@wjarka/cezarion 0.16.0 → 0.17.0

package/dist/server/server.js

@@ -1,20 +1,54 @@
-import { sidebarLimitsSchema } from '../contract/index.js';
-import { worktreeSetupConfigSchema } from '../contract/index.js';
-import { ARCHIVED_RUNS_PAGE_DEFAULT, RUNS_SEARCH_PER_PROJECT_MAX, archivedRunsQuerySchema, runSummariesQuerySchema, runsSearchQuerySchema } from '../contract/index.js';
-import { automationKindSchema, automationScheduleSchema, localTimeZone, nextOccurrence } from '../contract/index.js';
+import { automationCreateSchema, automationUpdateSchema, automationCheckRequestSchema, automationLogQuerySchema } from '../contract/index.js';
+import { providerConnectSchema, createAgentProfileSchema, openAgentAccountFileSchema, updateAgentProfileSchema, selectAgentProfileSchema, providerEnabledSchema, providerRetrySchema, providerRouteParamsSchema, agentProfileRouteParamsSchema } from '../contract/index.js';
+import { planSchema, parseWorkflowSchema } from '../contract/index.js';
+import { uiStateBody } from '../contract/index.js';
+import { queuedMessagePatchSchema, continueSchema, archiveSchema, openInSchema } from '../contract/index.js';
+import { refreshQuery, waitQuery, modelDiscoveryQuerySchema, strictRefreshQuerySchema, browseQuerySchema, worktreeFilesQuerySchema } from '../contract/index.js';
+import { mergeNumberParams, prChangesParams, prChangesQuery, mergeBodySchema } from '../contract/index.js';
+import { gitCommitSchema, reclaimBodySchema, repoBranchSchema } from '../contract/index.js';
+import { setConfigSchema, setAgentConfigSchema } from '../contract/index.js';
+import { saveWorkflowInputSchema as saveWorkflowSchema } from '../contract/index.js';
+import { patchRunInputSchema as patchRunSchema, messageInputSchema as messageSchema } from '../contract/index.js';
+import { checkoutProjectInputSchema as checkoutSchema, registerProjectInputSchema as registerProjectSchema } from '../contract/index.js';
+import { setWorkspaceConfigInputSchema as workspaceConfigUpdateSchema } from '../contract/index.js';
+import { reclaimRunParamsSchema } from '../contract/index.js';
+import { githubChecksQuerySchema } from '../contract/index.js';
+import { githubRefsQuerySchema } from '../contract/index.js';
+import { commitQuerySchema } from '../contract/index.js';
+import { imageMimeType } from '../contract/index.js';
+import { providerForActiveRun } from '../contract/index.js';
+import { defined } from '../core/defined.js';
+import { ArchiveOnMergeCoordinator } from './archive-on-merge.js';
+import { CompletionActionCoordinator } from './completion-actions.js';
+import { discoverRepoHandle, lookupMergedPullRequests } from './forge/github.js';
+import { resolveArchiveOnMerge, resolveGlobalArchiveOnMerge } from '../archive-on-merge-setting.js';
+import { permissionDecisionSchema } from '../contract/index.js';
+import { runIdParamSchema as permissionRunIdParamSchema } from '../contract/index.js';
+import { autosaveCleanupBlocker } from '../autosave-cleanup.js';
+import { CheckoutProgressCache } from './checkout-progress.js';
+import { checkoutProgressParamsSchema, createProjectInputSchema } from '../contract/index.js';
+import { createLiveRoutes } from './live-routes.js';
+import { subscribeRunFeed } from './run-event-feed.js';
+import { ARCHIVED_RUNS_PAGE_DEFAULT } from '../contract/index.js';
+import { RUNS_SEARCH_PER_PROJECT_MAX, archivedRunsQuerySchema, runSummariesQuerySchema, runsSearchQuerySchema } from '../contract/index.js';
+import { automationListQuerySchema } from '../contract/index.js';
+import { localTimeZone } from '../contract/index.js';
 import { DelegationService } from '../delegation/service.js';
 import { workerCapacity } from '../delegation/capacity.js';
 import { delegationFailure } from '../delegation/routes.js';
-import { githubItemParamsSchema, CLIENT_REQUEST_VARIANTS_ERROR, workerEmptyRequestSchema, runRelationshipsSchema } from '../contract/index.js';
+import { githubItemParamsSchema } from '../contract/index.js';
+import { createRunInputSchema } from '../contract/index.js';
+import { workerEmptyRequestSchema, runRelationshipsSchema } from '../contract/index.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
-import { AutomationStore } from '../automations/store.js';
+import { createAutomationService, onceCreateAnswer } from '../automations/service.js';
+import { createAutomationToolService } from '../automations/tool-adapter.js';
 import { AutomationCoordinator } from '../automations/coordinator.js';
-import { GithubPoller } from '../automations/github-poller.js';
+import { AutomationCandidateChangedError, GithubPoller } from '../automations/github-poller.js';
 import { ProjectAutomationScheduler, WorkspaceAutomationScheduler } from '../automations/scheduler.js';
 import { AutomationProjectUnavailableError, SCHEDULE_LEASE_HELD_REASON, ScheduleRunner } from '../automations/schedule-runner.js';
-import { launchAutomationRun, launchScheduledRun, rebaselineIdleAutomations, reconcileAutomationReceipts, validateAutomationPrompt, } from '../automations/task-template.js';
-import { automationEventSchema, automationFiltersSchema, automationLogResultSchema, automationTaskSchema, isGithubAutomation, isScheduleAutomation, } from '../automations/types.js';
+import { launchAutomationRun, launchScheduledRun, rebaselineIdleAutomations, reconcileAutomationReceipts, } from '../automations/task-template.js';
+import { isGithubAutomation, isScheduleAutomation, } from '../automations/types.js';
 import { access, constants as fsConstants, mkdir, readFile, realpath, stat, unlink, writeFile } from 'node:fs/promises';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -24,35 +58,40 @@ import { bodyLimit } from 'hono/body-limit';
 import { streamSSE } from 'hono/streaming';
 import { matchedRoutes } from 'hono/route';
 import { jsonZodValidator, paramZodValidator, queryZodValidator } from './validators.js';
-import { deliverOnce, TaskWebhooks } from '../runs/webhook.js';
+import { RecentVoiceActions } from '../voice/decision-log.js';
+import { selectVoiceEngine } from '../voice/engine.js';
+import { createVoiceRoutes } from '../voice/routes.js';
+import { deliverOnce, registryEntry, sendAgentReport, TaskWebhooks } from '../runs/webhook.js';
 import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
 import { z } from 'zod';
-import { repoPullInputSchema, deleteBranchesInputSchema, pinRunInputSchema, archiveFinishedRequestSchema, notifyRunInputSchema, githubSearchQuerySchema, githubProjectsQuerySchema, setWorkspaceUiStateInputSchema, } from '../contract/index.js';
+import { repoPullInputSchema, deleteBranchesInputSchema } from '../contract/index.js';
+import { pinRunInputSchema, archiveFinishedRequestSchema, markAllReadRequestSchema, notifyRunInputSchema, } from '../contract/index.js';
+import { githubSearchQuerySchema, githubProjectsQuerySchema, githubListQuerySchema, githubCommentCountsQuerySchema, } from '../contract/index.js';
+import { setWorkspaceUiStateInputSchema } from '../contract/index.js';
 // A contract VALUE, like `workspaceUiStateSchema` in workspace/migrations.ts — the request
 // schema this route validates with is the same one the client compiles against.
-import { MODEL_DISCOVERY_RUNNERS, attachmentInputSchema, attachmentFileParamSchema, modelDiscoveryRunnerSchema, openProjectInSchema, runnerDiscoversModels, updateProjectInputSchema, } from '../contract/index.js';
+import { MODEL_DISCOVERY_RUNNERS, openProjectInSchema, } from '../contract/index.js';
+import { attachmentFileParamSchema, } from '../contract/index.js';
+import { agentWebhookParamsSchema, createProjectWebhookInputSchema, projectWebhookParamsSchema, sendAgentReportInputSchema, updateProjectInputSchema, updateProjectWebhookInputSchema, } from '../contract/index.js';
+import { PROJECT_WEBHOOKS_MAX } from '../contract/index.js';
+import { agentWebhook, agentWebhooks, applyTaskWebhookInput, createdWebhook, editedWebhook, nameTaken, projectWebhooks, redactWebhook, setProjectWebhooks, taskWebhooks as taskWebhookList, } from '../workspace/webhooks.js';
 import { detectEnvironment } from '../core/backend-detect.js';
-import { RUNNER_IDS } from '../core/agent-runner.js';
 import { AGENT_MODELS_LOCKED_ERROR, agentModelsLocked } from '../core/agent-model-policy.js';
-import { hostModelCatalogAdapters } from '../core/host-model-catalog.js';
-import { PROVIDER_IDS, ProviderAuthService, providerAuthChecksDisabled, } from '../core/provider-auth.js';
+import { PROVIDER_IDS, } from '../core/provider-auth.js';
 import { applyProviderEnablement } from '../core/provider-availability.js';
-import { RunnerModelCatalog } from '../core/runner-model-catalog.js';
 import { currentUsage, onUsage } from '../core/process-usage.js';
 import { WORKFLOWS_DIR, loadWorkflows } from '../workflows/load.js';
-import { QUICK_TASK_WORKFLOW, normalizeWorkflowDoc, plannedWorkflow, skillStackOf, skillsToSteps, stepsIssue, workflowFileSchema, workflowStepSchema, } from '../workflows/types.js';
+import { normalizeWorkflowDoc, skillStackOf, skillsToSteps, stepsIssue, workflowFileSchema, } from '../workflows/types.js';
 import { planChain, slugify } from '../planner.js';
 import { discoverSkills } from '../skills.js';
-import { SkillsUpdateConflictError, SkillsUpdateCoordinator, SkillsUpdateService } from '../skills-update.js';
 import { getTeamSkillsCached, refreshTeamSkills, waitForTeamSkills } from '../skills-remote.js';
-import { appendHandoffHeartbeat, handoffProgressExcerpt, readHandoff } from '../handoff.js';
-import { markStarted, onTodosChanged, readTodos, removeTodo, todoTaskText } from '../todos.js';
+import { readHandoff, renderHandoffRecords } from '../handoff.js';
 import { ARCHIVED_WINDOW } from '../runs/store.js';
-import { HistoryCursorError, deriveRunContextEvents, readEventsAfterLiveCursor, readRunHistoryPage, validateLiveCursor, } from '../runs/event-history.js';
+import { HistoryCursorError, deriveRunContextEvents, readRunHistoryPage, validateLiveCursor, } from '../runs/event-history.js';
 import { readRunIndexFromDisk, searchRunIndexFromDisk } from '../runs/run-index.js';
 import { workerDestroyView } from '../runs/delegation-state.js';
-import { searchTokens } from '../runs/run-search.js';
-import { clientRequestHash } from '../runs/client-request.js';
+import { searchTokens } from '../contract/index.js';
+import { ownPullRequestNumbers } from '../runs/pull-requests.js';
 import { ColdRepoHandles } from './cold-repo-handles.js';
 import { isV2WireEventType } from '../runs/ui-event-sink.js';
 import { runEventsQuerySchema, runHistoryQuerySchema, runIdParamSchema, } from '../contract/index.js';
@@ -61,14 +100,14 @@ import { artifactParamsSchema, fileLinkQuerySchema } from '../contract/index.js'
 import { artifactDirectory, listArtifacts, readArtifact } from '../artifacts/store.js';
 import { artifactPreview, loadFileLink, rasterMime } from '../artifacts/resolve.js';
 import { isUntouchedCancelledRun, toPastedContent } from '../workflows/run.js';
-import { worktreeDiff, worktreeDiffStat, worktreeSizeBytes } from '../git-worktree.js';
+import { worktreeDiff, worktreeSizeBytes } from '../git-worktree.js';
 import { releaseThenRemoveWorktree } from '../git-worktree-release.js';
 import { isReclaimable, reclaimWorktree, reclaimWorktrees, rematerializeReclaimedWorktree, selectReclaimableWorktrees } from '../runs/retention.js';
-import { getBranches, getCommit, getDiff, getLogWithParents, getRepoInfo, getStatus, getTracking } from './git.js';
+import { getBranches, getCommit, getDiff, getLogWithParents, getBranchHead, getRepoInfo, getStatus, getTracking } from './git.js';
 import { attributeLog, deleteBranches, forgetRepoBranches, githubBranchForge, readRepoBranches } from './repo-branches.js';
 import { claimRepoGitMutation, localPullBranches, pullRepoCheckout } from './repo-pull.js';
-import { collectChanges, collectCommitChanges, collectRunCommits, commitAll, createOrSwitchBranch, imageMimeType, isOsOpenableImage, pushCurrentBranch, readWorktreePath, } from './git-changes.js';
-import { gatedSkillsRepos, loadConfig, resolveWorktreeRetention } from '../config.js';
+import { collectChanges, collectCommitChanges, collectRunCommits, commitAll, createOrSwitchBranch, pushCurrentBranch, readWorktreePath, } from './git-changes.js';
+import { loadConfig, resolveWorktreeRetention } from '../config.js';
 import { resolveWorktreeSetup } from '../worktree-setup.js';
 import { findConfigFile } from '../agent-config/catalog.js';
 import { readConfigFile, statConfigPath, writeConfigFile } from '../agent-config/files.js';
@@ -76,76 +115,47 @@ import { readAgentModelDefaults } from '../agent-config/models.js';
 import { listAgentConfig } from '../agent-config/service.js';
 import { listConfigFiles } from '../agent-config/catalog.js';
 import { readAccountIdentity } from '../agent-config/account-identity.js';
-import { PROJECT_ID_RE, defaultWorkspaceConfig, effectiveSkillsAutoUpdate, loadWorkspaceConfig, mergeWriteWorkspaceConfig, effectiveComposerDefault, } from '../workspace/config.js';
+import { PROJECT_ID_RE, defaultWorkspaceConfig, loadWorkspaceConfig, mergeWriteWorkspaceConfig, effectiveComposerDefault, } from '../workspace/config.js';
 import { CONTROL_CHARS_RE, DEFAULT_AGENT_ACCOUNT_ID, defaultAgentAccountStore, isAbsoluteConfigDir, loadAgentAccounts, mergeWriteAgentAccounts, } from '../workspace/agent-accounts.js';
-import { defaultAgentProfile, listAgentProfiles, profileDirState, resolveProfileEnvForRoot, resolveStoredProfile, sameProfileDir, } from '../workspace/agent-profiles.js';
-import { PROFILE_CAPABLE_PROVIDERS, profileEnv, supportsProfiles } from '../core/agent-profiles.js';
+import { defaultAgentProfile, listAgentProfiles, namedAccountUnavailable, ompProfileDirError, profileDirState, resolveStoredProfile, sameProfileDir, } from '../workspace/agent-profiles.js';
+import { PROFILE_CAPABLE_PROVIDERS, profileAgentDir, profileEnv, supportsProfiles } from '../core/agent-profiles.js';
 import { quoteExecutable, withEnvPrefix } from '../core/shell-env.js';
 import { resolveCursorExecutable } from '../core/cursor-model-catalog.js';
 import { resolveOmpExecutable } from '../core/omp-model-catalog.js';
 import { allocateProjectSlug, listProjects, normalizeProjectTags, probeProjectStatus, toProjectListEntry, registerProject, removeProject, shouldRegisterProject, } from '../workspace/projects.js';
 import { mergeWriteWorkspaceUiState, readWorkspaceUiState } from '../workspace/ui-state.js';
 import { checkoutRepo } from './checkout.js';
-import { armPreview, ProjectContextError, ProjectContexts, sweepRegisteredPreviewLeftovers } from './project-context.js';
-import { reviewGateEnabled } from '../runs/review-gate.js';
-import { readUiState, uiStatePath } from '../ui-state.js';
+import { createProject, listGithubOwners } from './create-project.js';
+import { armPreview, ProjectContextError, ProjectContexts, projectWarmupEnabled, sweepRegisteredPreviewLeftovers } from './project-context.js';
+import { readProjectUiState, readUiState, writeProjectUiState } from '../ui-state.js';
 import { agentHomePaths, expandTilde } from '../paths.js';
 import { isLoopbackHostHeader, normalizeHostname, resolveCapabilities } from './capabilities.js';
 import { applicationUpdateInputSchema } from '../contract/index.js';
 import { ApplicationUpdateConflictError, ApplicationUpdateFailureError } from '../application-update/service.js';
 import { createSocketHub, socketHubRoute } from './ws.js';
 import { attachUpgradeRouter } from './upgrade-router.js';
-import { createPreviewSocket } from './preview-socket.js';
+import { createPreviewSockets } from './preview-sockets.js';
 import { browseDirectory, isInsideBrowseRoot, isLexicallyInsideBrowseRoot, resolveBrowseRoot } from './fs-browse.js';
-import { parseRemote, resolveForge } from './forge/index.js';
-import { fetchGithub, fetchGithubProjects, fetchGithubChecks, fetchGithubComments, fetchGithubItem, forgetGithubItem, fetchGithubPrDiff, fetchGithubRefStatus, forgetRefStatus, readCachedRefStatuses, refNumberFromUrl, searchGithubItems, GithubPrNotFoundError, GH_CHECKS_MAX, GH_REF_STATUS_MAX } from './github.js';
-import { ensureLaunchKey } from './launch-key.js';
+import { parseRemote, resolveForge, forgeWebRoot } from './forge/index.js';
+import { fetchGithub, fetchGithubProjects, fetchGithubChecks, fetchGithubCommentCounts, fetchGithubComments, fetchGithubItem, forgetGithubItem, fetchGithubPrDiff, fetchGithubRefStatus, forgetRefStatus, readCachedRefStatuses, refNumberFromUrl, searchGithubItems, GithubPrNotFoundError, GH_CHECKS_MAX, GH_REF_STATUS_MAX } from './github.js';
 import { CockpitAlreadyRunningError } from './cockpit-ownership.js';
 import { RunStoreOpenError } from '../runs/store-open-error.js';
-import { openInTerminal } from './open-in-terminal.js';
-import { agentCliRunner, detectOpenTargets, openFileInDefaultApp, openInApp } from './open-in-app.js';
+import { openRunApp, openRunCli, openRunDefaultApp } from './open-in-targets.js';
+import { agentCliRunner, detectOpenTargets } from './open-in-app.js';
 import { createDraftPr } from './pr.js';
 import { ProviderRuntimeAuthObserver } from './provider-auth-runtime.js';
-import { providerForActiveRun, providerForExistingRun, providersRequiredByWorkflow, unavailableProviderMessage, } from './provider-action-gate.js';
+import { providerForExistingRun, providersRequiredByWorkflow, } from './provider-action-gate.js';
+import { attachProjectWebhooks, createBootContext, createProviderStatus, resolveServerDeps, watchProviderRuntimeAuth, } from './server-deps.js';
+import { NO_WEBHOOK_ERROR, agentProfileRefusal, clientRequestOf, launchRun, modelLockRefusal, notifyRefusal, providerGateRefusal, replayedRun, resolveStartWorkflow, startRunInput, } from './start-run-options.js';
 import { ASSET_CACHE_CONTROL, BUILD_HINT_HTML, assetContentType, isSafeAssetFilename, resolveGetRequest, } from './static-ui.js';
 /** `projectId` gate at the route boundary (spec "Project identity"): the slug
  *  shape or the reserved `default` alias — validated BEFORE touching any map
  *  or path. (`default` matches the slug regex too; the literal keeps the
  *  contract explicit.) */
 const projectIdSchema = z.union([z.literal('default'), z.string().regex(PROJECT_ID_RE)]);
-const providerConnectSchema = z.object({
-    provider: z.enum(PROVIDER_IDS),
-    /** Which agent account to sign in (spec 2026-07-29-agent-profiles). Absent = the discovered
-     *  default, which is what every pre-profiles client sends. Without this, "Connect" on a second
-     *  Claude account would open a login for the FIRST one and report success. */
-    profileId: z.string().max(64).optional(),
-}).strict();
-/** Agent-account bodies (spec 2026-07-29-agent-profiles). Bounds mirror `agentProfileSchema` in
- *  src/workspace/config.ts exactly, so a value these accept can never be degraded away by the
- *  next load's `.catch`. The id is allocated server-side and is never a request field. */
-const createAgentProfileSchema = z.object({
-    provider: z.enum(PROVIDER_IDS),
-    label: z.string().trim().max(200).optional(),
-    configDir: z.string().trim().min(1).max(4096),
-}).strict();
-/** `POST …/agent-profiles/:id/open` — a catalog id (or `folder`) plus an optional open target. */
-const openAgentAccountFileSchema = z.object({
-    file: z.string().min(1).max(200),
-    target: z.string().min(1).max(64).optional(),
-}).strict();
-const updateAgentProfileSchema = z.object({
-    label: z.string().trim().max(200).optional(),
-    configDir: z.string().trim().min(1).max(4096).optional(),
-}).strict().refine((value) => value.label !== undefined || value.configDir !== undefined, 'send label or configDir');
-/** `PUT …/agent-profiles/selection` — which account a project uses for one provider. `null`
- *  clears it back to the discovered account. */
-const selectAgentProfileSchema = z.object({
-    /** `null` targets the machine-wide default rather than one repo. */
-    projectId: z.string().min(1).max(64).nullable(),
-    provider: z.enum(PROVIDER_IDS),
-    profileId: z.string().max(64).nullable(),
-}).strict();
 /** The hosted-mode refusal, worded like the agent-config one it mirrors. */
+const HOSTED_GITHUB_CREATE_REFUSAL = 'Creating GitHub repositories is available from a local cockpit only';
+const HOSTED_GITHUB_OWNERS_REASON = 'GitHub repositories can be created from a local cockpit only';
 const hostedProfileRefusal = {
     error: 'agent accounts are managed from the machine that owns the checkout (this cockpit runs in hosted mode)',
 };
@@ -161,107 +171,6 @@ function allocateAgentProfileId(source, taken) {
     // `^[a-z0-9][a-z0-9-]{0,63}$` shape, so `~/.claude-klaudiusz` slugs to `claude-klaudiusz`.
     return allocateProjectSlug(source, taken);
 }
-const providerParamSchema = z.enum(PROVIDER_IDS);
-const providerEnabledSchema = z.object({ enabled: z.boolean() }).strict();
-const providerRetrySchema = z.object({
-    authFailureId: z.string().min(1).max(128),
-}).strict();
-/**
- * The editable body of both kinds. Every kind-specific key is optional here because which ones a
- * body must (or must not) carry depends on the kind, and on `PUT` the kind is the STORED one when
- * the body omits it — `resolveAutomationKind` below owns those rules.
