequestUrl) {
-                        run.referencedPullRequestUrl = resolved;
-                        changed = true;
-                    }
+            // One associated URL per trusted creation claim; replayed v1/v2 reports merge by identity.
+            const item = full.item;
+            const toolOutput = item?.kind === 'tool' && typeof item.output === 'string' ? item.output : undefined;
+            const created = createdPrUrls(claim, haystack, toolOutput);
+            for (const url of created) {
+                const number = refUrlNumber(url);
+                const parsed = runPullRequestSchema.safeParse({ number, url, source: 'created' });
+                if (!parsed.success)
+                    continue;
+                changed = this.accumulatePullRequests(run, [parsed.data]) || changed;
+                if (!run.pullRequestUrl) {
+                    run.pullRequestUrl = url;
+                    changed = true;
                 }
-                else if (PR_URL_RE.test(haystack) && this.trackReferencedPrs(run, haystack)) {
+            }
+            if (created.length > 0) {
+                const resolved = resolveReferencedRef(run.referencedPrCandidates ?? [], run.task, referencedPrDeclaration(run), this.repoHandle);
+                if (resolved !== run.referencedPullRequestUrl) {
+                    run.referencedPullRequestUrl = resolved;
                     changed = true;
                 }
             }
+            else if (!run.pullRequestUrl && PR_URL_RE.test(haystack) && this.trackReferencedPrs(run, haystack)) {
+                changed = true;
+            }
             // Issue links feed their own referenced tier regardless of PR state —
             // a task that created a PR can still be ABOUT an issue
             // (spec 2026-07-21-report-ref-discovery).
@@ -3242,7 +3623,7 @@ export class RunStore extends EventEmitter {
         if (candidatesChanged)
             run.referencedIssueCandidates = [...seen];
         const prev = run.referencedIssueUrl;
-        run.referencedIssueUrl = resolveReferencedRef(run.referencedIssueCandidates ?? [], run.task, run.markerRefs?.issue, this.repoHandle);
+        run.referencedIssueUrl = resolveIssueReference(run, this.repoHandle);
         let numberChanged = false;
         if (run.markerRefs?.issue === undefined && ISSUE_URL_RE.test(seedHaystack)) {
             if (run.referencedIssueUrl && run.issueNumber === undefined) {
@@ -3266,7 +3647,7 @@ export class RunStore extends EventEmitter {
     /**
      * Apply agent-declared reference markers (spec 2026-07-18-task-ref-markers).
      * Marker values are authoritative for the display tier: they overwrite the
-     * regex/namer numbers, and a declared PR re-resolves the referenced URL
+     * regex/namer numbers unless the prompt identifies the originating issue, and a declared PR re-resolves the referenced URL
      * against the candidate working set — including down to `undefined` when no
      * candidate matches (a wrong chip is worse than no chip). The created tier
      * (`pullRequestUrl`) is deliberately untouched.
@@ -3279,6 +3660,17 @@ export class RunStore extends EventEmitter {
         const run = this.record(runId);
         if (!run || (refs.pr === undefined && refs.issue === undefined))
             return run;
+        const numbers = [...new Set([...(run.markerRefs?.pr === undefined ? [] : [run.markerRefs.pr]),
+                ...(refs.prs ?? (refs.pr === undefined ? [] : [refs.pr]))])];
+        if (numbers.length)
+            this.accumulatePullRequests(run, numbers.flatMap((number) => {
+                const matches = (run.referencedPrCandidates ?? []).filter((url) => refUrlNumber(url) === number &&
+                    (this.repoHandle ? isRepoScopedRef(url, run.task, this.repoHandle) : promptNamesRepo(url, run.task)));
+                const url = matches.length === 1 ? matches[0] : matches.length === 0 && this.repoHandle
+                    ? `https://github.com/${this.repoHandle.owner}/${this.repoHandle.name}/pull/${number}` : undefined;
+                const parsed = runPullRequestSchema.safeParse({ number, ...(url ? { url } : {}), source: 'declared' });
+                return parsed.success ? [parsed.data] : [];
+            }));
         run.markerRefs = {
             ...run.markerRefs,
             ...(refs.pr !== undefined ? { pr: refs.pr } : {}),
@@ -3291,28 +3683,53 @@ export class RunStore extends EventEmitter {
             run.prNumber = refs.pr;
         }
         if (refs.issue !== undefined) {
-            run.issueNumber = refs.issue;
+            run.issueNumber = originatingIssue(run) ?? refs.issue;
             delete run.referencedIssueNumberSeeded;
         }
         if (run.markerRefs.pr !== undefined) {
             run.referencedPullRequestUrl = resolveReferencedRef(run.referencedPrCandidates ?? [], run.task, referencedPrDeclaration(run), this.repoHandle);