- */
-const automationEditableSchema = z
-    .object({
-    name: z.string().trim().min(1).max(200),
-    description: z.string().max(2_000).optional(),
-    enabled: z.boolean().optional(),
-    kind: automationKindSchema.optional(),
-    events: z.array(automationEventSchema).min(1).max(4).optional(),
-    intervalSeconds: z.number().int().min(60).max(86_400).optional(),
-    filters: automationFiltersSchema.optional(),
-    schedule: automationScheduleSchema.optional(),
-    task: automationTaskSchema,
-})
-    .strict();
-const automationCreateSchema = automationEditableSchema.extend({ enable: z.boolean().optional() });
-const automationUpdateSchema = automationEditableSchema.extend({ expectedRevision: z.number().int().positive() });
-const automationCheckRequestSchema = z.object({ mode: z.enum(['preview', 'execute']) }).strict();
-const automationLogQuerySchema = z.object({
-    automationId: z.string().optional(),
-    result: automationLogResultSchema.optional(),
-    event: automationEventSchema.optional(),
-    since: z.string().datetime().optional(),
-    cursor: z.coerce.number().int().positive().optional(),
-    // Optional, not `.default(100)`: `AutomationStore.logs` already clamps `limit ?? 100` into
-    // 1..100, so the default here was a second copy of it — and a defaulted key is REQUIRED in the
-    // request type `queryZodValidator` publishes (see validators.ts on why the request side falls
-    // back to the schema's output), which would have made every caller send a `?limit=` this route
-    // never needed.
-    limit: z.coerce.number().int().min(1).max(100).optional(),
-});
-/** enable/pause carry no client revision, so a conflict is a race inside the write: 409, never 500. */
-function toggleFailure(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message === 'automation not found')
-        return { error: 'not found', status: 404 };
-    if (message === 'automation revision conflict')
-        return { error: 'the automation changed elsewhere; reload and try again', status: 409 };
-    throw error;
-}
-function editableAutomation(definition) {
-    return {
-        name: definition.name,
-        description: definition.description,
-        enabled: definition.enabled,
-        kind: definition.kind,
-        ...(definition.events ? { events: definition.events } : {}),
-        ...(definition.intervalSeconds !== undefined ? { intervalSeconds: definition.intervalSeconds } : {}),
-        ...(definition.filters ? { filters: definition.filters } : {}),
-        ...(definition.schedule ? { schedule: definition.schedule } : {}),
-        task: definition.task,
-    };
-}
-/**
- * Which kind a create/update body is, and whether its keys fit it (spec
- * 2026-10-02-scheduled-automations § Data model). A body without `kind` is `github` on create —
- * every pre-schedule client — and the STORED kind on update, so an old client editing a schedule
- * edits a schedule. Changing the kind is refused: receipts and cursors are kind-specific.
- */
-function resolveAutomationKind(body, stored) {
-    const kind = body.kind ?? stored?.kind ?? 'github';
-    if (stored && kind !== stored.kind)
-        return { error: 'change the kind by creating a new automation', status: 409 };
-    if (kind === 'schedule') {
-        if (body.events !== undefined || body.intervalSeconds !== undefined || body.filters !== undefined) {
-            return { error: 'a scheduled automation has no GitHub filter', status: 400 };
-        }
-        if (!body.schedule)
-            return { error: 'a scheduled automation needs a schedule', status: 400 };
-    }
-    else {
-        if (body.schedule !== undefined)
-            return { error: 'a GitHub automation has no schedule', status: 400 };
-        if (!body.events || body.intervalSeconds === undefined || !body.filters) {
-            return { error: 'a GitHub automation needs events, intervalSeconds and filters', status: 400 };
-        }
-    }
-    return { kind };
-}
-function sameSchedule(a, b) {
-    return JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
-}
-/**
- * The `nextRunAt` a schedule definition arms with: its next occurrence from now when enabled,
- * cleared when paused. Passed to the store's `create`/`update` as `arm`, which writes it BEFORE
- * the definition, so another cockpit's timer never pairs the new definition with the old instant.
- */
-function armScheduleFromNow(definition) {
-    if (!isScheduleAutomation(definition))
-        return undefined;
-    const next = definition.enabled ? nextOccurrence(definition.schedule, Date.now(), localTimeZone()) : null;
-    return { nextRunAt: next === null ? undefined : new Date(next).toISOString() };
-}
 /**
  * The public API surface (spec 2026-07-23-independent-server-web-packages).
  *
@@ -296,8 +205,6 @@ export function projectRouteManifest(app) {
     }
     return manifest;
 }
-/** 409 body for the inbox mutators while the follow-up inbox is off (#471). */
-const FOLLOWUPS_OFF = 'the follow-up inbox is disabled — set CEZ_FOLLOWUPS=1 to enable it';
 /** 409 body for every automations route while GitHub automations are off (#801). */
 const AUTOMATIONS_OFF = 'Automations are disabled — set CEZ_AUTOMATIONS=1 to enable them';
 /** 404 body for a run whose row is in runs.db but whose record this cezar cannot decode (#779). */
@@ -336,243 +243,6 @@ const streamSSENoBuffer = (c, cb, onError) => {
     res.headers.set('X-Accel-Buffering', 'no');
     return res;
 };
-// A run starts from a named workflow OR an inline chain of steps (spec 008 —
-// the approved plan is posted as-is, never written to a file).
-const startRunSchema = z
-    .object({
-    workflow: z.string().min(1).optional(),
-    steps: z.array(workflowStepSchema).min(1).max(8).optional(),
-    // The primary agent prompt handed to the spawned runner. Bounded like the
-    // other prompt fields (`systemPrompt` 20k, message `text` 100k) so an
-    // unbounded body can't be piped into a spawned process (#429). 100k chars
-    // (~25k tokens) is well past any hand-written task.
-    task: z.string().min(1).max(100_000, 'must be at most 100000 characters'),
-    model: z.string().optional(),
-    // Reasoning-effort pin (#45). Omit for the harness default.
-    effort: z.string().max(32).optional(),
-    // Agent backend for this task (falls back to config `defaultRunner`).
-    runner: z.enum(RUNNER_IDS).optional(),
-    // Agent account for this task (spec 2026-07-29-agent-profiles). Falls back to the project's
-    // own selection, then the discovered default. Bounded like a profile id in the workspace
-    // schema, so a value this route accepts can never be degraded away by the next load.
-    agentProfile: z.string().max(64).optional(),
-    // Parallel variants (spec 010): ×2/×3 runs the task as 2–3 competing
-    // agents in separate worktrees; the user compares diffs and picks one.
-    variants: z.number().int().min(1).max(3).optional(),
-    // Composer worktree opt-out (#worktree-toggle): false runs in the repo
-    // working tree. Ignored when variants > 1.
-    worktree: z.boolean().optional(),
-    // Autonomous mode (#autonomous): the run never parks at `waiting` — it
-    // auto-continues until the agent signals done. No "needs you" is raised.
-    autonomous: z.boolean().optional(),
-    // Generate follow-up inbox entries (spec 007, #444). Honoured only while
-    // the `followups` capability is on (#471) — off, the server pins it to
-    // false whatever the client asked for. Omitted still means "enabled" for
-    // old clients, but only within an already-enabled server. The handoff
-    // journal is unaffected either way.
-    generateFollowups: z.boolean().optional(),
-    // Per-run system-prompt override (R2 2.3) — programmatic callers only
-    // (bookmarklets, scripts); deliberately NOT a composer-UI control. Wins
-    // over the config.json default; whitespace-only degrades to absent.
-    systemPrompt: z
-        .string()
-        .trim()
-        .max(20_000, 'must be at most 20000 characters')
-        .optional()
-        .transform((s) => (s ? s : undefined)),
-    // Attachments pasted into the new-task form — same shape and limits as a
-    // live-session message; delivered with the first agent step's opening.
-    images: z.array(attachmentInputSchema).max(4).optional(),
-    // Inbox follow-up (#374): the todo the composer was prefilled from
-    // (`/new?skill=&ref=&todo=t1`). On a successful start the entry is marked
-    // started — the same bookkeeping POST /api/todos/:id/start does, so the
-    // audit trail survives the composer detour. Bounded like every other
-    // string here; a todo id is a short generated key.
-    todoId: z.string().min(1).max(200, 'must be at most 200 characters').optional(),
-    // Idempotent start (#504): the same id and payload answer 200 with the existing run.
-    clientRequestId: z.string().uuid().optional(),
-    // Task webhook opt-in (#589). Absent = off; not part of the idempotency hash.
-    notify: z.boolean().optional(),
-})
-    .refine((b) => Boolean(b.workflow) !== Boolean(b.steps), {
-    message: 'provide either "workflow" or "steps", not both',
-})
-    .refine((b) => !(b.clientRequestId && (b.variants ?? 1) > 1), {
-    message: CLIENT_REQUEST_VARIANTS_ERROR,
-});
-const pickSchema = z.object({
-    runId: z.string().min(1),
-});
-const planSchema = z.object({
-    // Same bound as `startRunSchema.task` — this flows into `planChain` (#429).
-    task: z.string().trim().min(1).max(100_000, 'must be at most 100000 characters'),
-});
-// A saved workflow carries full `steps` OR the builder's `skills` stack
-// (spec 012). `overwrite: true` is the builder's Save on an existing file —
-// the GUI asks first; a plain POST still refuses to clobber.
-const saveWorkflowSchema = z
-    .object({
-    name: z.string().trim().min(1).max(80),
-    // Written into a YAML file on disk (#429) — a workflow description is a
-    // short blurb, so a 2k cap is generous without allowing a file-bloat write.
-    description: z.string().max(2_000, 'must be at most 2000 characters').optional(),
-    steps: z.array(workflowStepSchema).min(1).max(8).optional(),
-    skills: z.array(z.string().trim().min(1)).min(1).max(8).optional(),
-    overwrite: z.boolean().optional(),
-})
-    .refine((b) => Boolean(b.steps) !== Boolean(b.skills), {
-    message: 'provide either "steps" or "skills", not both',
-});
-const parseWorkflowSchema = z.object({
-    yaml: z.string().min(1).max(100_000),
-});
-// Small GUI preferences persisted in `.ai/cezar/ui-state.json` (files, not a
-// DB): today just the last-used task source, so the form preselects what you
-// actually run. Unknown keys pass through — future prefs won't need a schema
-// dance.
-/** Entry cap on the `skillUsage` map (#408). A real skill catalog is dozens of entries; this
- *  bounds the ui-state.json write without ever rejecting a legitimate one. */
-const SKILL_USAGE_MAX_ENTRIES = 200;
-// Belt-and-braces cap on the number of top-level ui-state keys so a
-// `.passthrough()` schema can't accumulate an unbounded key set (#429). Very
-// generous for GUI prefs; over-limit is a 400, never a silent strip. Shared by
-// BOTH ui-state routes (per-repo and workspace) via `parseUiStateBody`.
-const UI_STATE_MAX_KEYS = 200;
-/** Settings → Appearance (redesign R6): accent + density + reading width. ONE
- *  schema for both ui-state files — per-repo (the legacy home, kept so an older
- *  cezar in the same repo still honours it) and workspace
- *  (`~/.cezar/ui-state.json`, its post-migration home — multi-project spec,
- *  Data Model).
- *
- *  Every key is `.optional()` so an older ui-state.json parses unchanged, but
- *  each one must be listed HERE: the enclosing `workspaceUiStateSchema` is
- *  `.passthrough()` at the top level only, so an unlisted key inside
- *  `appearance` is stripped by zod and then wiped from the file by the shallow
- *  merge-on-write. The cockpit adopts the PUT response as authoritative, so a
- *  stripped key does not merely fail to persist — it visibly reverts the
- *  control the user just touched. Adding an appearance preference means adding
- *  it here in the same change. */
-const appearanceSchema = z.object({
-    accent: z.enum(['cezarion', 'lime', 'violet']).optional(),
-    density: z.enum(['comfortable', 'compact', 'ultra']).optional(),
-    width: z.enum(['narrow', 'wide']).optional(),
-});
-const uiStateSchema = z
-    .object({
-    sidebarLimits: sidebarLimitsSchema.optional(),
-    // `null` clears the recorded choice — the composer's "no skill, no workflow" state,
-    // which is a plain quick-task run. Written through to the file like any other value, so an
-    // older cockpit reading it falls back to its own default instead of restoring a stale skill.
-    lastTask: z
-        .object({
-        source: z.enum(['workflow', 'skill']),
-        ref: z.string().min(1).max(200),
-    })
-        .nullable()
-        .optional(),
-    // Composer picker recency (newest first, capped) + the remembered worktree
-    // choice for single-skill runs. Additive prefs, like the rest of ui-state.
-    recentSources: z
-        .array(z.object({
-        source: z.enum(['workflow', 'skill']),
-        ref: z.string().min(1).max(200),
-    }))
-        .max(50)
-        .optional(),
-    lastWorktree: z.boolean().optional(),
-    lastAutonomous: z.boolean().optional(),
-    lastGenerateFollowups: z.boolean().optional(),
-    // Skill selection frequency (#408): name → times chosen, incremented on a successful run
-    // start from EITHER composer (`/new`'s SourcePill and the follow-up `SkillsPicker`). Drives
-    // the shared `orderSkillsByUsage` sort (web/app/src/lib/skills.ts) so both pickers float the
-    // skills a user actually reaches for above the rest, within the existing project-first
-    // grouping. ADDITIVE, like the rest of ui-state — the client always PUTs the whole map
-    // because the top-level merge below is shallow.
-    //
-    // Bounded on all three axes (key length, value, entry count) like every neighbour here: this
-    // map is written straight to `ui-state.json`, which the cockpit GETs on every load and this
-    // route re-reads on every PUT, so an unbounded map is an unbounded file write. Keys are skill
-    // names (`.min(1).max(200)`, matching `lastTask.ref`); SKILL_USAGE_MAX_ENTRIES sits far above
-    // any real catalog while capping the file at a few tens of KB.
-    skillUsage: z
-        .record(z.string().min(1).max(200), z.number().int().min(0).max(1_000_000))
-        .refine((usage) => Object.keys(usage).length <= SKILL_USAGE_MAX_ENTRIES, {
-        message: `skillUsage must have at most ${SKILL_USAGE_MAX_ENTRIES} entries`,
-    })
-        .optional(),
-    // Runs area presentation (#348): the sidebar-list + detail pane, or the
-    // full-width table ("task manager") view.
-    runsView: z.enum(['list', 'table']).optional(),
-    // The GitHub tab's last-selected sub-tab (#417): issues or PRs. ADDITIVE — an old
-    // ui-state.json without the key behaves as the default (issues).
-    githubView: z.enum(['issues', 'prs']).optional(),
-    // Settings → Appearance (redesign R6): accent + density. ADDITIVE — the theme itself
-    // stays in the browser (`cez-theme` localStorage, pre-paint). The cockpit always PUTs
-    // the whole object because the top-level merge below is shallow.
-    appearance: appearanceSchema.optional(),
-    // Follow-up prompt templates (#413): reusable snippets insertable into the GitHub hand-over
-    // and Inbox follow-up composers. Absent → the client's built-in defaults; present (even `[]`)
-    // is the user's own edited list, from Settings → Prompt templates. Additive, like the rest of
-    // ui-state — the cockpit is the only writer, so validation stays generous but bounded.
-    promptTemplates: z
-        .array(z.object({
-        id: z.string().min(1).max(64),
-        label: z.string().trim().min(1).max(80),
-        text: z.string().trim().min(1).max(2000),
-        // Skill names this template auto-applies for. Optional and additive: templates
-        // written before this key existed keep validating, and stay manual-only.
-        skills: z.array(z.string().trim().min(1).max(200)).max(50).optional(),
-    }))
-        .max(50)
-        .optional(),
-    // Skills promo banner (#391): set once the cockpit banner is dismissed, never unset.
-    // Server-persisted (not a cookie) so the "shown once" promise holds across browsers.
-    // Retained for backward compatibility — the banner is gone, replaced by the workspace-level
-    // `importedSkills` curation (see `workspaceUiStateSchema`); `.passthrough()` would preserve
-    // the key regardless, but keep it typed.
-    dismissedSkillsBanner: z.boolean().optional(),
-})
-    .passthrough();
-// Editable titles (#389), and the initial prompt while the run is still queued
-// (#472 — rejected with 409 on any other status by the handler).
-const patchRunSchema = z.object({
-    title: z.string().trim().min(1).max(300).optional(),
-    task: z.string().trim().min(1).max(100_000).optional(),
-});
-// Session commit (redesign R5 — §"Git/session API additions").
-const gitCommitSchema = z.object({
-    message: z.string().trim().min(1, 'must not be empty').max(5_000),
-});
-// "Open in…" (#open-in / #365): `target` selects the app; `path` (optional, worktree-relative)
-// narrows the target's own worktree/repo-root default to one file — used by the diff pane's
-// "open in default app" action for images. Containment is re-checked server-side via
-// `readWorktreePath`; this schema only shapes the request.
-const openInSchema = z.object({
-    // A short bound (#429): matched against a downstream allowlist, so an editor id is never long.
-    target: z.string().trim().min(1, 'target required').max(200),
-    path: z.string().max(1_000).optional(),
-});
-// Attachment-carrying bodies validate with the CONTRACT's `attachmentInputSchema` (#950) —
-// images plus the short PDF/TXT/MD allowlist, 7,000,000 encoded characters each. Imported rather
-// than mirrored here, so the wire cannot drift from what the cockpit compiles against.
-const messageSchema = z
-    .object({
-    text: z.string().max(100_000).default(''),
-    images: z.array(attachmentInputSchema).max(4).default([]),
-})
-    .refine((m) => m.text.trim().length > 0 || m.images.length > 0, {
-    message: 'message needs text or at least one attachment',
-});
-// PATCH semantics are load-bearing here: an omitted field keeps its current value.
-// In particular, the cockpit edits text without re-uploading existing attachments.
-const queuedMessagePatchSchema = z
-    .object({
-    text: z.string().max(100_000).optional(),
-    images: z.array(attachmentInputSchema).max(4).optional(),
-})
-    .refine((m) => m.text !== undefined || m.images !== undefined, {
-    message: 'message edit needs text or attachments',
-});
 // Queued prompt stack bounds (#472). The per-message bounds mirror `messageSchema`
 // above; the one that actually matters is the FOLDED total, because 20 messages of
 // 100 000 chars each would otherwise compose a ~2 M-character {{task}}.
@@ -589,48 +259,6 @@ function foldedLength(task, stack) {
         .filter((part) => part.length > 0)
         .join('\n\n').length;
 }
-// "Continue"/"Send back" body (spec 003 / #401): every field optional, so an empty POST reopens
-// the last session on the run's current backend (backward compat). A runner/model/account override
-// lets the follow-up composer choose which engine handles the continuation. `text` stays bounded
-// like the live-session message `text` (#429), and `images` like a live-session message's — the
-// follow-up composer is a full composer, so a screenshot pasted into it must reach the reopened
-// session rather than being silently dropped.
-const continueSchema = z.object({
-    text: z.string().max(100_000, 'must be at most 100000 characters').optional(),
-    images: z.array(attachmentInputSchema).max(4).optional(),
-    runner: z.enum(RUNNER_IDS).optional(),
-    model: z.string().max(200).optional(),
-    /** Reasoning-effort pin (#45). Omitted keeps the run's pin; empty string clears it. */
-    effort: z.string().max(32).optional(),
-    /** Agent account for the reopened session (spec 2026-07-29-agent-profiles). Bound mirrors
-     *  `POST /runs`' own `agentProfile`. Omitted = keep the account the run is already on. */
-    agentProfile: z.string().max(64).optional(),
-});
-// Inbox "▶ Run" body (spec 007 / #401 / #413): every field optional, and the whole body is
-// optional too, so an empty POST — every client before the pills and the composer — starts on
-// the host's `defaultRunner` with no extra instructions, exactly as before. This is a START
-// path, not a continue: there is no prior backend to preserve, so an omitted `runner`/`model`
-// means "host default" rather than "keep what the run had". `prompt` (#413) is extra
-// instructions appended to the entry's suggested/summary task text; whitespace-only degrades to
-// absent so it never touches `task`.
-const startTodoSchema = z
-    .object({
-    runner: z.enum(RUNNER_IDS).optional(),
-    model: z.string().max(200).optional(),
-    effort: z.string().max(32).optional(),
-    prompt: z
-        .string()
-        .trim()
-        .max(20_000, 'must be at most 20000 characters')
-        .optional()
-        .transform((s) => (s ? s : undefined)),
-})
-    .optional();
-// `POST /api/runs/:id/archive` (#429) — no body archives; `{archived:false}`
-// un-archives. A tiny schema so the route follows the safeParse convention.
-const archiveSchema = z.object({
-    archived: z.boolean().optional(),
-});
 // Request-body size guards (#429). A generous global cap keeps a single
 // localhost request from being unbounded (the largest legit body is 4 pasted
 // images at ~7 MB base64 each); the ui-state PUT gets a much tighter cap since
@@ -647,47 +275,6 @@ function stripHostPort(host) {
         return bracketed[1];
     return host.replace(/:\d+$/, '');
 }
-/** The shared write-side half of BOTH ui-state routes (per-repo `/api/v1/ui-state`
- *  and workspace `/api/v1/workspace/ui-state`) — the factored split the
- *  multi-project spec calls for instead of a copy: the route's own schema, plus a
- *  cap on the top-level key count so a `.passthrough()` schema can't accumulate an
- *  unbounded key set (#429). The cap rides as a refinement so the whole thing is one
- *  schema and can go through `jsonBody` like every other mutating route. The
- *  merge-on-write stays with each route (they write different files) but is shallow
- *  in both. */
-function capUiStateKeys(data, ctx) {
-    if (Object.keys(data).length > UI_STATE_MAX_KEYS) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `ui-state has too many keys (max ${UI_STATE_MAX_KEYS})` });
-    }
-}
-// Derived once per route instead of by a generic `wrap(schema)` helper called at the route: a
-// generic wrapper leaves the schema type unresolved where `jsonBody` needs it, and Hono answers
-// that by dropping the whole PUT from the route schema rather than erroring — both ui-state PUTs
-// silently vanished from `AppType`. Concrete consts keep them visible to `hc`.
-const uiStateBody = uiStateSchema.superRefine(capUiStateKeys);
-/**
- * Query schemas for the READ routes — deliberately permissive.
- *
- * These exist to make a query key VISIBLE to the route type (`hc` refuses a `query` argument for
- * a key no validator declares), NOT to narrow what the route accepts. Every one of these handlers
- * compares `=== '1'` and treats everything else as false, so `?refresh=0` is a successful request
- * today; a literal schema would silently turn it into a 400. The comparison stays in the handler
- * and the validator stays out of its way.
- *
- * The one route that really is strict on the wire — `GET /github/prs/:number/changes`, which 400s
- * on `?refresh=true` — keeps its own `z.enum(['1'])` schema next to the route.
- */
-/**
- * One query value, matching what `c.req.query('k')` did before these routes were validated.
- *
- * Hono's query validator hands a REPEATED key as an array (`?wait=1&wait=1` → `['1','1']`), where
- * `c.req.query()` silently took the first. A plain `z.string()` therefore turns a request that
- * used to answer 200 into a 400 — a wire change no caller asked for. Collapsing to the first
- * value keeps the old behaviour, and the client still sees a plain `key?: string`.
- */
-const queryValue = z.union([z.string(), z.array(z.string()).transform((v) => v[0])]).optional();
-const refreshQuery = z.object({ refresh: queryValue });
-const waitQuery = z.object({ wait: queryValue });
 function parseAccept(header) {
     const ranges = [];
     for (const part of header.split(',')) {
@@ -775,62 +362,9 @@ export function createApp(deps) {
     // turns into a compile error instead.
     const bootRoot = deps.repoRoot;
     const bootDataDir = join(bootRoot, '.ai/cezar');
-    // One adapter per contract-advertised runner; the map is typed over `modelDiscoveryRunnerSchema`
-    // so a runner added to the contract without an adapter fails typecheck (AGENT_PROTOCOL.md §10).
-    const modelCatalog = deps.modelCatalog ?? new RunnerModelCatalog({ adapters: hostModelCatalogAdapters(bootRoot) });
-    const invalidateHostModels = (provider) => {
-        if (runnerDiscoversModels(provider))
-            modelCatalog.invalidate(provider);
-    };
-    const providerAuth = deps.providerAuth ?? new ProviderAuthService();
-    const workspaceConfig = deps.workspaceConfig ?? {
-        load: loadWorkspaceConfig,
-        mergeWrite: mergeWriteWorkspaceConfig,
-    };
-    const providerStatus = async (options) => {
-        if (providerAuthChecksDisabled()) {
-            return applyProviderEnablement(await providerAuth.status(options?.refresh ? { refresh: true } : undefined), []);
-        }
-        const [discovered, workspace] = await Promise.all([
-            providerAuth.status(options?.refresh ? { refresh: true } : undefined),
-            workspaceConfig.load(),
-        ]);
-        return applyProviderEnablement(discovered, workspace.disabledProviders);
-    };
-    /**
-     * The gate: why a run cannot start against `required`, or null when it can.
-     *
-     * VERIFY BEFORE YOU REFUSE. Auth state is served stale-while-revalidate (see
-     * `ProviderAuthService.status`), so a cached "disconnected" may predate a login cezar could not
-     * observe — someone running `claude auth login` in a terminal. Refusing on that would lock a user
-     * out of their own cockpit with no way back but waiting. So a believed-unavailable provider is
-     * re-probed, and only a refusal that survives the fresh answer is returned.
-     *
-     * The cost lands where it belongs: the common path (connected, warm) pays nothing at all, and the
-     * probe is only spawned when cezar is about to say no — a rare, interactive moment. This is also
-     * what lets the cache hold a negative for a minute instead of five seconds, which is what made
-     * every reader of `GET /providers/status` periodically pay for a CLI spawn.
-     *
-     * A runtime auth latch is deliberately NOT escaped by this: `withRuntimeFailures` keeps forcing
-     * the row disconnected until the user acknowledges that exact incident, so the re-probe cannot
-     * talk cezar out of a rejection it actually observed.
-     */
-    const providerActionError = async (required) => {
-        const known = await providerStatus();
-        const message = unavailableProviderMessage(required, known);
-        if (message === null)
-            return null;
-        // A DISABLED provider is a settings fact, not a probe result — re-probing it learns nothing and
-        // would spawn a CLI to re-read something the user typed.
-        const disabled = required.some((provider) => known.providers.find((row) => row.provider === provider)?.enabled === false);
-        if (disabled)
-            return message;
-        return unavailableProviderMessage(required, await providerStatus({ refresh: true }));
-    };
-    const openTerminal = deps.openTerminal ?? openInTerminal;
-    const openFile = deps.openFile ?? openFileInDefaultApp;
-    const openApp = deps.openApp ?? openInApp;
-    const skillsUpdate = deps.skillsUpdate ?? new SkillsUpdateService();
+    // The host-wide services and the provider closures built on them live in `./server-deps.ts`.
+    const { modelCatalog, providerAuth, workspaceConfig, openTerminal, openFile, openApp } = resolveServerDeps(deps, bootRoot);
+    const { providerStatus, providerActionError, invalidateHostModels } = createProviderStatus({ modelCatalog, providerAuth, workspaceConfig });
     // ---- workspace boot-project identity (multi-project spec) ----------------
     // The boot flow (`initWorkspace` in src/index.ts) registers the boot repo
     // and plumbs its registry id in via `deps.bootProjectId`. Legacy callers and
@@ -889,21 +423,8 @@ export function createApp(deps) {
     // and since step 2.3 the per-dataDir watch is created lazily by the first
     // SSE subscription (and torn down with the last), nothing to start here.
     // ---- project contexts (multi-project spec, step 2.2) ---------------------
-    // The boot project's context is SEEDED from the deps the caller already
-    // built (src/index.ts `serveCommand` did the recover/prune/launch-key work
-    // at startup — observable boot behavior unchanged); it never enters the
-    // lazy map, so its `.ai/cezar` state is never double-opened. `id` starts as
-    // the reserved alias when registration was suppressed — handlers never read
-    // it; API payloads name the boot project via `resolveBootProject` instead.
-    const bootContext = {
-        id: bootProjectId ?? 'default',
-        root: bootRoot,
-        dataDir: bootDataDir,
-        store: deps.store,
-        manager: deps.manager,
-        automationStore: deps.automationStore ?? AutomationStore.open(bootDataDir),
-        launchKey: ensureLaunchKey(bootDataDir), // bookmarklet auto-start secret (spec 011)
-    };
+    // The boot project's context is SEEDED from the deps the caller already built (`createBootContext`).
+    const bootContext = createBootContext(deps, bootRoot, bootDataDir);
     // The task webhook (#589): attached before any recovery — the boot store by `index.ts`, lazy
     // projects through `prepareManager` below. Attaching is idempotent, so the calls here only
     // cover an app built without boot's wiring (tests, embedded servers).
@@ -929,6 +450,8 @@ export function createApp(deps) {
     });
     // Workspace-level SSE bus (step 2.8) — the registry mutators and the
     // checkout flow (Phase 4) emit here; /api/workspace/events relays.
+    const serverGeneration = randomUUID();
+    const checkoutProgress = new CheckoutProgressCache();
     const workspaceEvents = deps.workspaceEvents ?? new WorkspaceEventBus();
     const emitAutomationChange = (project, automationId, revision, deleted = false) => workspaceEvents.emit('automation-change', {
         project: project.id,
@@ -941,61 +464,84 @@ export function createApp(deps) {
         ?? new ProviderRuntimeAuthObserver(providerAuth, (status) => {
             workspaceEvents.emit('provider-status', status);
         });
-    providerRuntimeAuth.watch(bootContext.store);
-    for (const id of contexts.ids()) {
-        const ctx = contexts.peek(id);
-        if (ctx)
-            providerRuntimeAuth.watch(ctx.store);
-    }
-    contexts.onStoreCreated((store) => providerRuntimeAuth.watch(store));
-    contexts.onContextBuilt((ctx) => providerRuntimeAuth.watch(ctx.store));
-    // Injected contexts (tests) skip `prepareManager`; attach those when they are built.
-    for (const id of contexts.ids()) {
-        const ctx = contexts.peek(id);
-        if (ctx)
-            taskWebhooks.attach(ctx);
-    }
-    contexts.onContextBuilt((ctx) => taskWebhooks.attach(ctx));
+    watchProviderRuntimeAuth(providerRuntimeAuth, bootContext, contexts);
+    attachProjectWebhooks(taskWebhooks, contexts);
+    // #667: recovery ran inside the build, before any workspace stream attached to this project's
+    // store, so the runs it resumed sent no `run` event. Until a cockpit refetches, its cross-project
+    // index keeps the cold read's answer: every run the restart interrupted, shown as failed.
+    contexts.onContextBuilt((ctx) => workspaceEvents.emit('project-ready', { project: ctx.id }));
     const projectRegistryEntry = async (projectId) => {
         const id = projectId === 'default' ? await resolveBootProject() : projectId;
         return (await loadWorkspaceConfig()).projects.find((entry) => entry.id === id);
     };
+    /** One `task.test` POST to `webhook`, or a dry run under `CEZ_DRY_RUN=1`. */
+    const sendTestDelivery = async (projectId, webhook) => {
+        if (process.env.CEZ_DRY_RUN === '1')
+            return { ok: true, dryRun: true };
+        const payload = {
+            event: 'task.test',
+            deliveryId: randomUUID(),
+            projectId,
+            webhook: { id: webhook.id, name: webhook.name },
+            occurredAt: new Date().toISOString(),
+        };
+        const result = await deliverOnce(webhook, payload, { fetch: deps.taskWebhookFetch });
+        return {
+            ok: result.ok,
+            ...(result.status === undefined ? {} : { status: result.status }),
+            ...(result.error === undefined ? {} : { error: result.error }),
+        };
+    };
+    /**
+     * Read-modify-write one project's webhook list (hearsay-tools/cezarion#1576), with the PATCH
+     * route's guards: single-project mode refuses, an unknown project 404s without a write, and a
+     * failed write (a read-only home) answers 500 having persisted nothing.
+     */
+    const editProjectWebhooks = async (raw, edit) => {
+        if (capabilities().singleProject)
+            return { ...singleProjectRefusal('editing projects'), status: 409 };
+        if (!projectIdSchema.safeParse(raw).success)
+            return { error: `unknown project: ${raw}`, status: 404 };
+        const id = raw === 'default' ? await resolveBootProject() : raw;
+        const known = await loadWorkspaceConfig().then((config) => config.projects.some((p) => p.id === id), () => false);
+        if (!known)
+            return { error: `unknown project: ${id}`, status: 404 };
+        let updated;
+        let outcome;
+        try {
+            await mergeWriteWorkspaceConfig((config) => {
+                const entry = config.projects.find((p) => p.id === id);
+                if (!entry)
+                    return;
+                outcome = edit([...projectWebhooks(entry)]);
+                if ('error' in outcome)
+                    return;
+                setProjectWebhooks(entry, outcome.webhooks);
+                updated = entry;
+            });
+        }
+        catch (err) {
+            return { error: err instanceof Error ? err.message : String(err), status: 500 };
+        }
+        if (outcome && 'error' in outcome)
+            return outcome;
+        if (!updated || !outcome)
+            return { error: `unknown project: ${id}`, status: 404 };
+        return {
+            body: {
+                project: toProjectListEntry(updated, await probeProjectStatus(updated.root)),
+                webhook: redactWebhook(outcome.webhook),
+            },
+        };
+    };
     const app = new Hono();
     // Reject oversized request bodies before they reach any handler (#429). GETs
     // and SSE carry no body, so this only ever gates the mutating routes.
     app.use('*', bodyLimit({ maxSize: GLOBAL_BODY_LIMIT }));
-    // ---- request-origin guard (#426) -----------------------------------------
-    // This server executes agents with shell access — "start a task" ≈ run code
-    // as the user — so "bind 127.0.0.1 + same-origin" is not a perimeter on its
-    // own: any page the user visits can still POST to us (CSRF), and DNS
-    // rebinding can point a foreign domain at loopback and read our responses.
-    // Two zero-config checks close both holes on every /api route EXCEPT
-    // /api/v1/health (the intentional cross-origin discovery endpoint, spec 011 —
-    // it exposes nothing sensitive, see #431):
-    //   1. Host allowlist (loopback deployments only) — a request whose Host is
-    //      not a loopback name did not really originate from this machine. A
-    //      rebound `evil.com` still sends `Host: evil.com`, so this kills DNS
-    //      rebinding for reads AND writes. Skipped in hosted mode (CEZ_REMOTE /
-    //      non-loopback bind), where the reverse proxy forwards the real public
-    //      Host and TLS+auth own the perimeter.
-    //      The match runs through `isLoopbackHostHeader`, whose 127.0.0.0/8 test
-    //      is *anchored* and whose missing-Host answer is "untrusted". Both are
-    //      load-bearing: a `startsWith('127.')` prefix would accept the
-    //      attacker-registrable `127.0.0.1.evil.com`, and such a page is really
-    //      same-origin with us, so checks 2 and 3 would wave it through too.
-    //   2. Same-origin write guard — a cross-origin write always carries an
-    //      `Origin` header (browsers attach it to every non-GET), so its full
-    //      authority (host AND port) must match the served Host. A blind CSRF
-    //      POST from evil.tld is rejected; the cockpit's own same-origin fetch
-    //      (Origin === Host, or no Origin at all for non-browser callers) passes
-    //      untouched. Works in both local and hosted mode because it compares
-    //      Origin to the actual Host.
-    // Scope note: check 2 covers writes only. A cross-origin GET from any site
-    // still reaches the read routes — but its Host is ours, so it is a *forced
-    // request*, not a read: the same-origin policy stops the attacker seeing any
-    // response body (we send CORS headers on /api/v1/health alone), and no GET
-    // handler mutates state. Rebinding, which WOULD make those reads legible, is
-    // what check 1 stops.
+    // Local APIs require a loopback Host, including health. Browser writes require
+    // matching full authority or the verified local dev-proxy case. Health alone is
+    // CORS-readable. Hosted mode delegates Host/auth policy to the deployment;
+    // absent Origin remains valid for native clients. Keep WS trust checks separate.
     const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
     const isHostedMode = () => !resolveCapabilities(process.env, bindHost).localHandoff;
     app.use('/api/*', async (c, next) => {
@@ -1055,17 +601,8 @@ export function createApp(deps) {
         }
         return next();
     });
-    // The mirrored project-route table (spec "API Contracts → Project-scoped").
-    // Every route below registers ONCE on this sub-app; `createApp` mounts it
-    // twice — under `/api/v1/p/:projectId` (scoped) and under `/api/v1` (bound to
-    // the boot project) — so both spellings share one handler and can never
-    // drift. The resolver middleware binds `c.get('project')`:
-    // no `projectId` param (unscoped mount) → the boot context, byte-identical to
-    // the pre-workspace closures; `default` or the boot project's own id → the
-    // boot context too; anything else → the lazy context map, with
-    // `ProjectContextError` mapped to 404 (unknown) / 409 (missing root).
-    // Named rather than inlined because both mounts share it — one function, so
-    // the two spellings can never disagree about what `default` means.
+    // Register project routes once; mount them under scoped and boot-alias prefixes.
+    // Resolve default and boot ids to the boot context; unknown/missing projects map to 404/409.
     if (deps.projectLookup) {
         deps.projectLookup.resolve = async (raw) => {
             if (raw === undefined || raw === 'default' || raw === (await resolveBootProject()))
@@ -1129,6 +666,12 @@ export function createApp(deps) {
             return c.json({ error: 'not found' }, 404);
         return new Response(readFileSync(path), { headers: { 'content-type': type } });
     };
+    // Stable SharedWorker identity across same-origin tabs; its imported chunks stay hashed.
+    app.get('/live-worker.js', (c) => {
+        const response = staticFile('live-worker.js', 'text/javascript; charset=utf-8')(c);
+        response.headers.set('Cache-Control', 'no-cache');
+        return response;
+    });
     let hintLogged = false;
     const serveShell = (c) => {
         const distIndex = join(distDir, 'index.html');
@@ -1435,6 +978,9 @@ export function createApp(deps) {
         for (const account of listAgentProfiles(store, PROVIDER_IDS)) {
             if (account.isDefault)
                 continue; // covered by `status()` above
+            // Probing it would sign in or report on another folder (#1283); its status route says why.
+            if (namedAccountUnavailable(account.provider, account.path) !== null)
+                continue;
             await providerAuth
                 .profileStatus(account.provider, { id: account.id, configDir: account.path })
                 .catch(() => { });
@@ -1450,7 +996,7 @@ export function createApp(deps) {
         // `modelDiscoveryRunnerSchema` is the contract's own list of the runners with an
         // authoritative host-local catalog (#794), so the client compiles against exactly what this
         // validates, including Claude stream-json discovery (#89).
-        .get('/models', queryZodValidator(z.object({ runner: z.union([z.string(), z.array(z.string()).transform((v) => v[0])]).pipe(modelDiscoveryRunnerSchema) }), { message: `runner must be ${MODEL_DISCOVERY_RUNNERS.slice(0, -1).join(', ')}, or ${MODEL_DISCOVERY_RUNNERS.at(-1)}` }), async (c) => {
+        .get('/models', queryZodValidator(modelDiscoveryQuerySchema, { message: `runner must be ${MODEL_DISCOVERY_RUNNERS.slice(0, -1).join(', ')}, or ${MODEL_DISCOVERY_RUNNERS.at(-1)}` }), async (c) => {
         const query = { data: c.req.valid('query') };
         return c.json(query.data.runner === 'cursor'
             ? modelCatalog.getCached('cursor')
@@ -1495,7 +1041,10 @@ export function createApp(deps) {
             return { error: `this session belongs to an account that no longer exists (${profileId})` };
         }
         const { profile } = resolved;
-        return { env: profile.isDefault ? {} : profileEnv(provider, profile.path) };
+        if (profile.isDefault)
+            return { env: {} };
+        const unavailable = namedAccountUnavailable(provider, profile.path);
+        return unavailable !== null ? { error: unavailable } : { env: profileEnv(provider, profile.path) };
     };
     /** The copy-paste fallback shown when no terminal could be opened — same account, spelled for
      *  this platform's shell. `null` when the dir cannot be embedded safely, which is a refusal. */
@@ -1514,7 +1063,7 @@ export function createApp(deps) {
     };
     // ---- chained family: agent providers (workspace-level) ----
     const providersRoutes = new Hono()
-        .get('/providers/status', queryZodValidator(z.object({ refresh: queryValue.refine((v) => v === undefined || v === '1') }), { message: 'refresh must be 1 when provided' }), async (c) => {
+        .get('/providers/status', queryZodValidator(strictRefreshQuerySchema, { message: 'refresh must be 1 when provided' }), async (c) => {
         const query = { data: c.req.valid('query') };
         const refresh = query.data.refresh === '1';
         if (refresh) {
@@ -1523,7 +1072,7 @@ export function createApp(deps) {
         }
         return c.json(await providerStatus({ refresh }));
     })
-        .put('/providers/:provider/enabled', paramZodValidator(z.object({ provider: providerParamSchema }), { message: 'provider and enabled boolean are required' }), jsonZodValidator(providerEnabledSchema, { message: 'provider and enabled boolean are required' }), async (c) => {
+        .put('/providers/:provider/enabled', paramZodValidator(providerRouteParamsSchema, { message: 'provider and enabled boolean are required' }), jsonZodValidator(providerEnabledSchema, { message: 'provider and enabled boolean are required' }), async (c) => {
         const provider = { data: c.req.valid('param').provider };
         const body = { data: c.req.valid('json') };
         let workspace;
@@ -1546,7 +1095,7 @@ export function createApp(deps) {
             workspaceEvents.emit('provider-status', row);
         return c.json(result);
     })
-        .post('/providers/:provider/retry', paramZodValidator(z.object({ provider: providerParamSchema }), { message: 'provider and current authFailureId are required' }), jsonZodValidator(providerRetrySchema, { message: 'provider and current authFailureId are required' }), async (c) => {
+        .post('/providers/:provider/retry', paramZodValidator(providerRouteParamsSchema, { message: 'provider and current authFailureId are required' }), jsonZodValidator(providerRetrySchema, { message: 'provider and current authFailureId are required' }), async (c) => {
         const provider = { data: c.req.valid('param').provider };
         const body = { data: c.req.valid('json') };
         if (!providerAuth.clearRuntimeAuthFailure(provider.data, body.data.authFailureId)) {
@@ -1581,6 +1130,10 @@ export function createApp(deps) {
         if ('error' in resolved)
             return c.json({ error: resolved.error }, 400);
         const { profile } = resolved;
+        // A login aimed at a folder the agent would not open signs in another account (#1283).
+        const unavailable = profile.isDefault ? null : namedAccountUnavailable(provider, profile.path);
+        if (unavailable !== null)
+            return c.json({ error: unavailable }, 409);
         const command = providerAuth.loginCommand(provider, profile.isDefault ? null : profile.path);
         // Fail closed: a config dir that cannot be embedded safely in this platform's shell has no
         // safe degradation. Running the bare command would sign the user into a DIFFERENT account
@@ -1655,6 +1208,10 @@ export function createApp(deps) {
             ...(profile.provider === 'claude' ? { claude: profile.path } : {}),
             ...(profile.provider === 'codex' ? { codex: profile.path } : {}),
             ...(profile.provider === 'opencode' ? { opencodeConfig: profile.path } : {}),
+            ...(profile.provider === 'pi' ? { pi: profile.path } : {}),
+            // The discovered omp account is already an agent dir; a named one is a profile folder that
+            // keeps its config in `agent/`.
+            ...(profile.provider === 'omp' ? { omp: profile.isDefault ? profile.path : profileAgentDir('omp', profile.path) } : {}),
         };
         const defs = listConfigFiles().filter((def) => def.scope === 'user' && def.runners.includes(profile.provider));
         return Promise.all(defs.map(async (def) => {
@@ -1711,7 +1268,7 @@ export function createApp(deps) {
         }
     };
     /** Validate a client-supplied config dir. Returns the error text, or null when it is usable. */
-    const checkProfileDir = (configDir) => {
+    const checkProfileDir = async (configDir, provider) => {
         if (CONTROL_CHARS_RE.test(configDir))
             return 'folder must not contain control characters';
         const expanded = expandTilde(configDir);
@@ -1721,13 +1278,18 @@ export function createApp(deps) {
         // real Windows path, and this is the only gate the Add-account dialog has.
         if (!isAbsoluteConfigDir(expanded))
             return `folder must be an absolute path: ${configDir}`;
+        // An omp account is selected by profile NAME, so only a folder in omp's profiles dir can be one.
+        if (provider === 'omp')
+            return ompProfileDirError(expanded);
         return null;
     };
     /** Refuse a dir that is already some other account's (or the default's), compared through
      *  `realpath` — two spellings of one directory would be two accounts silently sharing one
      *  session store, and "which one am I logged into?" would stop having an answer. */
     const conflictingProfile = async (profiles, provider, path, exceptId) => {
-        if (await sameProfileDir(path, defaultAgentProfile(provider).path)) {
+        // Compared as agent dirs: the discovered omp account is one (a host `OMP_PROFILE=work` makes it
+        // `…/profiles/work/agent`), while a named omp account is the profile folder holding it.
+        if (await sameProfileDir(profileAgentDir(provider, path), defaultAgentProfile(provider).path)) {
             return 'that is already this agent\'s default folder';
         }
         for (const candidate of profiles) {
@@ -1780,7 +1342,7 @@ export function createApp(deps) {
         if (!supportsProfiles(provider)) {
             return c.json({ error: `${provider} cannot carry more than one account` }, 400);
         }
-        const dirError = checkProfileDir(configDir);
+        const dirError = await checkProfileDir(configDir, provider);
         if (dirError)
             return c.json({ error: dirError }, 400);
         // Read-first, exactly like `POST /projects`: the duplicate check needs `realpath`, and the
@@ -1828,13 +1390,13 @@ export function createApp(deps) {
             .catch(() => { });
         return c.json({ profile: created201 }, 201);
     })
-        .patch('/workspace/agent-profiles/:id', paramZodValidator(z.object({ id: z.string() })), jsonZodValidator(() => updateAgentProfileSchema), async (c) => {
+        .patch('/workspace/agent-profiles/:id', paramZodValidator(agentProfileRouteParamsSchema), jsonZodValidator(() => updateAgentProfileSchema), async (c) => {
         if (!capabilities().localHandoff)
             return c.json(hostedProfileRefusal, 409);
         const id = c.req.param('id');
         const { label, configDir } = c.req.valid('json');
         if (configDir !== undefined) {
-            const dirError = checkProfileDir(configDir);
+            const dirError = await checkProfileDir(configDir);
             if (dirError)
                 return c.json({ error: dirError }, 400);
         }
@@ -1851,6 +1413,10 @@ export function createApp(deps) {
         if (!current)
             return c.json({ error: `unknown account: ${id}` }, 404);
         if (configDir !== undefined) {
+            // The provider's own folder rule needs the account, so it runs once the id is known.