         }
         if (run.markerRefs.issue !== undefined) {
-            run.referencedIssueUrl = resolveReferencedRef(run.referencedIssueCandidates ?? [], run.task, run.markerRefs.issue, this.repoHandle);
+            run.referencedIssueUrl = resolveIssueReference(run, this.repoHandle);
         }
         this.touch(run);
         return run;
     }
+    /** Authoritative creation keeps the first scalar for publishing, plus every created identity. */
+    recordCreatedPr(runId, url) {
+        const run = this.record(runId);
+        const parsed = runPullRequestSchema.safeParse({ number: refUrlNumber(url), url, source: 'created' });
+        if (!run || !parsed.success)
+            return run;
+        let changed = this.accumulatePullRequests(run, [parsed.data]);
+        if (!run.pullRequestUrl) {
+            run.pullRequestUrl = url;
+            changed = true;
+        }
+        if (changed)
+            this.touch(run);
+        return run;
+    }
+    accumulatePullRequests(run, entries) {
+        const next = mergePullRequests(run.pullRequests, entries, this.repoHandle
+            ? `https://github.com/${this.repoHandle.owner}/${this.repoHandle.name}` : undefined);
+        if (isDeepStrictEqual(next, run.pullRequests))
+            return false;
+        run.pullRequests = next;
+        return true;
+    }
     /**
      * Fan an event out to live subscribers WITHOUT writing it to the NDJSON
      * file — the channel for coalesced `item.delta` flushes (protocol-v2
      * performance guardrail: raw deltas never hit disk; replay = the persisted
      * snapshots). Stamped with `seq`/`ts` like persisted lines so the live
-     * wire keeps one ordering axis; the seq simply never appears in a replay
-     * (gaps are fine — dedup compares with `>`).
+     * wire keeps one ordering axis. Finite polling coalesces active item content
+     * into bounded in-memory snapshots on that clock; disk replay still has gaps
+     * (dedup compares with `>`).
      */
     emitEphemeral(runId, event) {
         const full = this.redact({ ...event, seq: this.nextSeq(runId), ts: new Date().toISOString() });
+        this.liveItems.observe(runId, full, true);
         this.emit('event', { runId, event: full });
         return full;
     }
@@ -3350,19 +3767,89 @@ export class RunStore extends EventEmitter {
     transcriptFacts(runId) {
         return this.facts.get(runId) ?? emptyFacts();
     }
+    /** The run's transcript facts when they are known: undefined when the transcript exists but its
+     *  facts are not current or cannot be read, so a caller can tell "no ask" from "no evidence". */
+    knownTranscriptFacts(runId) {
+        return this.facts.peek(runId);
+    }
     hasProjection(runId, projectionId) {
         return this.transcriptFacts(runId).projectionIds.includes(projectionId);
     }
     factsWarming = Promise.resolve();
-    /** After open, build the indexes the delegation reconcile will ask for first, off the request
-     *  path: every member of every family with a conversation (#880). */
+    /** Indexed family enumeration, including members not yet flushed to SQLite. */
+    listFamilyRunIds(rootId) {
+        const ids = new Set([rootId, ...(this.db?.listIdsByParent(rootId) ?? [])]);
+        for (const [id, run] of this.held) {
+            if (familyRootOf(run) === rootId)
+                ids.add(id);
+            else if (id !== rootId)
+                ids.delete(id);
+        }
+        for (const id of this.deleted)
+            ids.delete(id);
+        return [...ids];
+    }
+    recoveryFactIds(familyRootId) {
+        if (familyRootId !== undefined)
+            return this.listFamilyRunIds(familyRootId);
+        const ids = new Set();
+        for (const [id, run] of this.held) {
+            if (!isLiveRecord(run))
+                continue;
+            const root = familyRootOf(run);
+            for (const member of root === undefined ? [id] : this.listFamilyRunIds(root))
+                ids.add(member);
+        }
+        return [...ids];
+    }
+    /** Readiness owns no run snapshot across an await: refresh only the currently held owner. */
+    async prepareTranscriptFacts(runIds) {
+        for (const id of new Set(runIds)) {
+            // Exact sidecars resolve immediately too: recovery must yield to timers/I/O between IDs.
+            await new Promise(resolve => setImmediate(resolve));
+            await this.facts.ready(id);
+        }
+    }
+    prepareRecoveryFacts(familyRootId) {
+        return this.prepareTranscriptFacts(this.recoveryFactIds(familyRootId));
+    }
+    /** Register IDs only here; the index yields between cache reads and off-loop rebuilds. */
     warmTranscriptFacts() {
-        // A microtask, not a timer: open returns first, and no timer outlives a store that never warms.