+            const dirError = await checkProfileDir(configDir, current.provider);
+            if (dirError)
+                return c.json({ error: dirError }, 400);
             const conflict = await conflictingProfile(existing, current.provider, expandTilde(configDir), id);
             if (conflict !== null)
                 return c.json({ error: conflict }, 409);
@@ -1896,12 +1462,14 @@ export function createApp(deps) {
          * the "Check again" affordance — the cache itself holds a connected answer for minutes and an
          * unsettled one for a minute (`cacheTtlFor` in `core/provider-auth.ts`).
          */
-        .get('/workspace/agent-profiles/:id/status', paramZodValidator(z.object({ id: z.string() })), queryZodValidator(z.object({ refresh: queryValue.refine((v) => v === undefined || v === '1') }), { message: 'refresh must be 1 when provided' }), async (c) => {
+        .get('/workspace/agent-profiles/:id/status', paramZodValidator(agentProfileRouteParamsSchema), queryZodValidator(strictRefreshQuerySchema, { message: 'refresh must be 1 when provided' }), async (c) => {
+        // jscpd:ignore-start -- hearsay-tools/cezarion#1888: unchanged gate; only the validator arguments around it moved.
         if (!capabilities().localHandoff)
             return c.json(hostedProfileRefusal, 409);
         const account = await accountById(c.req.param('id'));
         if (!account)
             return c.json({ error: `unknown account: ${c.req.param('id')}` }, 404);
+        // jscpd:ignore-end
         const refresh = c.req.valid('query').refresh === '1';
         if (refresh)
             invalidateHostModels(account.provider);
@@ -1912,6 +1480,12 @@ export function createApp(deps) {
             const row = all.providers.find((candidate) => candidate.provider === account.provider);
             return c.json({ status: row ?? { provider: account.provider, status: 'unknown' } });
         }
+        // A probe of an account the agent would not open reports on another folder (#1283), so the
+        // row says why instead, without a spawn.
+        const unavailable = namedAccountUnavailable(account.provider, account.path);
+        if (unavailable !== null) {
+            return c.json({ status: { provider: account.provider, status: 'unknown', hint: unavailable, profileId: account.id } });
+        }
         // "Check again" re-probes THIS account only — the other accounts' warm answers are not
         // invalidated by asking about this one.
         if (refresh)
@@ -1924,20 +1498,17 @@ export function createApp(deps) {
         });
     })
         /**
-         * Who this account is signed in AS — the pane's "Show details".
-         *
-         * A separate, on-demand route rather than a field on the listing, and that is what makes
-         * "hidden by default" real: an email carried by the listing would already be in the response,
-         * the query cache and devtools, whatever the UI chose to render. `provider-auth.ts` keeps
-         * identity out of ITS boundary on purpose; this is the deliberate, local-only, opt-in
-         * exception — not a widening of that rule. Never logged, never persisted.
+         * Local-only account details, fetched separately on request. Keep identity out of normal
+         * listings, logs and run persistence.
          */
-        .get('/workspace/agent-profiles/:id/details', paramZodValidator(z.object({ id: z.string() })), async (c) => {
+        .get('/workspace/agent-profiles/:id/details', paramZodValidator(agentProfileRouteParamsSchema), async (c) => {
+        // jscpd:ignore-start -- hearsay-tools/cezarion#1888: unchanged gate; only the validator arguments around it moved.
         if (!capabilities().localHandoff)
             return c.json(hostedProfileRefusal, 409);
         const account = await accountById(c.req.param('id'));
         if (!account)
             return c.json({ error: `unknown account: ${c.req.param('id')}` }, 404);
+        // jscpd:ignore-end
         return c.json(await readAccountIdentity(account.provider, account.path));
     })
         /**
@@ -1948,12 +1519,14 @@ export function createApp(deps) {
          * `/api/v1/agent-config/:id` follows). `folder` is the one extra keyword, and it resolves to
          * the account's dir rather than anything the caller spelled.
          */
-        .post('/workspace/agent-profiles/:id/open', paramZodValidator(z.object({ id: z.string() })), jsonZodValidator(() => openAgentAccountFileSchema), async (c) => {
+        .post('/workspace/agent-profiles/:id/open', paramZodValidator(agentProfileRouteParamsSchema), jsonZodValidator(() => openAgentAccountFileSchema), async (c) => {
+        // jscpd:ignore-start -- hearsay-tools/cezarion#1888: unchanged gate; only the validator arguments around it moved.
         if (!capabilities().localHandoff)
             return c.json(hostedProfileRefusal, 409);
         const account = await accountById(c.req.param('id'));
         if (!account)
             return c.json({ error: `unknown account: ${c.req.param('id')}` }, 404);
+        // jscpd:ignore-end
         const { file, target } = c.req.valid('json');
         let path;
         if (file === 'folder') {
@@ -2055,7 +1628,7 @@ export function createApp(deps) {
         }
         return c.json({ selections: store.selections, defaults: store.defaults });
     })
-        .delete('/workspace/agent-profiles/:id', paramZodValidator(z.object({ id: z.string() })), async (c) => {
+        .delete('/workspace/agent-profiles/:id', paramZodValidator(agentProfileRouteParamsSchema), async (c) => {
         if (!capabilities().localHandoff)
             return c.json(hostedProfileRefusal, 409);
         const id = c.req.param('id');
@@ -2182,6 +1755,9 @@ export function createApp(deps) {
                 error: `cezar is serving ${entry.name} right now — it re-registers itself at every start, so it cannot be removed from here`,
             }, 409);
         }
+        // A background warm-up may be building this project right now: count its runs, and dispose
+        // it, only once that build has landed (#667).
+        await contexts.settle(id);
         const active = activeRunCount(id);
         if (active > 0) {
             return c.json({
@@ -2278,13 +1854,10 @@ export function createApp(deps) {
                 }
                 if (webhook !== undefined) {
                     // The token is write-only (#589): the form never has it back, so an omitted token
-                    // keeps the stored one and only `''` clears it.
-                    if (webhook === null)
-                        delete entry.webhook;
-                    else {
-                        const token = webhook.token === undefined ? entry.webhook?.token : webhook.token || undefined;
-                        entry.webhook = { url: webhook.url, ...(token ? { token } : {}) };
-                    }
+                    // keeps the stored one and only `''` clears it. An omitted `triggers` keeps the stored
+                    // selection the same way, so a URL or token edit never resets it (#1356).
+                    // Since #1576 this edits the first webhook with task notifications on.
+                    applyTaskWebhookInput(entry, webhook);
                 }
                 updated = entry;
             });
@@ -2319,26 +1892,83 @@ export function createApp(deps) {
         const entry = await projectRegistryEntry(raw).catch(() => undefined);
         if (!entry)
             return c.json({ error: `unknown project: ${raw}` }, 404);
-        if (!entry.webhook)
+        // Since #1576: the first webhook with task notifications on.
+        const webhook = taskWebhookList(entry)[0];
+        if (!webhook)
             return c.json({ error: NO_WEBHOOK_ERROR }, 400);
-        const payload = {
-            event: 'task.test',
-            deliveryId: randomUUID(),
-            projectId: entry.id,
-            occurredAt: new Date().toISOString(),
-        };
-        if (process.env.CEZ_DRY_RUN === '1') {
-            const body = { ok: true, dryRun: true };
-            return c.json(body);
+        const body = await sendTestDelivery(entry.id, webhook);
+        return c.json(body);
+    })
+        // ---- project webhooks (hearsay-tools/cezarion#1576) ----
+        // Several webhooks per project, each with its own task-state selection and an explicit
+        // "Expose to agents" switch. Registry edits like the PATCH above: refused in single-project
+        // mode, 404 on an unknown project or webhook, and a write that names nothing else leaves the
+        // rest of the entry alone. The first write stores `webhooks` and drops the old `webhook` key.
+        .post('/projects/:projectId/webhooks', jsonZodValidator(createProjectWebhookInputSchema), async (c) => {
+        const input = c.req.valid('json');
+        const answer = await editProjectWebhooks(c.req.param('projectId'), (webhooks) => {
+            if (webhooks.length >= PROJECT_WEBHOOKS_MAX)
+                return { error: `a project holds at most ${PROJECT_WEBHOOKS_MAX} webhooks`, status: 409 };
+            if (nameTaken(webhooks, input.name))
+                return { error: webhookNameTakenError(input.name), status: 409 };
+            const webhook = createdWebhook(webhooks, input);
+            return { webhooks: [...webhooks, webhook], webhook };
+        });
+        if ('error' in answer)
+            return c.json({ error: answer.error }, answer.status);
+        const body = answer.body;
+        return c.json(body, 201);
+    })
+        .patch('/projects/:projectId/webhooks/:webhookId', paramZodValidator(projectWebhookParamsSchema), jsonZodValidator(updateProjectWebhookInputSchema), async (c) => {
+        const { projectId, webhookId } = c.req.valid('param');
+        const input = c.req.valid('json');
+        const answer = await editProjectWebhooks(projectId, (webhooks) => {
+            const index = webhooks.findIndex((webhook) => webhook.id === webhookId);
+            if (index < 0)
+                return { error: `unknown webhook: ${webhookId}`, status: 404 };
+            if (input.name !== undefined && nameTaken(webhooks, input.name, webhookId))
+                return { error: webhookNameTakenError(input.name), status: 409 };
+            const webhook = editedWebhook(webhooks[index], input);
+            return { webhooks: webhooks.map((entry, at) => (at === index ? webhook : entry)), webhook };
+        });
+        if ('error' in answer)
+            return c.json({ error: answer.error }, answer.status);
+        const body = answer.body;
+        return c.json(body);
+    })
+        .delete('/projects/:projectId/webhooks/:webhookId', paramZodValidator(projectWebhookParamsSchema), async (c) => {
+        const { projectId, webhookId } = c.req.valid('param');
+        const answer = await editProjectWebhooks(projectId, (webhooks) => {
+            const webhook = webhooks.find((entry) => entry.id === webhookId);
+            if (!webhook)
+                return { error: `unknown webhook: ${webhookId}`, status: 404 };
+            return { webhooks: webhooks.filter((entry) => entry !== webhook), webhook };
+        });
+        if ('error' in answer)
+            return c.json({ error: answer.error }, answer.status);
+        const project = answer.body.project;
+        const body = { project: defined({ ...project, webhook: project.webhook && defined(project.webhook) }) };
+        return c.json(body);
+    })
+        // "Send test" for one webhook: one `task.test` delivery, now, no retries.
+        .post('/projects/:projectId/webhooks/:webhookId/test', paramZodValidator(projectWebhookParamsSchema), async (c) => {
+        if (capabilities().singleProject) {
+            return c.json(singleProjectRefusal('editing projects'), 409);
         }
-        const result = await deliverOnce(entry.webhook, payload, { fetch: deps.taskWebhookFetch });
-        const body = {
-            ok: result.ok,
-            ...(result.status === undefined ? {} : { status: result.status }),
-            ...(result.error === undefined ? {} : { error: result.error }),
-        };
+        const { projectId, webhookId } = c.req.valid('param');
+        if (!projectIdSchema.safeParse(projectId).success) {
+            return c.json({ error: `unknown project: ${projectId}` }, 404);
+        }
+        const entry = await projectRegistryEntry(projectId).catch(() => undefined);
+        if (!entry)
+            return c.json({ error: `unknown project: ${projectId}` }, 404);
+        const webhook = projectWebhooks(entry).find((candidate) => candidate.id === webhookId);
+        if (!webhook)
+            return c.json({ error: `unknown webhook: ${webhookId}` }, 404);
+        const body = await sendTestDelivery(entry.id, webhook);
         return c.json(body);
     })
+        .get('/projects/checkout/:checkoutId/progress', paramZodValidator(checkoutProgressParamsSchema), c => c.json({ progress: checkoutProgress.get(c.req.valid('param').checkoutId) }))
         .post('/projects/checkout', jsonZodValidator(() => checkoutSchema, { message: 'url must be a GitHub repository' }), async (c) => {
         if (capabilities().singleProject) {
             return c.json(singleProjectRefusal('adding projects'), 409);
@@ -2350,7 +1980,7 @@ export function createApp(deps) {
             name,
             checkoutId,
             projectsDir: expandTilde(await workspaceProjectsDir()),
-            onProgress: (event) => workspaceEvents.emit('checkout-progress', event),
+            onProgress: (event) => { checkoutProgress.record(event); workspaceEvents.emit('checkout-progress', event); },
             // A closed dialog / navigated-away tab aborts the request; the clone is
             // killed and its partial directory removed rather than left running.
             signal: c.req.raw.signal,
@@ -2372,14 +2002,95 @@ export function createApp(deps) {
             return c.json({ error: `${error} (the clone is at ${result.target})` }, registered.status);
         }
         return c.json(registered.body, 200);
+    })
+        // ---- new project (spec 2026-10-15-create-new-project) ------------------
+        // "Add project → New project": a fresh git repo at `<projectsDir>/<name>`,
+        // optionally backed by a new PRIVATE GitHub repository (never public — the
+        // body has no visibility field to set), optionally from a template. Same
+        // progress stream and cache, same `registerFolder` commit, same
+        // `{ error, reason }` degradation as the clone route above.
+        //
+        // A hosted cockpit creates LOCAL projects only: GitHub creation would act
+        // with the host's `gh` account on a remote viewer's behalf, and the owner
+        // list would show that viewer the host's login and organisations.
+        .get('/projects/github-owners', async (c) => {
+        if (!capabilities().localHandoff) {
+            const body = { available: false, reason: HOSTED_GITHUB_OWNERS_REASON };
+            return c.json(body);
+        }
+        return c.json(await listGithubOwners(deps.projectCommandRunner));
+    })
+        .post('/projects/create', jsonZodValidator(() => createProjectInputSchema, { message: 'project name must be a valid GitHub repository name — letters, digits, ".", "-" and "_" only, no spaces' }), async (c) => {
+        if (capabilities().singleProject) {
+            return c.json(singleProjectRefusal('adding projects'), 409);
+        }
+        const { name, github, checkoutId } = c.req.valid('json');
+        if (github && !capabilities().localHandoff) {
+            return c.json({ error: HOSTED_GITHUB_CREATE_REFUSAL }, 409);
+        }
+        const projectsDir = expandTilde(await workspaceProjectsDir());
+        // `registerFolder` re-checks hosted containment, but only AFTER the
+        // repository exists; asked here first, an out-of-root checkout root
+        // refuses before anything is created.
+        if (!capabilities().localHandoff && !(await isInsideHostedBrowseRoot(join(projectsDir, name)))) {
+            return c.json({ error: 'folder is outside the browsable root' }, 400);
+        }
+        const result = await createProject({
+            name,
+            github,
+            checkoutId,
+            projectsDir,
+            onProgress: (event) => { checkoutProgress.record(event); workspaceEvents.emit('checkout-progress', event); },
+            // Cancels only the steps before `gh repo create` (create-project.ts).
+            signal: c.req.raw.signal,
+            ...(deps.projectCommandRunner ? { run: deps.projectCommandRunner } : {}),
+        });
+        if (!result.ok) {
+            return c.json('reason' in result ? { error: result.error, reason: result.reason } : { error: result.error }, result.status);
+        }
+        // GitHub-backed projects register as `checkout` (they have an origin the
+        // clone flow would also produce); a local-only repo is `local`.
+        const registered = await registerFolder(result.target, result.slug ? 'checkout' : 'local');
+        // A new entry (200), or the existing one for the same root (409 "already registered") — what
+        // creating a registered project whose folder had been deleted produces. The user asked for
+        // that project and it is there, so both are a success. (An if/else chain, not a helper:
+        // only narrowing `registered` keeps the error bodies out of the route's 200 type.)
+        let project;
+        if (registered.status === 200)
+            project = registered.body.project;
+        else if (registered.status === 409 && 'project' in registered.body)
+            project = registered.body.project;
+        else {
+            // As with a clone: the repository is the user's now, so it stays — and a GitHub warning
+            // rides along, since its finishing commands are the only record of what is left to do.
+            const { body } = registered;
+            const error = 'error' in body && body.error ? body.error : 'could not register the new project';
+            const warning = result.warning ? `\n${result.warning}` : '';
+            return c.json({ error: `${error} (the project is at ${result.target})${warning}` }, registered.status);
+        }
+        const body = { project, ...(result.warning ? { warning: result.warning } : {}) };
+        return c.json(body, 200);
     });
+    /** Hosted containment for a path that may not exist yet: lexical for the
+     *  path itself, realpath for its nearest existing ancestor (a symlink inside
+     *  the browse root may point out of it). Same rule as `registerFolder`. */
+    const isInsideHostedBrowseRoot = async (candidate) => {
+        const browseRoot = resolveBrowseRoot(await workspaceBrowseRoot());
+        if (!(await isLexicallyInsideBrowseRoot(browseRoot, candidate)))
+            return false;
+        let existing = candidate;
+        while (!(await stat(existing).then(() => true, () => false))) {
+            const parent = dirname(existing);
+            if (parent === existing)
+                return false;
+            existing = parent;
+        }
+        return isInsideBrowseRoot(browseRoot, existing);
+    };
     // Register an existing folder (multi-project spec, "Add project" — the
     // folder-browser dialog's commit step, step 4.2). Workspace-level like its
     // GET twin. Everything here is a guard; the registry write itself is one
     // idempotent `registerProject` call.
-    const registerProjectSchema = z.object({
-        root: z.string().trim().min(1).max(4096),
-    });
     /**
      * The register-a-folder half of `POST /api/projects`, factored out so the
      * checkout route (step 4.3) commits its fresh clone through the SAME guards
@@ -2527,60 +2238,6 @@ export function createApp(deps) {
             return 0;
         return ctx.store.listRuns().filter((run) => ACTIVE_RUN_STATUSES.has(run.status)).length;
     };
-    // Workspace-level by design: update state spans project and global installs,
-    // but the selected registered project supplies the safe, server-owned cwd.
-    const skillsUpdateInputSchema = z.object({ projectId: projectIdSchema }).strict();
-    const resolveSkillsUpdateRoot = async (raw) => {
-        if (!projectIdSchema.safeParse(raw).success)
-            return { status: 404, error: `unknown project: ${raw}` };
-        const bootId = await resolveBootProject();
-        if (raw === 'default' || raw === bootId)
-            return { root: bootRoot };
-        const project = (await loadWorkspaceConfig()).projects.find((entry) => entry.id === raw);
-        if (!project)
-            return { status: 404, error: `unknown project: ${raw}` };
-        if ((await probeProjectStatus(project.root)).status === 'missing') {
-            return { status: 409, error: `project folder not found: ${raw}` };
-        }
-        return { root: project.root };
-    };
-    const skillsUpdateResponse = async (state) => {
-        const config = await loadWorkspaceConfig();
-        return { ...state, autoUpdateEnabled: effectiveSkillsAutoUpdate(config), inherited: config.skillsAutoUpdate === undefined };
-    };
-    // ---- chained family: skills updates (workspace-level) ----
-    const skillsUpdateRoutes = new Hono()
-        .get('/workspace/skills-update', queryZodValidator(skillsUpdateInputSchema, { message: 'projectId is required' }), async (c) => {
-        const parsed = { data: c.req.valid('query') };
-        const resolved = await resolveSkillsUpdateRoot(parsed.data.projectId);
-        if ('error' in resolved)
-            return c.json({ error: resolved.error }, resolved.status);
-        const state = skillsUpdate.snapshot(resolved.root);
-        void skillsUpdate.check(resolved.root).catch(() => { });
-        return c.json(await skillsUpdateResponse(state));
-    })
-        .post('/workspace/skills-update/check', jsonZodValidator(skillsUpdateInputSchema, { message: 'body must contain only projectId' }), async (c) => {
-        const parsed = { data: c.req.valid('json') };
-        const resolved = await resolveSkillsUpdateRoot(parsed.data.projectId);
-        if ('error' in resolved)
-            return c.json({ error: resolved.error }, resolved.status);
-        return c.json(await skillsUpdateResponse(await skillsUpdate.check(resolved.root, true)));
-    })
-        .post('/workspace/skills-update/apply', jsonZodValidator(skillsUpdateInputSchema, { message: 'body must contain only projectId' }), async (c) => {
-        const parsed = { data: c.req.valid('json') };
-        const resolved = await resolveSkillsUpdateRoot(parsed.data.projectId);
-        if ('error' in resolved)
-            return c.json({ error: resolved.error }, resolved.status);
-        try {
-            return c.json(await skillsUpdateResponse(await skillsUpdate.update(resolved.root, true)));
-        }
-        catch (error) {
-            if (error instanceof SkillsUpdateConflictError) {
-                return c.json({ error: 'another skills update operation is running', state: await skillsUpdateResponse(skillsUpdate.snapshot(resolved.root)) }, 409);
-            }
-            throw error;
-        }
-    });
     // Workspace-level, server-selected target and executable. The empty JSON body is strict.
     const applicationUpdateRoutes = new Hono()
         .post('/workspace/application-update/apply', jsonZodValidator(applicationUpdateInputSchema), async (c) => {
@@ -2618,11 +2275,6 @@ export function createApp(deps) {
     // events on the workspace stream. `checkoutId` is the cockpit's own
     // correlation token, echoed on every event so two tabs cloning at once never
     // render each other's progress.
-    const checkoutSchema = z.object({
-        url: z.string().trim().min(1).max(512),
-        name: z.string().trim().max(128).optional(),
-        checkoutId: z.string().trim().max(128).optional(),
-    });
     // ---- workspace settings (multi-project spec, step 2.7) -------------------
     // WORKSPACE-level routes: single-mount (never mirrored under /api/p/),
     // same-origin. The config routes carry the settings UI's slice of
@@ -2632,8 +2284,9 @@ export function createApp(deps) {
     const workspaceConfigBody = (config) => ({
         browseRoot: config.browseRoot,
         projectsDir: config.projectsDir,
-        skillsAutoUpdate: config.skillsAutoUpdate ?? null,
-        effectiveSkillsAutoUpdate: effectiveSkillsAutoUpdate(config),
+        archiveOnMerge: config.archiveOnMerge ?? null,
+        effectiveArchiveOnMerge: resolveGlobalArchiveOnMerge(config).enabled,
+        archiveOnMergeSource: resolveGlobalArchiveOnMerge(config).source,
         composerDefaults: {
             autonomous: config.composerDefaults.autonomous ?? null,
             worktree: config.composerDefaults.worktree ?? null,
@@ -2665,7 +2318,7 @@ export function createApp(deps) {
         .get('/workspace/config', async (c) => c.json(workspaceConfigBody(await loadWorkspaceConfig())))
         .put('/workspace/config', jsonZodValidator(() => workspaceConfigUpdateSchema), async (c) => {
         const parsed = { data: c.req.valid('json') };
-        const { browseRoot, projectsDir, skillsAutoUpdate, composerDefaults, resources, agentDefaults } = parsed.data;
+        const { browseRoot, projectsDir, archiveOnMerge, composerDefaults, resources, agentDefaults } = parsed.data;
         for (const [configuredRoot, create] of [
             [browseRoot, false],
             [projectsDir, true],
@@ -2704,10 +2357,10 @@ export function createApp(deps) {
                     config.browseRoot = browseRoot;
                 if (projectsDir !== undefined)
                     config.projectsDir = projectsDir;
-                if (skillsAutoUpdate === null)
-                    delete config.skillsAutoUpdate;
-                else if (skillsAutoUpdate !== undefined)
-                    config.skillsAutoUpdate = skillsAutoUpdate;
+                if (archiveOnMerge === null)
+                    delete config.archiveOnMerge;
+                else if (archiveOnMerge !== undefined)
+                    config.archiveOnMerge = archiveOnMerge;
                 if (composerDefaults?.autonomous === null)
                     delete config.composerDefaults.autonomous;
                 else if (composerDefaults?.autonomous !== undefined) {
@@ -2761,6 +2414,8 @@ export function createApp(deps) {
             // e.g. a read-only home — nothing was persisted (atomic tmp+rename).
             return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
         }
+        if (archiveOnMerge !== undefined)
+            deps.archiveOnMergeChanged?.();
         // A resource change takes effect WITHOUT a restart: refresh the shared
         // semaphore's in-memory snapshot and pump every manager (step 2.5's hook).
         if (resources !== undefined)
@@ -2793,47 +2448,9 @@ export function createApp(deps) {
     // Partial updates only — absent keys stay untouched. Bounds mirror the
     // workspace schema (src/workspace/config.ts, step 1.2) exactly, so a value
     // this route accepts can never be degraded away by the next load's `.catch`.
-    const workspaceConfigUpdateSchema = z.object({
-        browseRoot: z.string().trim().min(1).max(4096).optional(),
-        projectsDir: z.string().trim().min(1).max(4096).optional(),
-        skillsAutoUpdate: z.boolean().nullable().optional(),
-        composerDefaults: z
-            .object({
-            autonomous: z.boolean().nullable().optional(),
-            worktree: z.boolean().nullable().optional(),
-        })
-            .optional(),
-        resources: z
-            .object({
-            maxParallel: z.number().int().min(1).max(16).optional(),
-            maxMonitoringSessions: z.number().int().min(0).max(16).optional(),
-            monitoringWakeIntervalMinutes: z.number().int().min(1).max(60).nullable().optional(),
-            autoResumeOnUsageLimit: z.boolean().optional(),
-            memoryLimitMb: z.number().int().min(0).max(1_048_576).nullable().optional(),
-            worktreeRetentionDefault: z.number().int().min(0).max(1000).optional(),
-        })
-            .optional(),
-        // Bounds mirror `src/workspace/config.ts`, so a value this accepts is never degraded away by
-        // the next load's `.catch`. `null` clears a key back to "no opinion".
-        agentDefaults: z
-            .object({
-            runner: z.enum(PROVIDER_IDS).nullable().optional(),
-            models: z
-                .object({
-                claude: z.string().trim().min(1).max(200).nullable().optional(),
-                codex: z.string().trim().min(1).max(200).nullable().optional(),
-                opencode: z.string().trim().min(1).max(200).nullable().optional(),
-                pi: z.string().trim().min(1).max(200).nullable().optional(),
-                omp: z.string().trim().min(1).max(200).nullable().optional(),
-                cursor: z.string().trim().min(1).max(200).nullable().optional(),
-            })
-                .optional(),
-        })
-            .optional(),
-    });
     // ---- chained family: filesystem browse (workspace-level) ----
     const fsBrowseRoutes = new Hono()
-        .get('/fs/browse', queryZodValidator(z.object({ path: queryValue, showHidden: queryValue })), async (c) => {
+        .get('/fs/browse', queryZodValidator(browseQuerySchema), async (c) => {
         if (capabilities().singleProject) {
             return c.json(singleProjectRefusal('folder browsing'), 409);
         }
@@ -2860,31 +2477,17 @@ export function createApp(deps) {
         // cache converges without polling or a manual reload (spec 005 / #555).
         if (c.req.valid('query').wait === '1')
             await waitForTeamSkills(repoRoot);
-        return c.json(await discoverSkills(repoRoot));
+        return c.json(await discoverSkills(repoRoot, { builtin: builtinSkillsOf(c.get('project').manager) }));
     })
-        // The opt-in catalog for the "Import skills" panel: every skill a default
-        // (vendor) repo offers — `open-mercato/skills` — regardless of import state,
-        // so the panel can present them all with a per-skill toggle. Empty once a repo
-        // configures its own `skillsRepos` (nothing is gated then). `wait=1` lets the
-        // panel wait out a cold team-skill cache, same as `GET /skills` (spec 005).
+        // Every team skill the configured sources offer, including those this project switched
+        // off, so the Skills catalog can show each with its toggle: one entry per source copy, so a
+        // name two sources offer comes twice (#1494). Empty without `skillsRepos`.
+        // `wait=1` lets the panel wait out a cold team-skill cache, same as `GET /skills` (spec 005).
         .get('/skills/importable', queryZodValidator(waitQuery), async (c) => {
         const repoRoot = c.get('project').root;
-        const gated = await gatedSkillsRepos(repoRoot);
-        if (gated.size === 0)
-            return c.json([]);
         if (c.req.valid('query').wait === '1')
             await waitForTeamSkills(repoRoot);
-        const importable = getTeamSkillsCached(repoRoot)
-            .filter((skill) => skill.team && gated.has(skill.team.repo))
-            // Spread `description` rather than writing it unconditionally: an undefined VALUE is
-            // dropped by JSON.stringify, so the key is absent on the wire, and writing it always
-            // typed the route as sending a key it does not. contract/skills.ts says `.optional()`,
-            // which is what the client actually receives.
-            .map((skill) => ({
-            name: skill.name,
-            ...(skill.description !== undefined ? { description: skill.description } : {}),
-        }));
-        return c.json(importable);
+        return c.json(getTeamSkillsCached(repoRoot));
     })
         // Refresh team skills (spec 005): clone/fetch the configured skills repos,
         // then return the merged catalog. Degrades quietly — offline just means the
@@ -2892,7 +2495,7 @@ export function createApp(deps) {
         .post('/skills/refresh', async (c) => {
         const { root: repoRoot } = c.get('project');
         await refreshTeamSkills(repoRoot);
-        return c.json(await discoverSkills(repoRoot));
+        return c.json(await discoverSkills(repoRoot, { builtin: builtinSkillsOf(c.get('project').manager) }));
     });
     // ---- chained family: GUI prefs / ui-state (project-scoped) ----
     const uiStateRoutes = new Hono()
@@ -2905,10 +2508,10 @@ export function createApp(deps) {
         // single request may not stuff an unbounded key set (#429) — the shared
         // schema+cap half of both ui-state routes lives in `uiStateBody`.
         const parsed = { data: c.req.valid('json') };
-        const merged = { ...(await readUiState(repoRoot)), ...parsed.data };
+        const merged = { ...(await readProjectUiState(repoRoot)), ...parsed.data };
         try {
             await mkdir(dataDir, { recursive: true });
-            await writeFile(uiStatePath(repoRoot), `${JSON.stringify(merged, null, 2)}\n`, 'utf8');
+            await writeProjectUiState(repoRoot, merged);
         }
         catch (err) {
             return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
@@ -3015,7 +2618,7 @@ export function createApp(deps) {
         const blocked = await providerActionError([(await loadConfig(repoRoot)).defaultRunner]);
         if (blocked)
             return c.json({ error: blocked }, 409);
-        return c.json(await planChain(repoRoot, parsed.data.task));
+        return c.json(await planChain(repoRoot, parsed.data.task, builtinSkillsOf(c.get('project').manager)));
     });
     const manualChecks = new Map();
     /**
@@ -3055,8 +2658,37 @@ export function createApp(deps) {
                 timeZone,
             }),
             onChange: (automationId, revision) => emitAutomationChange(project, automationId, revision),
+            // A route's write settles a crash-left reservation first, as the timer does (#1465).
+            reconcile: async () => { reconcileAutomationReceipts(project.automationStore, project.store); },
         };
     };
+    /** The automations family's behavior, shared with the session tools (#1465). */
+    const automationService = createAutomationService({
+        timeZone: localTimeZone,
+        discovery: { models: modelCatalog, providers: () => providerStatus() },
+        scheduleHandle: (project) => scheduleHandle(project),
+        emitChange: (project, automationId, revision, deleted) => emitAutomationChange(project, automationId, revision, deleted),
+        changed: automationsChanged,
+        // Awaits the driver's settled probe (per-repo cache + in-flight dedupe, 5 s timeout, never
+        // throws): a "still being checked" answer would leave the cockpit's GitHub option disabled
+        // because it does not refetch when the probe completes. `/health` keeps `detectCached`.
+        githubAvailability: async (root) => {
+            const forge = resolveForge(await getRepoInfo(root));
+            return forge ? forge.detect() : { available: false, reason: 'No GitHub remote is configured' };
+        },
+        hasGithubRemote: async (root) => Boolean(resolveForge(await getRepoInfo(root))),
+    });
+    // #1465: every project's manager gets the schedule tools over this service. A manager reads
+    // them at call time, so a session recovered before its project's context finished building
+    // reaches them once this runs. The tools themselves stay behind CEZ_AUTOMATIONS=1.
+    const attachAutomationTools = (project) => project.manager.setAutomationTools?.(createAutomationToolService(automationService, project, { timeZone: localTimeZone }));
+    attachAutomationTools(bootContext);
+    for (const id of contexts.ids()) {
+        const ctx = contexts.peek(id);
+        if (ctx)
+            attachAutomationTools(ctx);
+    }
+    contexts.onContextBuilt(attachAutomationTools);
     // ---- chained family: GitHub automations (project-scoped) ----
     // Every handler below reads `c.get('project')` — the definitions, their runtime state and the
     // execution log are per-project files — so the family is project-scoped and mounted with the
@@ -3067,216 +2699,61 @@ export function createApp(deps) {
         .use('/automations/*', requireAutomations)
         .use('/automation-log', requireAutomations)
         .use('/automation-log/*', requireAutomations)
-        .get('/automations', async (c) => {
-        const { root, automationStore } = c.get('project');
-        const forge = resolveForge(await getRepoInfo(root));
-        // Awaits the driver's settled probe (per-repo cache + in-flight dedupe, 5 s timeout, never
-        // throws): a "still being checked" answer would leave the cockpit's GitHub option disabled
-        // because it does not refetch when the probe completes. `/health` keeps `detectCached`.
-        // Annotated, so both branches are ONE shape: the route type is what
-        // `contract/src/automations.ts` has to describe.
-        const availability = forge
-            ? await forge.detect()
-            : { available: false, reason: 'No GitHub remote is configured' };
-        const automations = automationStore.list().map((automation) => {
-            const logs = automationStore.logs({ automationId: automation.id, limit: 100 });
-            const state = automationStore.state(automation.id);
-            const latestLog = logs[0];
-            // Enabled only: a paused definition's stored instant is stale, not a next run.
-            const nextRunAt = automation.enabled
-                ? (automation.kind === 'schedule' ? state?.nextRunAt : state?.nextCheckAt)
-                : undefined;
-            return {
-                ...automation,
-                // Spread conditionally, never `state: maybeUndefined`: the latter types the key as
-                // always-present while `JSON.stringify` drops it from the wire, so the contract would
-                // have to describe a key consumers never receive.
-                ...(state ? { state } : {}),
-                ...(latestLog ? { latestLog } : {}),
-                ...(nextRunAt ? { nextRunAt } : {}),
-                counts: {
-                    matches: logs.filter((row) => row.result === 'launched' || row.result === 'duplicate').length,
-                    launched: logs.filter((row) => row.result === 'launched' || row.result === 'manual' || row.result === 'catch-up').length,
-                    duplicates: logs.filter((row) => row.result === 'duplicate').length,
-                    errors: logs.filter((row) => row.result === 'error' || row.result === 'rate-limited' || row.result === 'failed').length,
-                },
-            };
-        });
-        const nextDue = automations.map((item) => item.nextRunAt).filter(Boolean).sort()[0];
-        return c.json({
-            ...availability,
-            timeZone: localTimeZone(),
-            scheduler: {
-                // `as const` on both arms: in an object literal a conditional of two string literals
-                // widens to `string`, which would erase the two states this key can hold.
-                state: automations.some((item) => item.enabled) ? 'scheduled' : 'idle',
-                ...(nextDue ? { nextDue } : {}),
-            },
-            automations,
-        });
+        .get('/automations', queryZodValidator(automationListQuerySchema), async (c) => {
+        return c.json(await automationService.list(c.get('project'), c.req.valid('query')));
     })
         .post('/automations', jsonZodValidator(() => automationCreateSchema), async (c) => {
-        const { root, automationStore } = c.get('project');
-        const parsed = { data: c.req.valid('json') };
-        const resolved = resolveAutomationKind(parsed.data);
-        if ('error' in resolved)
-            return c.json({ error: resolved.error }, resolved.status);
-        const promptIssue = validateAutomationPrompt(parsed.data.task.prompt, resolved.kind);
-        if (promptIssue)
-            return c.json({ error: promptIssue }, 400);
-        // A poll needs a GitHub remote to poll; a schedule needs nothing but this project.
-        if (resolved.kind === 'github' && !resolveForge(await getRepoInfo(root))) {
-            return c.json({ error: 'No GitHub remote is configured' }, 400);
-        }
-        const { enable, ...input } = parsed.data;
-        try {
-            const automation = automationStore.create({ ...input, kind: resolved.kind, enabled: enable === true }, undefined, enable ? armScheduleFromNow : undefined);
-            if (enable && isGithubAutomation(automation)) {
-                const baselineAt = new Date().toISOString();
-                automationStore.setState(automation.id, (current) => ({
-                    ...current,
-                    revision: automation.revision,
-                    baselineAt,
-                    cursor: { timestamp: baselineAt },
-                    nextCheckAt: new Date(Date.now() + automation.intervalSeconds * 1_000).toISOString(),
-                }));
-            }
-            emitAutomationChange(c.get('project'), automation.id, automation.revision);
-            automationsChanged();
-            return c.json({ automation }, 201);
-        }
-        catch (error) {
-            return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
-        }
+        const result = await automationService.create(c.get('project'), c.req.valid('json'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
+        const once = onceCreateAnswer(result.automation);
+        return c.json({ automation: result.automation, ...(once ? { once } : {}) }, 201);
     })
         .get('/automations/:id', (c) => {
-        const { automationStore } = c.get('project');
-        const automation = automationStore.get(c.req.param('id'));
-        if (!automation)
-            return c.json({ error: 'not found' }, 404);
-        const state = automationStore.state(automation.id);
-        const latestLog = automationStore.logs({ automationId: automation.id, limit: 1 })[0];
-        return c.json({
-            automation,
-            ...(state ? { state } : {}),
-            ...(latestLog ? { latestLog } : {}),
-        });
+        const result = automationService.get(c.get('project'), c.req.param('id'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
+        return c.json(result.body);
     })
         .put('/automations/:id', jsonZodValidator(() => automationUpdateSchema), async (c) => {
-        const { automationStore } = c.get('project');
-        const parsed = { data: c.req.valid('json') };
-        const { expectedRevision, ...input } = parsed.data;
-        const stored = automationStore.get(c.req.param('id'));
-        if (!stored)
-            return c.json({ error: 'not found' }, 404);
-        const resolved = resolveAutomationKind(input, stored);
-        if ('error' in resolved)
-            return c.json({ error: resolved.error }, resolved.status);
-        const promptIssue = validateAutomationPrompt(input.task.prompt, resolved.kind);
-        if (promptIssue)
-            return c.json({ error: promptIssue }, 400);
-        try {
-            // The armed instant belongs to the schedule it was computed from, and to an enabled
-            // definition: a new schedule, or a resume through PUT, re-arms from now — never a catch-up
-            // of an occurrence that passed while it was paused. Pausing clears it in the same write, so
-            // another cockpit never reads the still-enabled definition beside a due instant. Armed in
-            // the request, as `enable` does, rather than left to the timer: the list refetched on the
-            // change event must already see it. Compared with the definition on disk, not the one read above.
-            const automation = automationStore.update(c.req.param('id'), expectedRevision, { ...input, kind: resolved.kind, enabled: input.enabled ?? false }, (next, previous) => previous && (!sameSchedule(previous.schedule, next.schedule) || previous.enabled !== next.enabled) ? armScheduleFromNow(next) : undefined);
-            emitAutomationChange(c.get('project'), automation.id, automation.revision);
-            automationsChanged();
-            return c.json({ automation });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            return c.json({ error: message }, message.includes('conflict') ? 409 : 400);
-        }
+        const result = await automationService.update(c.get('project'), c.req.param('id'), c.req.valid('json'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
+        return c.json({ automation: result.automation });
     })
-        .delete('/automations/:id', (c) => {
-        const id = c.req.param('id');
-        const store = c.get('project').automationStore;
-        const current = store.get(id);
-        if (!current || !store.delete(id))
-            return c.json({ error: 'not found' }, 404);
-        emitAutomationChange(c.get('project'), id, current.revision, true);
-        automationsChanged();
+        .delete('/automations/:id', async (c) => {
+        const result = await automationService.remove(c.get('project'), c.req.param('id'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
         return c.body(null, 204);
     })
         .post('/automations/:id/enable', async (c) => {
-        const store = c.get('project').automationStore;
-        // No client revision: the toggle applies to what is on disk now, not to this store's last read.
-        store.reload();
-        const current = store.get(c.req.param('id'));
-        if (!current)
-            return c.json({ error: 'not found' }, 404);
-        try {
-            if (isScheduleAutomation(current)) {
-                // A schedule has no backlog to baseline against: it arms its next occurrence from now.
-                const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: true }, armScheduleFromNow);
-                emitAutomationChange(c.get('project'), automation.id, automation.revision);
-                automationsChanged();
-                return c.json({ automation });
-            }
-            if (!isGithubAutomation(current))
-                return c.json({ error: 'automation definition is incomplete' }, 409);
-            const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: true });
-            const baselineAt = new Date().toISOString();
-            store.setState(automation.id, (state) => ({
-                ...state,
-                revision: automation.revision,
-                baselineAt,
-                cursor: { timestamp: baselineAt },
-                nextCheckAt: new Date(Date.now() + current.intervalSeconds * 1_000).toISOString(),
-            }));
-            await store.appendLog({ automationId: automation.id, revision: automation.revision, result: 'baseline', reason: 'Enabled from a current-time baseline; existing records were not launched.' });
-            emitAutomationChange(c.get('project'), automation.id, automation.revision);
-            automationsChanged();
-            return c.json({ automation });
-        }
-        catch (error) {
-            const { status, ...body } = toggleFailure(error);
-            return c.json(body, status);
-        }
+        const result = await automationService.enable(c.get('project'), c.req.param('id'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
+        return c.json({ automation: result.automation });
     })
-        .post('/automations/:id/pause', (c) => {
-        const store = c.get('project').automationStore;
-        store.reload();
-        const current = store.get(c.req.param('id'));
-        if (!current)
-            return c.json({ error: 'not found' }, 404);
-        try {
-            const automation = store.update(current.id, current.revision, { ...editableAutomation(current), enabled: false }, armScheduleFromNow);
-            emitAutomationChange(c.get('project'), automation.id, automation.revision);
-            automationsChanged();
-            return c.json({ automation });
-        }
-        catch (error) {
-            const { status, ...body } = toggleFailure(error);
-            return c.json(body, status);
-        }
+        .post('/automations/:id/pause', async (c) => {
+        const result = await automationService.pause(c.get('project'), c.req.param('id'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
+        return c.json({ automation: result.automation });
+    })
+        // One-time schedules only (#1465): archive without launching. 409 for any other automation.
+        .post('/automations/:id/cancel', async (c) => {
+        const result = await automationService.cancel(c.get('project'), c.req.param('id'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
+        return c.json({ automation: result.automation });
     })
         // Run now: a schedule fired once by hand, paused or not, outside the timer and under the same
-        // lease. `nextRunAt` and `enabled` are untouched; a GitHub automation's equivalent is `check`.
+        // lease. A repeating schedule keeps `nextRunAt` and `enabled`; a one-time schedule is consumed
+        // (archived) by it. A GitHub automation's equivalent is `check`.
         .post('/automations/:id/run', async (c) => {
-        const project = c.get('project');
-        const store = project.automationStore;
-        const automation = store.get(c.req.param('id'));
-        if (!automation)
-            return c.json({ error: 'not found' }, 404);
-        if (!isScheduleAutomation(automation))
-            return c.json({ error: 'a GitHub automation runs on its events; use check with mode execute' }, 409);
-        const outcome = await new ScheduleRunner(scheduleHandle(project)).runNow(automation);
-        // Gone, or no longer a schedule, once re-read under the lease: nothing was launched.
-        if (outcome.result === 'skipped')
-            return c.json({ error: 'not found' }, 404);
-        if (outcome.result === 'manual') {
-            emitAutomationChange(project, automation.id, store.get(automation.id)?.revision ?? automation.revision);
-            return c.json({ runId: outcome.runId }, 202);
-        }
-        if (outcome.result === 'lease-held')
-            return c.json({ error: SCHEDULE_LEASE_HELD_REASON }, 409);
-        const reason = store.logs({ automationId: automation.id, limit: 1 })[0]?.reason;
-        return c.json({ error: reason ?? 'the run could not be launched' }, 409);
+        const result = await automationService.runNow(c.get('project'), c.req.param('id'));
+        if (!result.ok)
+            return c.json({ error: result.error }, result.status);
+        return c.json({ runId: result.runId }, 202);
     })
         // The body is validated as MIDDLEWARE, which is what puts it in the route type — and moves
         // the 400 ahead of this route's 404: `POST /automations/<unknown>/check` with a malformed
@@ -3372,7 +2849,7 @@ export function createApp(deps) {
             return c.json({ receiptId: receipt.receiptId, runId: launched.runId }, 202);
         }
         catch (error) {
-            store.appendReceipt({ ...reserved, status: 'launch-error', error: error instanceof Error ? error.message : String(error), updatedAt: new Date().toISOString() });
+            store.appendReceipt({ ...reserved, status: error instanceof AutomationCandidateChangedError ? 'released' : 'launch-error', error: error instanceof Error ? error.message : String(error), updatedAt: new Date().toISOString() });
             return c.json({ error: error instanceof Error ? error.message : String(error) }, 409);
         }
         finally {
@@ -3410,40 +2887,10 @@ export function createApp(deps) {
         const usage = currentUsage(summary.id);
         return usage ? { ...summary, usage } : summary;
     };
-    // The inbox half of a composer launch (#374). Since the cockpit's "▶ Run"
-    // prefills `/new` instead of calling POST /api/todos/:id/start (never launch
-    // blind — #355), the todo id rides along on the composer's POST /api/runs and
-    // lands here: `markStarted` writes `startedTaskId`, so the entry leaves the
-    // inbox (`visibleTodos()`) and stays in todos.json as the audit trail, and a
-    // second launch of the same entry no longer double-starts it.