-        this.factsWarming = Promise.resolve().then(() => {
-            const ids = [];
-            for (const rootId of this.listConversationRootIds())
-                ids.push(rootId, ...(this.db?.listIdsByParent(rootId) ?? []));
-            return this.facts.warm(ids);
+        this.factsWarming = Promise.resolve().then(async () => {
+            if (!this.db)
+                return;
+            const ids = new Set(this.recoveryFactIds());
+            // hearsay-tools/cezarion#949: this microtask ends open()'s synchronous slice, and on a
+            // large history the JSON scan for conversation roots plus one family query per root cost
+            // as much again. Past one slice's worth of runs, yield before the scan and between root
+            // batches; a small store (every unit test) still registers in this one microtask.
+            const large = this.listRunIds().length > WARM_IDS_PER_SLICE;
+            const turn = async () => {
+                await new Promise(resolve => setImmediate(resolve));
+                return this.db !== null;
+            };
+            if (large && !await turn())
+                return;
+            const roots = this.listConversationRootIds();
+            for (let i = 0; i < roots.length; i++) {
+                if (large && i > 0 && i % WARM_IDS_PER_SLICE === 0 && !await turn())
+                    return;
+                for (const id of this.listFamilyRunIds(roots[i]))
+                    ids.add(id);
+            }
+            if (large && !await turn())
+                return;
+            // Re-list after the yields: a run deleted meanwhile must not be registered again.
+            const present = this.listRunIds();
+            if (large) {
+                const live = new Set(present);
+                for (const id of ids)
+                    if (!live.has(id))
+                        ids.delete(id);
+            }
+            for (const id of present)
+                ids.add(id);
+            await this.facts.warm(ids);
         }).catch(() => undefined);
     }
     /** Resolves when the open-time warm-up is done (tests). */
@@ -3379,18 +3866,6 @@ export class RunStore extends EventEmitter {
             return [];
         }
     }
-    /** The owned store's `refreshHumanAskSummary`, from the index, on the same rules: no history
-     *  (legacy runs) keeps the summary, an unreadable one requests attention. True when it changed. */
-    syncHumanAskSummary(run) {
-        const facts = this.facts.get(run.id);
-        const next = !facts ? true
-            : facts.bytes > 0 || facts.archive !== undefined ? facts.pendingAsk !== undefined
-                : run.hasPendingHumanAsk === true;
-        if (next === run.hasPendingHumanAsk)
-            return false;
-        run.hasPendingHumanAsk = next;
-        return true;
-    }
     readEvents(runId) {
         try {
             const raw = readHistoryText(this.dataDir, runId);
@@ -3498,6 +3973,8 @@ export class RunStore extends EventEmitter {
     }
     /** `workerResourcesSafe` with the refusal's live PIDs (empty when no PID explains it). */
     workerResourceHolders(id, generation, resourceId, opts = {}) {
+        if (autosaveCleanupBlocker(this.dataDir, id))
+            return [];
         const run = this.peek(id);
         const proof = this.readWorkerExecution(id);
         if (run?.delegation?.role !== 'worker' || run.delegation.workspace.ownerRunId !== id ||
@@ -3540,6 +4017,8 @@ export class RunStore extends EventEmitter {
     /** Cleanup can outlive its index row, but never its generation or terminal task intent.
      * `cwds` is the scratch reprobe tick's shared `/proc` snapshot (hearsay-tools/cezarion#879). */
     workerScratchResourcesSafe(id, generation, resourceId, cwds) {
+        if (autosaveCleanupBlocker(this.dataDir, id))
+            return false;
         const run = this.peek(id), proof = this.readWorkerExecution(id);
         if (proof?.phase !== 'complete' || proof.generation !== generation || proof.scratchCleanup?.resourceId !== resourceId ||
             (run && ['queued', 'running', 'waiting'].includes(run.status)))
@@ -3726,6 +4205,8 @@ export class RunStore extends EventEmitter {
         return proof?.phase === 'complete';
     }
     canDeleteRun(id) {
+        if (autosaveCleanupBlocker(this.dataDir, id))
+            return false;
         const run = this.peek(id);
         if (run?.delegation?.role === 'invalid')
             return false;
@@ -3821,6 +4302,7 @@ export class RunStore extends EventEmitter {
         rmSync(this.handoffPath(id), { force: true });
         rmSync(this.imagesDir(id), { recursive: true, force: true });
         removeArtifacts(this.dataDir, id);
+        clearAutosaveCleanup(this.dataDir, id);
     }
     deleteRun(id) {
         if (!this.canDeleteRun(id))
@@ -3830,6 +4312,8 @@ export class RunStore extends EventEmitter {
             return false;
         if (run?.delegation?.role === 'worker' || run?.delegation?.role === 'root')
             return this.deleteDelegatedRun(id);