-    //
-    // Deliberately best-effort: bookkeeping must never cost the user their task,
-    // so an unknown, stale or already-started id (markStarted → false) and any I/O
-    // failure only log. The run has already been created by the time we get here.
-    const noteTodoStarted = async (dataDir, todoId, taskId) => {
-        try {
-            if (!(await markStarted(dataDir, todoId, taskId))) {
-                console.warn(`[cezar] inbox entry ${todoId} not marked started (unknown or already started)`);
-            }
-        }
-        catch (err) {
-            console.warn(`[cezar] could not mark inbox entry ${todoId} started: ${String(err)}`);
-        }
-    };
     /**
-     * Every control on one run (any `/runs/:id` request that is not a read) first asks who owns it
-     * (#779, plan step 3): a `serve` and a headless `cez run` can share a project's runs.
-     * - Another live cezar process's run answers `409 { error }`, the shape these routes already
-     *   use for a run that exists but cannot be acted on now. Reads are never refused.
-     * - A run whose owner is proven dead is adopted first — claimed, loaded and settled as
-     *   interrupted, never resumed (`settleOrphanedRun`) — and the control then applies. Otherwise
-     *   Stop on a crashed `cez run` would be a dead end until this cockpit restarted. Stop is the one
-     *   control the adoption carries out itself: its run settles as cancelled, and Stop answers that
-     *   it stopped it (`stoppedOnAdoption`).
-     * - A run this process stopped writing after a conflicting write answers 409 too.
-     *
-     * Registered against explicit paths, like `requireAutomations`: `route()` re-registers it under
-     * the mount prefix, and it gates every family's `/runs/:id` routes registered after it.
+     * Gate every run control by family ownership: refuse foreign or quarantined writers with 409;
+     * adopt proven dead owners without resuming agents. Reads remain available. Stop carries its
+     * cancellation through adoption.
      */
     const requireRunControl = async (c, next) => {
         const id = c.req.param('id');
@@ -3482,8 +2929,14 @@ export function createApp(deps) {
         // The archived roots past that window, a page at a time, newest first (#864).
         .get('/run-summaries/archived', queryZodValidator(archivedRunsQuerySchema), (c) => {
         const { before, limit, q } = c.req.valid('query');
-        const page = c.get('project').store.listArchivedRuns({
+        const project = c.get('project');
+        // The page shows each task's origin line, so `q` matches what it names: the automation's
+        // name, or its recorded id while automations are off, as the cockpit's filter does (#1616).
+        const automationNames = new Map(capabilities().automations
+            ? project.automationStore.list().map((automation) => [automation.id, automation.name]) : []);
+        const page = project.store.listArchivedRuns({
             limit: limit ?? ARCHIVED_RUNS_PAGE_DEFAULT,
+            automationNames,
             ...(before !== undefined ? { before } : {}),
             ...(q !== undefined ? { q } : {}),
         });
@@ -3509,7 +2962,6 @@ export function createApp(deps) {
                 return [];
             return [{ workerId: worker.id, parentRunId: run.id, status: worker.status, workspace: owned.workspace,
                     ...(worker.currentStepId === undefined ? {} : { currentStepId: worker.currentStepId }),
-                    ...(worker.activity === undefined ? {} : { activity: worker.activity }),
                     ...(owned.destroy ? { destroy: workerDestroyView(worker) } : {}),
                 }];
         });
@@ -3543,10 +2995,10 @@ export function createApp(deps) {
     })
         // Registered before the `/:id/...` routes so "archive-finished" and "read-all"
         // never match as a run id.
-        .post('/runs/archive-finished', jsonZodValidator(archiveFinishedRequestSchema, { absent: {}, malformed: null }), (c) => c.json(c.get('project').store.archiveFinished(c.req.valid('json').scope)))
+        .post('/runs/archive-finished', jsonZodValidator(archiveFinishedRequestSchema, { absent: {}, malformed: null }), (c) => c.json(c.get('project').store.archiveFinished(c.req.valid('json').scope, c.req.valid('json').automation)))
         // The read-receipt sweep (#unread-done-items) — the mark-read twin of the archive
         // sweep above, and under the same registration-order guard.
-        .post('/runs/read-all', (c) => c.json({ read: c.get('project').store.markAllRead() }))
+        .post('/runs/read-all', jsonZodValidator(markAllReadRequestSchema, { absent: {}, malformed: null }), (c) => c.json({ read: c.get('project').store.markAllRead(c.req.valid('json').automation) }))
         .post('/runs/:id/archive', jsonZodValidator(archiveSchema, { absent: ({}) }), async (c) => {
         const { store } = c.get('project');
         const id = c.req.param('id');
@@ -3581,7 +3033,7 @@ export function createApp(deps) {
             return c.json({ error: 'not found' }, 404);
         if (notify) {
             const entry = await projectRegistryEntry(project.id).catch(() => undefined);
-            if (!entry?.webhook)
+            if (taskWebhookList(entry).length === 0)
                 return c.json({ error: NO_WEBHOOK_ERROR }, 400);
         }
         const run = project.store.updateRun(id, { notify: notify ? true : undefined });
@@ -3620,111 +3072,38 @@ export function createApp(deps) {
         const run = c.get('project').store.setUnread(c.req.param('id'));
         return run ? c.json(run) : c.json({ error: 'not found' }, 404);
     })
-        .post('/runs', jsonZodValidator(startRunSchema), async (c) => {
-        const { root: repoRoot, dataDir, manager, store } = c.get('project');
-        const parsed = { data: c.req.valid('json') };
-        const clientRequest = parsed.data.clientRequestId
-            ? { id: parsed.data.clientRequestId, hash: clientRequestHash(parsed.data) }
-            : undefined;
-        // A retry only retrieves a persisted result: mutable start prerequisites (workflow,
-        // provider, account and model policy) must not invalidate an already accepted request.
+        .post('/runs', jsonZodValidator(createRunInputSchema), async (c) => {
+        const { id: projectId, root: repoRoot, manager, store } = c.get('project');
+        const body = c.req.valid('json');
+        const clientRequest = clientRequestOf(body);
         if (clientRequest) {
-            const existing = store.findRunByClientRequestId(clientRequest.id);
-            if (existing) {
-                if (existing.clientRequestHash !== clientRequest.hash)
-                    return c.json({ error: 'request id payload conflict' }, 409);
-                return c.json(existing, 200);
-            }
-        }
-        if (agentModelsLocked(repoRoot) &&
-            (parsed.data.model?.trim() || parsed.data.effort?.trim())) {
-            return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
-        }
-        let workflow;
-        if (parsed.data.steps) {
-            // Inline chain (spec 008): an approved plan runs as an ad-hoc workflow.
-            const issue = stepsIssue(parsed.data.steps);
-            if (issue)
-                return c.json({ error: issue }, 400);
-            workflow = plannedWorkflow(parsed.data.steps);
-        }
-        else {
-            const { workflows } = await loadWorkflows(repoRoot);
-            workflow = workflows.find((w) => w.name === parsed.data.workflow);
-            if (!workflow)
-                return c.json({ error: `unknown workflow: ${parsed.data.workflow}` }, 404);
-        }
-        const fallback = parsed.data.runner ?? (await loadConfig(repoRoot)).defaultRunner;
-        const blocked = await providerActionError(providersRequiredByWorkflow(workflow, fallback));
+            const replay = replayedRun(store, clientRequest);
+            if (replay && 'error' in replay)
+                return c.json({ error: replay.error }, replay.status);
+            if (replay)
+                return c.json(replay.run, 200);
+        }
+        const locked = modelLockRefusal(repoRoot, body);
+        if (locked)
+            return c.json({ error: locked.error }, locked.status);
+        const resolved = await resolveStartWorkflow(repoRoot, body);
+        if ('error' in resolved)
+            return c.json({ error: resolved.error }, resolved.status);
+        const { workflow } = resolved;
+        const runner = body.runner ?? (await loadConfig(repoRoot)).defaultRunner;
+        const blocked = await providerGateRefusal(providerActionError, workflow, runner);
         if (blocked)
-            return c.json({ error: blocked }, 409);
-        // A composer override names an account the user just picked, so a stale id (deleted since
-        // the page loaded) is answered honestly instead of quietly running on the default — the
-        // opposite of how RESOLUTION treats a dangling reference, and deliberately so: a run
-        // replaying a stored id has no better answer than the default, a user does.
-        if (parsed.data.agentProfile !== undefined) {
-            const account = await resolveWorkspaceProfile(fallback, parsed.data.agentProfile);
-            if ('error' in account)
-                return c.json({ error: account.error }, 400);
-        }
-        // Task webhook (#589): an explicit `true` on a project with no webhook is refused, so a
-        // bot learns in one round trip. `cez task start`'s implicit default never sends it there.
-        if (parsed.data.notify === true && !(await projectRegistryEntry(c.get('project').id).catch(() => undefined))?.webhook) {
-            return c.json({ error: NO_WEBHOOK_ERROR }, 400);
-        }
-        const images = parsed.data.images?.map(toPastedContent);
-        const input = {
-            task: parsed.data.task,
-            notify: parsed.data.notify,
-            model: parsed.data.model,
-            effort: parsed.data.effort,
-            runner: parsed.data.runner,
-            agentProfile: parsed.data.agentProfile,
-            images,
-            systemPrompt: parsed.data.systemPrompt,
-            worktree: parsed.data.worktree,
-            autonomous: parsed.data.autonomous,
-            // Opt-in inbox (#471): the capability is the ceiling, so a client asking
-            // for follow-ups on a server that has them off gets a plain `false`
-            // rather than an error — the run is still perfectly valid without them.
-            // One decision here feeds the run record, the system prompt and
-            // CEZ_TODOS_FILE alike (RunManager.agentEnv).
-            generateFollowups: capabilities().followups ? parsed.data.generateFollowups : false,
-        };
-        if (clientRequest) {
-            // Recheck after every await: concurrent first requests may both miss the early lookup.
-            // The manager's lookup and create are synchronous, so exactly one can create (#504).
-            const result = manager.startRunIdempotent(workflow, input, clientRequest);
-            if ('conflict' in result)
-                return c.json({ error: 'request id payload conflict' }, 409);
-            if (!result.created)
-                return c.json(result.run, 200);
-            if (parsed.data.todoId)
-                await noteTodoStarted(dataDir, parsed.data.todoId, result.run.id);
-            return c.json(result.run, 201);
-        }
-        const variants = parsed.data.variants ?? 1;
-        if (variants > 1) {
-            // Variants live in worktrees — without git there's nothing to isolate
-            // them with, so this degrades to a clear 400 instead of stepping on
-            // one shared working tree.
-            const repo = await getRepoInfo(repoRoot);
-            if (!repo) {
-                return c.json({
-                    error: 'parallel variants need a git repository (each variant runs in its own worktree) — run ×1 here, or start cezar inside a git repo',
-                }, 400);
-            }
-            const runs = manager.startVariants(workflow, input, variants);
-            // The entry points at the first variant — the thread the composer navigates to.
-            const first = runs[0];
-            if (parsed.data.todoId && first)
-                await noteTodoStarted(dataDir, parsed.data.todoId, first.id);
-            return c.json({ runs }, 201);
-        }
-        const run = manager.startRun(workflow, input);
-        if (parsed.data.todoId)
-            await noteTodoStarted(dataDir, parsed.data.todoId, run.id);
-        return c.json(run, 201);
+            return c.json({ error: blocked.error }, blocked.status);
+        const badProfile = await agentProfileRefusal(resolveWorkspaceProfile, runner, body.agentProfile);
+        if (badProfile)
+            return c.json({ error: badProfile.error }, badProfile.status);
+        const noWebhook = await notifyRefusal(body.notify, projectId, projectRegistryEntry);
+        if (noWebhook)
+            return c.json({ error: noWebhook.error }, noWebhook.status);
+        const started = launchRun(manager, workflow, startRunInput(body), clientRequest);
+        if ('error' in started)
+            return c.json({ error: started.error }, started.status);
+        return c.json(started.run, started.status);
     })
         .get('/runs/:id', (c) => {
         const { store, manager } = c.get('project');
@@ -3791,6 +3170,12 @@ export function createApp(deps) {
                 titleOrigin: 'user',
             });
         }
+        if (parsed.data.archiveWhenDone !== undefined || parsed.data.autoMergePr !== undefined) {
+            store.updateRun(id, {
+                ...(parsed.data.archiveWhenDone === undefined ? {} : { archiveWhenDone: parsed.data.archiveWhenDone }),
+                ...(parsed.data.autoMergePr === undefined ? {} : { autoMergePr: parsed.data.autoMergePr }),
+            });
+        }
         return c.json(store.getRun(id));
     })
         .post('/runs/:id/cancel', (c) => {
@@ -3804,6 +3189,17 @@ export function createApp(deps) {
     })
         // Live-session participation (spec 002): deliver a user message (text +
         // pasted screenshots) into the run's open claude session.
+        .post('/runs/:id/permissions', paramZodValidator(permissionRunIdParamSchema), jsonZodValidator(permissionDecisionSchema), (c) => {
+        const { store, manager } = c.get('project');
+        const { id } = c.req.valid('param');
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        const { requestId, optionId } = c.req.valid('json');
+        if (!manager.respondPermission(id, requestId, optionId)) {
+            return c.json({ error: 'permission request is no longer available or option is invalid' }, 409);
+        }
+        return c.json({ delivered: true });
+    })
         .post('/runs/:id/messages', jsonZodValidator(messageSchema), async (c) => {
         const { store, manager } = c.get('project');
         const id = c.req.param('id');
@@ -4036,109 +3432,25 @@ export function createApp(deps) {
         const parsedBody = { data: c.req.valid('json') };
         const { target, path: relPath } = parsedBody.data;
         const dir = run.worktreePath && existsSync(run.worktreePath) ? run.worktreePath : repoRoot;
-        // Diff pane "open in OS default app" (#365): one worktree file, opened with the platform's
-        // default handler for its type — not a directory in the file manager (that's `finder`
-        // above) and not a session takeover (editors/CLIs above). `path` is re-validated against
-        // the worktree here regardless of what the schema allowed, so a stale/forged path can never
-        // escape it.
         if (target === 'default') {
-            if (!run.worktreePath || !existsSync(run.worktreePath)) {
-                return c.json({ error: NO_WORKTREE }, 409);
-            }
-            if (!relPath)
-                return c.json({ error: 'path required for the default-app target' }, 400);
-            const result = await readWorktreePath(run.worktreePath, relPath);
-            if (result.kind !== 'file') {
-                return c.json({
-                    error: result.kind === 'dir' ? `not a file: ${relPath}` : result.error,
-                }, 409);
-            }
-            // This route's whole contract is "preview an image in its default app", and containment
-            // alone does not enforce it. Without this gate any regular file in the worktree — a
-            // `.command`/`.desktop` an agent just wrote, an `.exe` — would be handed to the OS
-            // launcher, which EXECUTES it. Not remotely reachable (random run ids, same-origin, local
-            // mode), so: defense in depth.
-            //
-            // Deliberately `isOsOpenableImage`, NOT the raw route's `imageMimeType`: that list allows
-            // SVG on the strength of an `<img>` + no-script CSP the OS launcher never applies (the
-            // default `.svg` handler is usually a browser, which would run the file's `<script>`).
-            if (!isOsOpenableImage(result.path)) {
-                // Say which rule refused, in the route's own words — "limited to images" would be a lie
-                // to someone holding an SVG, which IS an image and DOES preview inline.
-                return c.json({
-                    error: imageMimeType(result.path)
-                        ? `SVG can carry scripts, so it previews inline but is never handed to the OS: ${result.path}`
-                        : `opening in the default app is limited to images: ${result.path}`,
-                }, 409);
-            }
-            const filePath = join(run.worktreePath, result.path);
-            const opened = await openFile(filePath);
-            if (!opened)
-                return c.json({ error: `could not open ${result.path}`, path: filePath }, 409);
-            return c.json({ opened: true, path: filePath });
-        }
-        // Coding-agent CLI handoff (#cli-handoff, #402): open a terminal in the worktree that resumes
-        // THIS run's latest session when the chosen CLI owns it (and a session exists), or
-        // starts a fresh CLI there otherwise. Same terminal launcher the Terminal button uses.
-        // Records that predate the runner choice carry no `runner` at all — they default to Claude
-        // everywhere else (resumeCommand, the client's resumeHint/cliTargetResumes), so the match
-        // check defaults the same way here; without it, a legacy run's own Claude CLI would never
-        // resume its own session, only ever launch fresh.
-        // A run the engine still owns never resumes: `sessionId` is seeded when the agent step STARTS
-        // (workflows/run.ts), so a running/queued/waiting run already carries one, and resuming it
-        // would attach a SECOND CLI process to the transcript the engine is actively writing. Those
-        // picks launch the CLI fresh in the worktree — the same degradation as a cross-runner pick,
-        // and what the client's cliTargetResumes now labels. Resume-after-finish is untouched.
+            return openRunDefaultApp(c, run, relPath, openFile, NO_WORKTREE);
+        }
         const cliRunner = agentCliRunner(target);
         if (cliRunner) {
-            const blocked = await providerActionError([cliRunner]);
-            if (blocked)
-                return c.json({ error: blocked }, 409);
-            const engineOwnsSession = run.status === 'running' || run.status === 'queued' || run.status === 'waiting';
-            const sessionStep = engineOwnsSession ? undefined : [...run.steps].reverse().find((s) => s.sessionId);
-            const sessionId = sessionStep?.sessionId;
-            // An id resumeCommand refuses (#431) degrades to a fresh CLI in the worktree,
-            // exactly like a run that never recorded a session.
-            const resume = sessionId && cliRunner === (sessionStep?.backend ?? run.runner ?? 'claude') ? resumeCommand(cliRunner, sessionId) : null;
-            // Runners with a CEZ_*_BIN override launch the configured binary, not the PATH name.
-            const command = resume ?? (cliRunner === 'cursor'
-                ? quoteExecutable(resolveCursorExecutable(), process.platform)
-                : cliRunner === 'omp' ? quoteExecutable(resolveOmpExecutable(), process.platform) : cliRunner);
-            if (command === null) {
-                return c.json({ error: `the configured ${cliRunner === 'omp' ? 'OMP' : 'Cursor'} executable cannot be used in a terminal command` }, 409);
-            }
-            // BOTH branches carry the account (spec 2026-07-29-agent-profiles): a resume needs the
-            // config dir that holds its session, and a FRESH CLI in this worktree should still open
-            // on the account the project works under — otherwise "Open in → Claude CLI" quietly
-            // hands the user a different subscription than every task in the same project uses.
-            const account = resume
-                ? await handoffEnv(cliRunner, sessionStep?.profileId)
-                : { env: (await resolveProfileEnvForRoot(repoRoot, cliRunner)).env };
-            if ('error' in account)
-                return c.json({ error: account.error }, 409);
-            const fallback = handoffFallbackCommand(dir, command, account.env);
-            if (fallback === null) {
-                return c.json({ error: 'this account\'s folder cannot be used in a terminal command' }, 409);
-            }
-            const opened = await openTerminal(dir, command, account.env);
-            if (!opened) {
-                return c.json({ error: 'no terminal emulator found', command: fallback }, 409);
-            }
-            return c.json({ opened: true, path: dir, command });
+            return openRunCli(c, run, cliRunner, dir, repoRoot, {
+                providerActionError, resumeCommand, handoffEnv, handoffFallbackCommand, openTerminal,
+            });
         }
-        const opened = await openApp(target, dir);
-        if (!opened)
-            return c.json({ error: `could not open ${target}`, path: dir }, 409);
-        return c.json({ opened: true, path: dir });
+        return openRunApp(c, target, dir, openApp);
     })
-        // Handoff journal (spec 007): the per-task handoff.md as markdown. 404 only
-        // when the task is unknown; a task without a (yet) seeded file returns ''.
+        // Handoff journal (spec 007): the per-task handoff.md as markdown, with cezar's records from the
+        // run store (hearsay-tools/cezarion#1809). 404 only when the task is unknown; no file returns ''.
         .get('/runs/:id/handoff', (c) => {
         const { dataDir, store } = c.get('project');
         const run = store.getRun(c.req.param('id'));
         if (!run)
             return c.json({ error: 'not found' }, 404);
-        return c.text(readHandoff(dataDir, run.id), 200, {
+        return c.text(renderHandoffRecords(readHandoff(dataDir, run.id), run.handoffRecords), 200, {
             'content-type': 'text/markdown; charset=utf-8',
         });
     })
@@ -4174,20 +3486,26 @@ export function createApp(deps) {
     })
         // Task diff (spec 006): what this run changed — its worktree vs its base.
         .get('/runs/:id/diff', async (c) => {
-        const { store } = c.get('project');
+        const { dataDir, store } = c.get('project');
         const run = store.getRun(c.req.param('id'));
         if (!run)
             return c.json({ error: 'not found' }, 404);
+        const blocker = autosaveCleanupBlocker(dataDir, run.id);
+        if (blocker)
+            return c.json({ error: blocker }, 409);
         if (!run.worktreePath || !existsSync(run.worktreePath)) {
             return c.text('(no worktree — this task ran directly in the repo working tree)');
         }
         return c.text(await worktreeDiff(run.worktreePath, run.baseBranch ?? 'HEAD'));
     })
         .get('/runs/:id/changes', async (c) => {
-        const { root: repoRoot, store } = c.get('project');
+        const { root: repoRoot, dataDir, store } = c.get('project');
         const run = store.getRun(c.req.param('id'));
         if (!run)
             return c.json({ error: 'not found' }, 404);
+        const blocker = autosaveCleanupBlocker(dataDir, run.id);
+        if (blocker)
+            return c.json({ error: blocker }, 409);
         const workingDirectory = workingDirectoryOf(run, repoRoot);
         if (!workingDirectory)
             return c.json({ error: NO_WORKTREE }, 409);
@@ -4304,7 +3622,7 @@ export function createApp(deps) {
         // An `Accept` that asks for images reaches the same raw branch without the flag — which is
         // what an `<img>` sends — while the flag still wins whenever it is present and `*<slash>*`
         // (every `fetch`) still gets the JSON listing. See `negotiate`.