+        if (run)
+            clearAutosaveCleanup(this.dataDir, id);
         const existed = run !== undefined;
         this.held.delete(id);
         if (existed) {
@@ -3891,6 +4375,7 @@ export class RunStore extends EventEmitter {
     /** The held record is gone; the next save or commit deletes its row, fenced by `family`'s claim
      *  and by the revision this store last saw (kept in `base` until the delete is written). */
     markDeleted(id, family) {
+        this.liveItems.forget(id);
         const read = this.coldBase.get(id);
         if (!this.base.has(id) && read)
             this.base.set(id, storedRow(read));
@@ -3989,7 +4474,10 @@ export class RunStore extends EventEmitter {
         const encode = (run) => {
             const encoded = encodeRawRecord(run, (this.base.get(run.id) ?? this.coldBase.get(run.id))?.extras);
             extras.set(run.id, encoded.extras);
-            upserts.push(encodeRunRow(run, encoded.data));
+            const projected = { ...run };
+            restoreOriginatingIssue(projected);
+            upserts.push({ ...encodeRunRow(run, encoded.data),
+                issueAttributionCurrent: isDeepStrictEqual(projected, run) });
         };
         for (const [id, next] of staged) {
             if (next)
@@ -4043,6 +4531,7 @@ export class RunStore extends EventEmitter {
             this.base.set(row.id, { revision: commit.revisions.get(row.id), seq: commit.seqs.get(row.id), data: row.data, extras: extras.get(row.id) });
         }
         for (const id of deletes) {
+            this.liveItems.forget(id);
             this.base.delete(id);
             this.deletedFamilies.delete(id);
             this.removeOwedHistory(id);
@@ -4068,23 +4557,9 @@ export class RunStore extends EventEmitter {
         return { owner: this.owner, claims, rows };
     }
     /**
-     * A fenced write found rows that changed under this store (#779, plan step 3); the write itself
-     * has already failed with nothing changed, and its caller sees that error.
-     *
-     * A conflict is UNEXPECTED when this store owned the row's family when it last read or wrote it:
-     * a held or pending row, or one read inside a family it claimed. Another writer then broke the
-     * claim. For each such row the original (what this store last saw), local (what it meant to
-     * write, or that it meant to delete it) and current versions go to `run_conflicts` first. Only
-     * once that evidence is stored does the row leave the pending set, so no retry rewrites it; this
-     * store then refuses to write it again, and its held copy is replaced by the current row (or
-     * dropped when deleted) and announced. That refusal lasts as long as this store: the explicit
-     * recovery is a restart, which reads the row as it now stands, and the evidence row stays for a
-     * person to compare. Other pending rows stay pending and the next save writes them.
-     *
-     * If the evidence cannot be stored, nothing changes: the rows stay pending, and the next write
-     * meets the same conflict and tries again. A row read before its family was claimed may simply
-     * have been finished by its previous owner in between: a stale read, not a conflict, so only the
-     * write fails.
+     * Handle a fenced-write conflict. Save unexpected conflict evidence before clearing pending
+     * state or quarantining the row. If evidence persistence fails, retain pending writes. Other
+     * rows remain writable; stale unclaimed reads only fail their write.
      */
     handleConflicts(error, staged) {
         const unexpected = error.conflicts.filter((conflict) => this.held.has(conflict.id) || this.deleted.has(conflict.id) || this.coldBase.get(conflict.id)?.owned === true);
@@ -4111,6 +4586,7 @@ export class RunStore extends EventEmitter {
         }
         unexpected.forEach((conflict, index) => {
             const family = this.familyOf(conflict.id);
+            this.liveItems.forget(conflict.id);
             this.quarantined.add(conflict.id);
             this.dirty.delete(conflict.id);
             this.deleted.delete(conflict.id);
@@ -4174,6 +4650,9 @@ export class RunStore extends EventEmitter {
      * absent. It saves nothing more, and a durable commit on it throws.
      */
     close() {
+        this.liveItems.clear();
+        // Demand-bound feeds stop before storage disappears during project removal/shutdown.
+        this.emit('closed');
         this.compressor.stop();
         this.facts.stop();
         this.facts.flush();
@@ -4198,4 +4677,17 @@ export class RunStore extends EventEmitter {
         this.db = null;
     }
 }
+function archiveDigest(value) {
+    return createHash('sha256').update(JSON.stringify(value)).digest('hex');
+}
+function archiveFields(run, archived, now) {
+    run.archived = archived;
+    run.archivedAt = archived ? now : undefined;
+    if (archived) {
+        clearPendingAutoResume(run);
+        clearPin(run);
+    }
+    else
+        run.manualUnarchivedAt = now;
+}
 //# sourceMappingURL=store.js.map