-        .get('/runs/:id/files', queryZodValidator(z.object({ path: queryValue, raw: queryValue })), async (c) => {
+        .get('/runs/:id/files', queryZodValidator(worktreeFilesQuerySchema), async (c) => {
         const { root: repoRoot, store } = c.get('project');
         const query = c.req.valid('query');
         c.header('vary', 'Accept');
@@ -4364,10 +3682,13 @@ export function createApp(deps) {
         });
     })
         .post('/runs/:id/git/commit', jsonZodValidator(gitCommitSchema), async (c) => {
-        const { store } = c.get('project');
+        const { dataDir, store } = c.get('project');
         const run = store.getRun(c.req.param('id'));
         if (!run)
             return c.json({ error: 'not found' }, 404);
+        const blocker = autosaveCleanupBlocker(dataDir, run.id);
+        if (blocker)
+            return c.json({ error: blocker }, 409);
         const worktree = worktreeOf(run);
         if (!worktree)
             return c.json({ error: NO_WORKTREE }, 409);
@@ -4378,10 +3699,13 @@ export function createApp(deps) {
         return c.json({ committed: true, sha: result.sha });
     })
         .post('/runs/:id/git/push', async (c) => {
-        const { root: repoRoot, store } = c.get('project');
+        const { root: repoRoot, dataDir, store } = c.get('project');
         const run = store.getRun(c.req.param('id'));
         if (!run)
             return c.json({ error: 'not found' }, 404);
+        const blocker = autosaveCleanupBlocker(dataDir, run.id);
+        if (blocker)
+            return c.json({ error: blocker }, 409);
         const worktree = worktreeOf(run);
         if (!worktree)
             return c.json({ error: NO_WORKTREE }, 409);
@@ -4393,7 +3717,9 @@ export function createApp(deps) {
         // per number, so without this the cockpit would keep showing the pre-push answer (up to a
         // minute of "Ready to merge" for a branch that has just been rewritten) about a push the
         // user watched this server make.
-        for (const number of runPrNumbers(run))
+        const remote = parseRemote((await getRepoInfo(repoRoot))?.remote ?? '');
+        const repoBase = remote?.host === 'github.com' ? `https://github.com/${remote.owner}/${remote.repo}` : undefined;
+        for (const number of ownPullRequestNumbers(run, repoBase))
             forgetRefStatus(repoRoot, number);
         return c.json({
             pushed: true,
@@ -4469,10 +3795,18 @@ export function createApp(deps) {
             return c.json({ error: 'run is active — cancel it first' }, 409);
         if (run.delegation?.role === 'worker' || !store.canDeleteRun(id))
             return c.json({ error: 'owned resources require verified worker cleanup' }, 409);
-        if (run.worktreePath)
-            await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, id, repoRoot, run.worktreePath, run.branch);
-        store.updateRun(id, { worktreePath: undefined, branch: undefined });
-        return c.json({ removed: true });
+        const release = manager.claimForPublish(id);
+        if (!release)
+            return c.json({ error: 'worktree cleanup pending — retry after cleanup is confirmed' }, 409);
+        try {
+            if (run.worktreePath)
+                await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, id, repoRoot, run.worktreePath, run.branch);
+            store.updateRun(id, { worktreePath: undefined, branch: undefined });
+            return c.json({ removed: true });
+        }
+        finally {
+            release();
+        }
     })
         .delete('/runs/:id', async (c) => {
         const { root: repoRoot, store, manager } = c.get('project');
@@ -4485,97 +3819,17 @@ export function createApp(deps) {
         // Delete cleans up after itself: worktree + branch go with the run (spec 006).
         if (!store.canDeleteRun(id))
             return c.json({ error: 'owned resources require verified worker cleanup and explicit child history deletion first' }, 409);
-        if (run.delegation?.role !== 'worker' && run.worktreePath)
-            await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, id, repoRoot, run.worktreePath, run.branch);
-        return store.deleteRun(id) ? c.json({ deleted: true }) : c.json({ error: 'history cleanup incomplete — retry deletion' }, 409);
-    });
-    // ---- parallel variants (spec 010) -----------------------------------------
-    const groupRuns = (store, groupId) => store
-        .listGroupRuns(groupId)
-        .sort((a, b) => (a.variant ?? '').localeCompare(b.variant ?? ''));
-    // ---- chained family: variant groups (project-scoped) ----
-    const groupsRoutes = new Hono()
-        .get('/groups/:groupId', async (c) => {
-        const { dataDir, store } = c.get('project');
-        const runs = groupRuns(store, c.req.param('groupId'));
-        if (runs.length === 0)
-            return c.json({ error: 'not found' }, 404);
-        const detailed = await Promise.all(runs.map(async (r) => ({
-            id: r.id,
-            variant: r.variant ?? '?',
-            title: r.title,
-            status: r.status,
-            archived: r.archived,
-            tokensUsed: r.tokensUsed,
-            ...(r.inputTokens !== undefined ? { inputTokens: r.inputTokens } : {}),
-            ...(r.outputTokens !== undefined ? { outputTokens: r.outputTokens } : {}),
-            ...(r.costUsd !== undefined ? { costUsd: r.costUsd } : {}),
-            diffStat: r.worktreePath && existsSync(r.worktreePath)
-                ? await worktreeDiffStat(r.worktreePath, r.baseBranch ?? 'HEAD')
-                : '',
-            handoffExcerpt: handoffProgressExcerpt(readHandoff(dataDir, r.id)),
-        })));
-        return c.json({
-            groupId: c.req.param('groupId'),
-            runs: detailed,
-        });
-    })
-        // "Pick this one": the winner rests at `review` (spec 009 takes it from
-        // there — send back / draft PR / finish); the losers are cancelled if
-        // alive, archived, and their worktrees + branches removed.
-        .post('/groups/:groupId/pick', jsonZodValidator(pickSchema), async (c) => {
-        const { root: repoRoot, dataDir, store, manager } = c.get('project');
-        const runs = groupRuns(store, c.req.param('groupId'));
-        if (runs.length === 0)
-            return c.json({ error: 'not found' }, 404);
-        const parsed = { data: c.req.valid('json') };
-        const winner = runs.find((r) => r.id === parsed.data.runId);
-        if (!winner)
-            return c.json({ error: 'runId is not part of this group' }, 404);
-        if (manager.isActive(winner.id)) {
-            return c.json({ error: 'this variant is still active — wait for it to finish first' }, 409);
-        }
-        // Winner: a non-review terminal state with a non-empty diff flips to
-        // `review` (the settleSuccess rule) — but only when the review gate applies
-        // (#489): it is enabled (`reviewGateEnabled`, default off) AND the winner is
-        // not autonomous. An autonomous / gate-off winner keeps its `done` state with
-        // the diff left in the worktree; an empty diff (or no worktree) stays too.
-        if (winner.status !== 'review' &&
-            winner.worktreePath &&
-            existsSync(winner.worktreePath) &&
-            winner.autonomous !== true &&
-            reviewGateEnabled(await loadConfig(repoRoot))) {
-            const diff = await worktreeDiff(winner.worktreePath, winner.baseBranch ?? 'HEAD');
-            if (diff.trim().length > 0 && !diff.startsWith('(diff failed')) {
-                store.updateRun(winner.id, { status: 'review' });
-            }
+        const release = manager.claimForPublish(id);
+        if (!release)
+            return c.json({ error: 'worktree cleanup pending — retry after cleanup is confirmed' }, 409);
+        try {
+            if (run.delegation?.role !== 'worker' && run.worktreePath)
+                await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, id, repoRoot, run.worktreePath, run.branch);
+            return store.deleteRun(id) ? c.json({ deleted: true }) : c.json({ error: 'history cleanup incomplete — retry deletion' }, 409);
         }
-        const losers = runs.filter((r) => r.id !== winner.id);
-        store.appendEvent(winner.id, {
-            type: 'lifecycle',
-            message: `picked from ${runs.length} variants — ${losers.length} other variant(s) archived`,
-        });
-        appendHandoffHeartbeat(dataDir, winner.id, `picked from ${runs.length} variants`);
-        for (const loser of losers) {
-            if (manager.isActive(loser.id))
-                manager.cancel(loser.id);
-            // Owned workers use verified cleanup exclusively, even after history becomes deletable.
-            if (loser.delegation?.role === 'worker' || !store.canDeleteRun(loser.id))
-                continue;
-            if (loser.worktreePath)
-                await releaseThenRemoveWorktree({ previewHost: deps.previewHost }, loser.id, repoRoot, loser.worktreePath, loser.branch);
-            store.updateRun(loser.id, { worktreePath: undefined, branch: undefined });
-            store.setArchived(loser.id, true);
-            store.appendEvent(loser.id, {
-                type: 'lifecycle',
-                message: `variant ${winner.variant ?? '?'} was picked — this variant is archived, its worktree removed`,
-            });
+        finally {
+            release();
         }
-        // Spread: `getRun` may answer undefined, and an undefined VALUE is dropped by
-        // JSON.stringify — so writing the key unconditionally typed the route as sending a key it
-        // does not. contract/workflows.ts says `.optional()`, which is what a client receives.
-        const picked = store.getRun(winner.id);
-        return c.json({ ...(picked !== undefined ? { winner: picked } : {}) });
     });
     // ---- chained family: open-targets (project-scoped) ----
     const openTargetsRoutes = new Hono()
@@ -4636,17 +3890,6 @@ export function createApp(deps) {
         ? repoRoot
         : worktreeOf(run);
     const NO_WORKTREE = 'no worktree — this task ran directly in the repo working tree';
-    /** Every pull request number this run points at — the one it created and the one it is about
-     *  (#901), from whichever field carries it. Used to invalidate what the forge told us about
-     *  them when this server does something that changes the answer. Deliberately tolerant: an
-     *  unrecognized URL shape yields nothing rather than a guessed number. */
-    const runPrNumbers = (run) => {
-        const numbers = [
-            run.prNumber,
-            ...[run.pullRequestUrl, run.referencedPullRequestUrl].map((url) => url ? refNumberFromUrl(url) : null),
-        ];
-        return [...new Set(numbers.filter((n) => typeof n === 'number'))];
-    };
     // ---- chained family: worktrees (project-scoped) ----
     const worktreesRoutes = new Hono()
         .get('/worktrees', async (c) => {
@@ -4693,7 +3936,7 @@ export function createApp(deps) {
         // One row's reclaim (issue 08 §B4): the DIRECTORY only, by retention's own rule and helper —
         // the `cez/<id8>` branch is kept, which is what makes this safe to offer on every finished
         // row. `/runs/:id/remove-worktree` (directory AND branch) stays the task screen's action.
-        .post('/worktrees/:runId/reclaim', paramZodValidator(z.object({ runId: z.string().min(1) })), async (c) => {
+        .post('/worktrees/:runId/reclaim', paramZodValidator(reclaimRunParamsSchema), async (c) => {
         const { root: repoRoot, store, manager } = c.get('project');
         const run = store.getRun(c.req.valid('param').runId);
         if (!run)
@@ -4716,103 +3959,6 @@ export function createApp(deps) {
         forgetRepoBranches(repoRoot);
         return c.json({ runId: run.id, worktreeReclaimedAt });
     });
-    const reclaimBodySchema = z.object({}).passthrough();
-    /**
-     * "The inbox is on and this entry exists" — the 409/404 half of `POST /todos/:id/start`, lifted
-     * out of the handler and in FRONT of the body validator.
-     *
-     * That position is the whole point. The route's contract is that an unknown id 404s before the
-     * body is looked at, and Hono only records a body in the route type when it is validated as
-     * MIDDLEWARE — which necessarily runs before the handler. Registering this guard first satisfies
-     * both: the documented status order is unchanged, and `startTodoSchema` becomes visible to
-     * `AppType` (and so to `hc`) instead of being parsed invisibly inside the handler.
-     *
-     * Deliberately NOT annotated with a return type: the inferred one carries the two typed
-     * responses, which is what keeps the 409 and 404 branches in the route's schema for the client.
-     */
-    const todoMustExist = async (c, next) => {
-        if (!capabilities().followups)
-            return c.json({ error: FOLLOWUPS_OFF }, 409);
-        const todo = (await readTodos(c.get('project').dataDir)).find((t) => t.id === c.req.param('id'));
-        if (!todo)
-            return c.json({ error: 'not found' }, 404);
-        c.set('todo', todo);
-        await next();
-    };
-    // ---- chained family: follow-up inbox / todos (project-scoped) ----
-    const todosRoutes = new Hono()
-        .get('/todos', async (c) => c.json(capabilities().followups ? await readTodos(c.get('project').dataDir) : []))
-        // Check off = delete the entry.
-        .delete('/todos/:id', async (c) => {
-        const { dataDir } = c.get('project');
-        if (!capabilities().followups)
-            return c.json({ error: FOLLOWUPS_OFF }, 409);
-        const removed = await removeTodo(dataDir, c.req.param('id'));
-        return removed ? c.json({ removed: true }) : c.json({ error: 'not found' }, 404);
-    })
-        // "▶ Run": turn an inbox entry into a task — a one-off single-step workflow
-        // around the suggested skill when it exists, plain quick-task otherwise.
-        //
-        // TWO middlewares, and their ORDER is the contract. This route's documented status order
-        // (pinned by todos-start.test.ts) is that a disabled inbox 409s and an unknown id 404s BEFORE
-        // the body is looked at — which is why the body used to be parsed inline, invisible to `hc`.
-        // Hono runs route middleware in registration order, so `todoMustExist` FIRST keeps that order
-        // exactly while `jsonZodValidator` second is what records the body in the route type.
-        //
-        // The two no-body cases the old inline parse distinguished are carried by the validator's
-        // `absent`/`malformed` options: no body at all is `undefined` (the pre-#401 bodyless POST,
-        // which the optional schema accepts → 201), a truncated payload is `null` (which it rejects
-        // → 400, rather than passing as "no body" and silently starting a run).
-        .post('/todos/:id/start', todoMustExist, jsonZodValidator(startTodoSchema, { absent: undefined, malformed: null }), async (c) => {
-        const { root: repoRoot, dataDir, manager } = c.get('project');
-        const id = c.req.param('id');
-        const todo = c.get('todo');
-        const parsed = { data: c.req.valid('json') };
-        if (agentModelsLocked(repoRoot) &&
-            (parsed.data?.model?.trim() || parsed.data?.effort?.trim())) {
-            return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
-        }
-        if (todo.startedTaskId)
-            return c.json({ error: 'already started' }, 409);
-        let task = todoTaskText(todo);
-        if (parsed.data?.prompt)
-            task += `\n\n${parsed.data.prompt}`;
-        let workflow;
-        if (todo.suggestedSkill) {
-            const skills = await discoverSkills(repoRoot);
-            if (skills.some((s) => s.name === todo.suggestedSkill)) {
-                workflow = {
-                    name: '(inbox)',
-                    description: `Follow-up from the inbox — skill "${todo.suggestedSkill}"`,
-                    source: 'built-in',
-                    steps: [
-                        {
-                            id: 'task',
-                            name: 'Do the task',
-                            skill: todo.suggestedSkill,
-                            prompt: '{{task}}',
-                        },
-                    ],
-                };
-            }
-        }
-        if (!workflow) {
-            const { workflows } = await loadWorkflows(repoRoot);
-            workflow = workflows.find((w) => w.name === 'quick-task') ?? QUICK_TASK_WORKFLOW;
-        }
-        const fallback = parsed.data?.runner ?? (await loadConfig(repoRoot)).defaultRunner;
-        const blocked = await providerActionError(providersRequiredByWorkflow(workflow, fallback));
-        if (blocked)
-            return c.json({ error: blocked }, 409);
-        const run = manager.startRun(workflow, {
-            task,
-            runner: parsed.data?.runner,
-            model: parsed.data?.model,
-            effort: parsed.data?.effort,
-        });
-        await markStarted(dataDir, id, run.id);
-        return c.json({ run }, 201);
-    });
     // ---- chained family: SSE streams (project-scoped) ----
     const sseRoutes = new Hono()
         .get('/runs/:id/events', paramZodValidator(runIdParamSchema), queryZodValidator(runEventsQuerySchema), async (c) => {
@@ -4834,61 +3980,38 @@ export function createApp(deps) {
         const lastEventId = Number.parseInt(c.req.header('Last-Event-ID') ?? '', 10);
         const requestedAfter = Math.max(query.afterSeq ?? 0, Number.isSafeInteger(lastEventId) && lastEventId >= 0 ? lastEventId : 0);
         return streamSSENoBuffer(c, async (stream) => {
-            let replaying = true;
-            let maxSeq = requestedAfter;
-            const buffered = [];
-            // One endpoint, two SSE event names: v1 lines stay `run-event` (the name
-            // the legacy UI listened to — its default branch JSON-dumped unknown
-            // types into the transcript, which is why v2 never rode that name; the
-            // split outlives the R7 retirement as wire shape); protocol-v2 lines
-            // (dotted types, persisted snapshots AND ephemeral coalesced deltas)
-            // ride `ui-event`, which only v2-aware clients subscribe to.
-            // EventSource ignores names it has no listener for.
-            const writeEvent = (event) => stream.writeSSE({
-                id: String(event.seq),
-                event: isV2WireEventType(event.type) ? 'ui-event' : 'run-event',
-                data: JSON.stringify(event),
-            });
-            const onEvent = (payload) => {
-                if (payload.runId !== id)
-                    return;
-                if (replaying)
-                    buffered.push(payload.event);
-                else
-                    void writeEvent(payload.event);
-            };
+            const controller = new AbortController();
+            const stop = () => controller.abort();
             const onRun = (run) => {
-                if (run.id !== id)
-                    return;
-                void stream.writeSSE({ event: 'run', data: JSON.stringify(run) });
+                if (run.id === id)
+                    void stream.writeSSE({ event: 'run', data: JSON.stringify(run) });
             };
-            store.on('event', onEvent);
             store.on('run', onRun);
-            stream.onAbort(() => {
-                store.off('event', onEvent);
-                store.off('run', onRun);
-            });
-            const replay = query.cursor
-                ? await readEventsAfterLiveCursor(dataDir, id, query.cursor)
-                : { events: store.readEvents(id), boundarySeq: 0 };
-            maxSeq = Math.max(maxSeq, replay.boundarySeq);
-            for (const event of replay.events) {
-                if (event.seq <= maxSeq)
-                    continue;
-                await writeEvent(event);
-                maxSeq = event.seq;
-            }
-            replaying = false;
-            for (const event of buffered) {
-                if (event.seq > maxSeq)
-                    await writeEvent(event);
-            }
+            stream.onAbort(() => { stop(); store.off('run', onRun); });
+            const feed = subscribeRunFeed({ store, dataDir }, {
+                projectId: c.get('project').id, runId: id, afterSeq: requestedAfter,
+                ...(query.cursor ? { cursor: query.cursor } : {}),
+            }, {
+                event: async (event) => {
+                    await stream.writeSSE({ id: String(event.seq), event: isV2WireEventType(event.type) ? 'ui-event' : 'run-event', data: JSON.stringify(event) });
+                },
+                reset: () => { stop(); void stream.close(); },
+                // The legacy full-replay endpoint predates the finite batch limit. Preserve its
+                // ability to deliver a large persisted event; new multiplex clients rehydrate it.
+            }, controller.signal, Infinity);
             const run = store.getRun(id);
             if (run)
                 await stream.writeSSE({ event: 'run', data: JSON.stringify(run) });
-            while (!stream.aborted) {
-                await stream.writeSSE({ event: 'ping', data: '' });
-                await stream.sleep(15_000);
+            try {
+                while (!stream.aborted && !controller.signal.aborted) {
+                    await stream.writeSSE({ event: 'ping', data: '' });
+                    await stream.sleep(15_000);
+                }
+            }
+            finally {
+                stop();
+                store.off('run', onRun);
+                await feed;
             }
         });
     })
@@ -4905,15 +4028,6 @@ export function createApp(deps) {
                 event: 'run-deleted',
                 data: JSON.stringify({ id }),
             });
-            const sendTodos = async () => {
-                const items = await readTodos(dataDir).catch(() => []);
-                await stream.writeSSE({ event: 'todos', data: JSON.stringify(items) });
-            };
-            // Opt-in inbox (#471): subscribing is what creates this project's
-            // watcher (step 2.3), so with the capability off we never subscribe —
-            // no watcher, no fd. Scoped to this stream's dataDir: another
-            // project's todos.json writes never reach this connection.
-            const offTodos = capabilities().followups ? onTodosChanged(dataDir, () => void sendTodos()) : () => undefined;
             // Live resource telemetry (#348): the sampler ticks ~every 2 s only
             // while some run has a registered process; each tick is relayed as one
             // `usage` message (runId → {cpuPct, rssBytes, procCount}). Never
@@ -4934,7 +4048,6 @@ export function createApp(deps) {
             stream.onAbort(() => {
                 store.off('run', onRun);
                 store.off('deleted', onDeleted);
-                offTodos();
                 offUsage();
             });
             while (!stream.aborted) {
@@ -4953,7 +4066,7 @@ export function createApp(deps) {
             const attach = (project, ctx) => {
                 if (attached.has(project))
                     return;
-                const { store, dataDir } = ctx;
+                const { store } = ctx;
                 const onRun = (run) => void stream.writeSSE({
                     event: 'run',
                     data: JSON.stringify({ ...run, project }),
@@ -4962,16 +4075,6 @@ export function createApp(deps) {
                     event: 'run-deleted',
                     data: JSON.stringify({ id, project }),
                 });
-                const sendTodos = async () => {
-                    const items = await readTodos(dataDir).catch(() => []);
-                    await stream.writeSSE({
-                        event: 'todos',
-                        data: JSON.stringify({ project, items }),
-                    });
-                };
-                // Same opt-in gate as the per-project stream (#471): no capability, no
-                // watcher — and each subscription is scoped to its own dataDir (2.3).
-                const offTodos = capabilities().followups ? onTodosChanged(dataDir, () => void sendTodos()) : () => undefined;
                 store.on('run', onRun);
                 store.on('deleted', onDeleted);
                 attached.set(project, {
@@ -4979,7 +4082,6 @@ export function createApp(deps) {
                     detach: () => {
                         store.off('run', onRun);
                         store.off('deleted', onDeleted);
-                        offTodos();
                     },
                 });
             };
@@ -5041,18 +4143,13 @@ export function createApp(deps) {
                     detach();
                 attached.clear();
             });
+            await stream.writeSSE({ event: 'ready', data: JSON.stringify({ generation: serverGeneration }) });
             while (!stream.aborted) {
                 await stream.writeSSE({ event: 'ping', data: '' });
                 await stream.sleep(15_000);
             }
         });
     });
-    // ---- chained family: GitHub (project-scoped) ----
-    // These sit ABOVE the routes rather than with the family's other schemas below it, because a
-    // validator argument is evaluated when the route is REGISTERED — a schema declared further down
-    // would be in its temporal dead zone. (The schemas below are all read inside a handler, or
-    // passed as a thunk, which defers them past that point.)
-    const mergeNumberParams = z.object({ number: z.coerce.number().int().positive() });
     /** A ref-status list: `null` means malformed (the caller answers 400), `[]` means "not asked
      *  for". Absent and empty are the same request — neither names a number. */
     const parseRefNumbers = (raw) => {
@@ -5068,17 +4165,22 @@ export function createApp(deps) {
         }
         return numbers;
     };
-    const prChangesParams = z.object({ number: z.coerce.number().int().positive().safe() });
-    const prChangesQuery = z.object({ refresh: queryValue.refine((v) => v === undefined || v === '1') });
     const githubRoutes = new Hono()
         .get('/github', 
     // `limit` stays a bare string: the handler's `Number.parseInt`/`Number.isFinite` fallback to
-    // 30 already accepts `?limit=banana`, and a numeric schema would 400 it instead.
-    queryZodValidator(z.object({ limit: queryValue, refresh: queryValue })), async (c) => {
+    // 30 already accepts `?limit=banana`, and a numeric schema would 400 it instead. The
+    // cursors and done flags page each side on its own (hearsay-tools/cezarion#1183); the
+    // schema refuses a done side that also carries its cursor, and both sides done.
+    queryZodValidator(githubListQuerySchema), async (c) => {
         const { root: repoRoot } = c.get('project');
         const query = c.req.valid('query');
         const limit = Number.parseInt(query.limit ?? '', 10);
-        return c.json(await fetchGithub(repoRoot, query.refresh === '1', Number.isFinite(limit) ? limit : 30));
+        return c.json(await fetchGithub(repoRoot, query.refresh === '1', Number.isFinite(limit) ? limit : 30, {
+            issuesCursor: query.issuesCursor,
+            prsCursor: query.prsCursor,
+            issuesDone: query.issuesDone === '1',
+            prsDone: query.prsDone === '1',
+        }));
     })
         .get('/github/projects', queryZodValidator(githubProjectsQuerySchema), async (c) => {
         return c.json(await fetchGithubProjects(c.get('project').root, c.req.valid('query').generation));
@@ -5108,7 +4210,7 @@ export function createApp(deps) {
         // `prs` is the one genuinely REQUIRED query key on this server, so it is the one validated
         // strictly — `.min(1)` because `?prs=` answered `missing prs query` before it answered
         // `invalid prs query`, and both spellings must keep their own words.
-        .get('/github/checks', queryZodValidator(z.object({ prs: z.string().min(1) }), { message: 'missing prs query' }), async (c) => {
+        .get('/github/checks', queryZodValidator(githubChecksQuerySchema, { message: 'missing prs query' }), async (c) => {
         const { root: repoRoot } = c.get('project');
         const raw = c.req.valid('query').prs;
         const parts = raw.split(',').map((p) => p.trim()).filter(Boolean);
@@ -5122,6 +4224,14 @@ export function createApp(deps) {
             numbers.push(n);
         }
         return c.json(await fetchGithubChecks(repoRoot, numbers));
+    })
+        // Comment counts for loaded list rows (hearsay-tools/cezarion#1183). The list defers them
+        // (`commentsDeferred`) because they were ~0.4 s of every page; the cockpit asks here after
+        // paint. Same shape and in-payload degrade as /github/checks: at most 100 positive numbers,
+        // 400 on anything malformed, never a 5xx.
+        .get('/github/comment-counts', queryZodValidator(githubCommentCountsQuerySchema, { message: 'invalid comment-counts query' }), async (c) => {
+        const { kind, numbers, refresh } = c.req.valid('query');
+        return c.json(await fetchGithubCommentCounts(c.get('project').root, kind, numbers.split(',').map(Number), refresh === '1'));
     })
         // Search across ALL states (#730). Additive sibling of `/github`, which lists the OPEN set
         // only (`gh issue/pr list` defaults to `--state open`) — so the tab's in-memory filter can
@@ -5138,7 +4248,7 @@ export function createApp(deps) {
         // GH_REF_STATUS_MAX per kind, malformed input is a 400, and an unreachable forge degrades in
         // the payload. Unlike /github/checks BOTH keys are optional — a table may hold only issues —
         // but at least one must name something, or the request asks for nothing.
-        .get('/github/ref-status', queryZodValidator(z.object({ prs: z.string().optional(), issues: z.string().optional() })), async (c) => {
+        .get('/github/ref-status', queryZodValidator(githubRefsQuerySchema), async (c) => {
         const { root: repoRoot } = c.get('project');
         const { prs, issues } = c.req.valid('query');
         const parsedPrs = parseRefNumbers(prs);
@@ -5205,11 +4315,6 @@ export function createApp(deps) {
         kind: z.enum(['issue', 'pr']),
         number: z.coerce.number().int().positive(),
     });
-    const mergeBodySchema = z.object({
-        method: z.enum(['merge', 'squash', 'rebase']),
-        expectedHeadSha: z.string().regex(/^[0-9a-f]{40}$/),
-        overrideRules: z.boolean().optional().default(false),
-    }).strict();
     /** What the branch classifier reads for one project, or null outside a repository. */
     const branchClassifyInput = async (project) => {
         const info = await getRepoInfo(project.root);
@@ -5309,7 +4414,7 @@ export function createApp(deps) {
         // `Accept: application/json` reaches the same structured answer without the flag, and
         // `Accept: text/plain` asks for the blob; the flag still wins whenever it is present, and a
         // request with no opinion still gets the blob. See `negotiate`.
-        .get('/repo/commit/:sha', queryZodValidator(z.object({ structured: queryValue })), async (c) => {
+        .get('/repo/commit/:sha', queryZodValidator(commitQuerySchema), async (c) => {
         const { root: repoRoot } = c.get('project');
         c.header('vary', 'Accept');
         const { structured } = c.req.valid('query');
@@ -5397,10 +4502,14 @@ export function createApp(deps) {
     // The Settings → Agents knobs in one read (R6 Step 1.5) — an ADDITIVE
     // sibling of PUT /api/config below; /api/health keeps its protected shape.
     const configAnswer = async (repoRoot, config) => {
+        const archive = resolveArchiveOnMerge(config, await loadWorkspaceConfig());
         const nativeModels = await readAgentModelDefaults(repoRoot);
         const setup = resolveWorktreeSetup(config.worktreeSetup);
         const modelsLocked = agentModelsLocked(repoRoot);
         return {
+            archiveOnMerge: config.archiveOnMerge ?? null,
+            effectiveArchiveOnMerge: archive.enabled,
+            archiveOnMergeSource: archive.source,
             baseBranch: config.baseBranch ?? null,
             defaultRunner: config.defaultRunner,
             systemPrompt: config.systemPrompt ?? null,
@@ -5486,6 +4595,12 @@ export function createApp(deps) {
             else
                 raw.liveTitleUpdates = parsed.data.liveTitleUpdates;
         }
+        if (parsed.data.archiveOnMerge !== undefined) {
+            if (parsed.data.archiveOnMerge === null)
+                delete raw.archiveOnMerge;
+            else
+                raw.archiveOnMerge = parsed.data.archiveOnMerge;
+        }
         if (parsed.data.reviewGate !== undefined) {
             if (parsed.data.reviewGate === null)
                 delete raw.reviewGate;
@@ -5537,50 +4652,11 @@ export function createApp(deps) {
         catch (err) {
             return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
         }
+        if (parsed.data.archiveOnMerge !== undefined)
+            deps.archiveOnMergeChanged?.();
         // Pre-R6 answer shape ({baseBranch, defaultRunner}) + additive R6 fields.
         return c.json(await configAnswer(repoRoot, await loadConfig(repoRoot)));
     });
-    // Set/clear the agents' config knobs (Settings → Agents; the Repo tab's
-    // base-branch picker). Merges into the RAW config.json so user keys
-    // (skillsRepos…) survive and schema defaults are never materialized into
-    // the file. All fields optional + additive: `null` (and `''` for the
-    // R6 keys) clears a knob back to its default.
-    const modelPresetSchema = z.string().trim().max(200).nullable().optional();
-    const setConfigSchema = z.object({
-        baseBranch: z.string().trim().min(1).max(200).nullable().optional(),
-        defaultRunner: z.enum(RUNNER_IDS).optional(),
-        systemPrompt: z.string().trim().max(20_000, 'must be at most 20000 characters').nullable().optional(),
-        defaultModels: z
-            .object({
-            claude: modelPresetSchema,
-            codex: modelPresetSchema,
-            opencode: modelPresetSchema,
-            pi: modelPresetSchema,
-            omp: modelPresetSchema,
-            cursor: modelPresetSchema,
-        })
-            .optional(),
-        // Concurrency + memory guard (Settings → Resources). maxParallel clamps to
-        // the schema's 1–16; memoryLimitMb null/0 clears the ceiling.
-        maxParallel: z.number().int().min(1).max(16).optional(),
-        memoryLimitMb: z.number().int().min(0).max(1_048_576).nullable().optional(),
-        // Worktree retention count (Settings → Resources, #483). 0 = unlimited;
-        // null clears the key back to the schema default (10). Unlike memoryLimitMb,
-        // 0 is a meaningful value (unlimited), so it is stored, not treated as clear.
-        worktreeRetention: z.number().int().min(0).max(1000).nullable().optional(),
-        // Live title updates toggle (Settings → Agents): null clears the key back
-        // to the env-default behavior.
-        liveTitleUpdates: z.boolean().nullable().optional(),
-        // Optional review gate toggle (Settings → Agents, #489): null clears the key
-        // back to the env-default behavior (OFF).
-        reviewGate: z.boolean().nullable().optional(),
-        // Worktree setup (Settings → Worktrees, #917): null or [] deletes the key.
-        worktreeSetup: worktreeSetupConfigSchema.nullable().optional(),
-    });
-    const setAgentConfigSchema = z.object({
-        content: z.string().max(2_000_000),
-        version: z.string().nullable(),
-    });
     // ---- chained family: agent-config (project-scoped) -----------------------
     // Agent config is project-scoped (spec #404, adapted to the multi-project
     // route seam from #521): handlers resolve the selected repo through the
@@ -5624,24 +4700,51 @@ export function createApp(deps) {
             return c.json({ error: out.error }, out.status);
         return c.json(out.read);
     });
-    // Repo view branch actions: switch to an existing branch, or create one
-    // (from `from` or HEAD) and switch. Predictable git failures — invalid
-    // name, unknown `from`, dirty-tree checkout conflict — are 409 + reason.
-    const repoBranchSchema = z.object({
-        name: z.string().trim().min(1).max(200),
-        from: z.string().trim().min(1).max(200).optional(),
-    });
     // ---- assemble the chained families --------------------------------------
     // Every chained family is registered ONCE and mounted into the versioned table. There is no
     // second, unversioned spelling: `/api/*` was removed once the whole API was reachable under
     // `/api/v1` (BACKWARD_COMPATIBILITY.md §2). One surface means one thing to keep working, and
     // it is the one the typed client describes.
     //
+    // ---- chained family: voice mode (project-scoped, gated on CEZ_VOICE) ----
+    const voiceRoutes = createVoiceRoutes({
+        voiceEnabled: () => capabilities().voice,
+        engine: () => selectVoiceEngine(process.env),
+        recent: new RecentVoiceActions(),
+    });
     // MOUNT ORDER IS REGISTRATION ORDER. Hono matches in the order routes were added, so each
     // family keeps its internal order and the families keep theirs relative to each other.
     //
     // Written as ONE chained expression because that is the only shape Hono can infer route types
     // from — it is what puts these routes in `AppType`, and so in the typed client.
+    // ---- chained family: agent webhooks (hearsay-tools/cezarion#1576, project-scoped) ----
+    // What `cez webhook` calls from inside a task: list the webhooks the owner exposed to agents in
+    // this project, and send one report through one of them. A webhook closed to agents answers
+    // the same 404 as an unknown one, so this interface cannot even confirm it exists.
+    const agentWebhooksRoutes = new Hono()
+        .get('/agent-webhooks', async (c) => {
+        const project = c.get('project');
+        const body = { webhooks: agentWebhooks(await registryEntry(project.id, project.root).catch(() => undefined)) };
+        return c.json(body);
+    })
+        .post('/agent-webhooks/:webhook', paramZodValidator(agentWebhookParamsSchema.pick({ webhook: true })), jsonZodValidator(sendAgentReportInputSchema), async (c) => {
+        const project = c.get('project');
+        const { webhook: ref } = c.req.valid('param');
+        const entry = await registryEntry(project.id, project.root).catch(() => undefined);
+        const webhook = agentWebhook(entry, ref);
+        if (!entry || !webhook)
+            return c.json({ error: `no webhook named "${ref}" is open to agents in this project — run \`cez webhook list\`` }, 404);
+        const outcome = await sendAgentReport({
+            projectId: entry.id,
+            webhook,
+            input: c.req.valid('json'),
+            store: project.store,
+            origin: taskWebhooks.currentOrigin(),
+            fetch: deps.taskWebhookFetch,
+        });
+        const body = { ...outcome, webhook: { id: webhook.id, name: webhook.name } };
+        return c.json(body);
+    });
     const v1 = new Hono()
         .use('*', resolveProjectScope)
         .route('/', launchKeyRoutes)
@@ -5650,16 +4753,16 @@ export function createApp(deps) {
         .route('/', workflowsRoutes)
         .route('/', planRoutes)
         .route('/', automationsRoutes)
+        .route('/', agentWebhooksRoutes)
         .route('/', runsRoutes)
-        .route('/', groupsRoutes)
         .route('/', openTargetsRoutes)
         .route('/', worktreesRoutes)
-        .route('/', todosRoutes)
         .route('/', sseRoutes)
         .route('/', githubRoutes)
         .route('/', repoRoutes)
         .route('/', configRoutes)
-        .route('/', agentConfigRoutes);
+        .route('/', agentConfigRoutes)
+        .route('/', voiceRoutes);
     projectRoutePaths = new Set(v1.routes.filter((route) => route.method !== 'ALL')
         .flatMap((route) => [V1_PREFIX, V1_SCOPED_PREFIX].map((prefix) => `${route.method} ${prefix}${route.path}`)));
     // ---- chained family: the cross-project run index (workspace-level) -------
@@ -5684,7 +4787,7 @@ export function createApp(deps) {
      * the client will not paint is free and asking about one it will is the whole point.
      */
     const mentionedReferenceNumbers = (run) => {
-        const numbers = [];
+        const numbers = (run.pullRequests ?? []).map(pr => pr.number);
         for (const url of [run.pullRequestUrl, run.referencedPullRequestUrl, run.referencedIssueUrl]) {
             const number = url ? refNumberFromUrl(url) : null;
             if (number !== null)
@@ -5832,13 +4935,22 @@ export function createApp(deps) {
     });
     // Workspace-level families answer for the whole workspace, so they are single-mount: never a
     // project-scoped spelling, which would be a second surface to protect with no consumer.
+    const liveRoutes = createLiveRoutes({
+        serverGeneration, resolveBootProject,
+        resolveProject: async (id) => {
+            const bootId = await resolveBootProject();
+            if (id === 'default' || id === bootId)
+                return { ...bootContext, id: bootId };
+            return contexts.context(id);
+        },
+    });
     const workspaceV1 = new Hono()
+        .route('/', liveRoutes)
         .route('/', healthRoutes)
         .route('/', modelsRoutes)
         .route('/', providersRoutes)
         .route('/', projectsRoutes)
         .route('/', agentProfilesRoutes)
-        .route('/', skillsUpdateRoutes)
         .route('/', applicationUpdateRoutes)
         .route('/', workspaceConfigRoutes)
         .route('/', fsBrowseRoutes)
@@ -5871,15 +4983,22 @@ export function createApp(deps) {
     return routed;
 }
 /** The host a thread link names (#589): the bound one, or loopback for a wildcard bind. */
+/** The built-in skills a project's manager offers (#774). Test apps inject partial managers. */
+function builtinSkillsOf(manager) {
+    return manager.builtinSkills?.() ?? [];
+}
 function taskWebhookHost(bindHost) {
     if (!bindHost || bindHost === '0.0.0.0' || bindHost === '::')
         return '127.0.0.1';
     return bindHost.includes(':') ? `[${bindHost}]` : bindHost;
 }
-const NO_WEBHOOK_ERROR = 'this project has no task webhook — set one in Settings → General → Task webhook, or start without notify';
+/** The origin a local client reaches this cockpit at: `CEZ_COCKPIT_URL` and the task webhook's links (#774, #594). */
+export function cockpitOriginFor(bindHost, port) {
+    return `http://${taskWebhookHost(bindHost)}:${port}`;
+}
+const webhookNameTakenError = (name) => `this project already has a webhook named "${name.trim()}" — pick another name`;
 export function startServer(deps, port, listener) {
     const workspaceEvents = deps.workspaceEvents ?? new WorkspaceEventBus();
-    const skillsUpdate = deps.skillsUpdate ?? new SkillsUpdateService({ invalidateCatalog: refreshTeamSkills });
     // The subscription hub rides the same HTTP server (one port, zero config):
     // createApp registers the topics, the `upgrade` hook below owns the socket.
     const socketHub = deps.socketHub ?? createSocketHub();
@@ -5891,6 +5010,14 @@ export function startServer(deps, port, listener) {
     const bootProjectId = deps.bootProjectId ?? 'default';
     const bootAutomationStore = automationCoordinator.store(bootProjectId, deps.repoRoot);
     const taskWebhooks = deps.taskWebhooks ?? new TaskWebhooks({ fetch: deps.taskWebhookFetch });
+    // #774: the bound origin every agent env carries (`CEZ_COCKPIT_URL`), so `cez automation` calls
+    // this cockpit instead of probing ports. Unset until `listening`; a project built after that is
+    // addressed in `prepareManager`, before its recovery resumes anything.
+    let cockpitOrigin;
+    const addressManager = (project) => {
+        if (cockpitOrigin)
+            project.manager.setCockpitAddress?.({ origin: cockpitOrigin, projectId: project.id });
+    };
     const sharedContexts = deps.contexts ?? new ProjectContexts({
         ownership: deps.ownership,
         listProjects,
@@ -5900,10 +5027,44 @@ export function startServer(deps, port, listener) {
         automationStore: (projectId, root) => automationCoordinator.store(projectId, root),
         prepareManager: (project) => {
             taskWebhooks.attach(project);
+            addressManager(project);
             return deps.delegation?.attachProject(project);
         },
         afterRecover: (project) => deps.delegation?.service.armDestroyRetries(project.id),
     });
+    const archiveDeps = {
+        projects: async () => {
+            const boot = { id: bootProjectId, root: deps.repoRoot, status: 'ok' };
+            if (resolveCapabilities(process.env, deps.bindHost).singleProject)
+                return [boot];
+            return [boot, ...(await listProjects()).filter(project => project.id !== bootProjectId && project.root !== deps.repoRoot)];
+        },
+        enabled: async (project) => resolveArchiveOnMerge(await loadConfig(project.root), await loadWorkspaceConfig()).enabled,
+        repository: async (project) => {
+            const repository = await discoverRepoHandle(project.root);
+            return repository.status === 'resolved' ? `https://github.com/${repository.handle.owner}/${repository.handle.name}` : undefined;
+        },
+        withStore: async (project, work) => {
+            if (project.root === deps.repoRoot)
+                return work(deps.store, id => deps.manager.isActive?.(id) ?? false, () => server.listening);
+            return sharedContexts.withMaintenanceStore(project.id, (store, valid) => work(store, id => sharedContexts.peek(project.id)?.manager.isActive(id) ?? false, valid));
+        },
+        lookup: lookupMergedPullRequests,
+    };
+    const archiveOnMerge = new ArchiveOnMergeCoordinator(archiveDeps);
+    const completionActions = new CompletionActionCoordinator({
+        projects: archiveDeps.projects,
+        withStore: (project, work) => archiveDeps.withStore(project, (store, _active, valid) => work(store, valid)),
+        forge: async (project) => {
+            const info = await getRepoInfo(project.root);
+            const driver = resolveForge(info);
+            const repository = info?.remote ? forgeWebRoot(info.remote) : null;
+            return driver && repository ? { driver, repository } : undefined;
+        },
+        head: (project, branch) => getBranchHead(project.root, branch),
+    });
+    // Injected contexts (tests) skip `prepareManager`.
+    sharedContexts.onContextBuilt(addressManager);
     // #801: GitHub automations are opt-in. Off, the flag must remove the BEHAVIOR and not merely
     // the UI — no scheduler, no GitHub polling, no launched runs — so every entry point into the
     // workspace scheduler below is gated on it. Read per call rather than captured, for the same
@@ -5916,10 +5077,10 @@ export function startServer(deps, port, listener) {
         contexts: sharedContexts,
         automationStore: bootAutomationStore,
         workspaceEvents,
-        skillsUpdate,
         socketHub,
         cezarPort,
         projectLookup,
+        archiveOnMergeChanged: () => archiveOnMerge.invalidate(),
         automationsChanged: () => rescheduleAutomations(),
     });
     // SECURITY: default to loopback. This server executes agents locally and its endpoints are
@@ -5957,10 +5118,9 @@ export function startServer(deps, port, listener) {
     // handler without closing/rebinding; direct server callers retain normal startup.
     if (listener) {
         listener.removeAllListeners('request');
-        listener.on('request', getRequestListener(serverOptions.fetch, { hostname: serverOptions.hostname }));
+        listener.on('request', getRequestListener(serverOptions.fetch, defined({ hostname: serverOptions.hostname })));
     }
     const server = listener ?? serve(serverOptions);
-    const coordinator = new SkillsUpdateCoordinator(skillsUpdate, async () => effectiveSkillsAutoUpdate(await loadWorkspaceConfig()));
     // EVERY registered project, remote or not: a schedule needs none. `github` is present only for
     // a github.com remote, and only then does the project's handle poll.
     const automationProjects = new Map();
@@ -6055,7 +5215,6 @@ export function startServer(deps, port, listener) {
         if (event === 'project-added') {
             const project = data.project;
             if (project && typeof project.id === 'string' && typeof project.root === 'string' && project.status !== 'missing') {
-                coordinator.add(project.id, project.root);
                 const { id, root } = project;
                 void rememberAutomationProject(id, root).then(() => {
                     if (!automationsEnabled())
@@ -6067,8 +5226,6 @@ export function startServer(deps, port, listener) {
         }
         else if (event === 'project-removed') {
             const id = data.id;
-            if (typeof id === 'string')
-                coordinator.remove(id);
             if (typeof id === 'string') {
                 automationCoordinator.remove(id);
                 automationProjects.delete(id);
@@ -6077,15 +5234,26 @@ export function startServer(deps, port, listener) {
         }
     });
     const startBackgroundServices = () => {
+        archiveOnMerge.start();
+        completionActions.start();
         void listProjects().then((projects) => {
             const all = projects.some((project) => project.root === deps.repoRoot)
                 ? projects : [{ id: deps.bootProjectId ?? 'default', root: deps.repoRoot, status: 'ok' }, ...projects];
-            coordinator.start(all);
             // #781: every registered project's preview leftovers, not only the boot project's.
             void sweepRegisteredPreviewLeftovers(all, deps.previewHost).catch(() => 0);
+            // #667: build every other project's context now, so the first click on one does not pay
+            // its store open, worktree sweeps and recovery. The boot project is built already.
+            // Not after a close that landed while the registry was being read: `disposeAll` has run, and
+            // a warm-up started now would build contexts nothing will ever dispose.
+            // Not in single-project mode either: every other project is out of reach there, and
+            // building one would resume its interrupted runs behind the operator's back.
+            if (projectWarmupEnabled() && server.listening && !resolveCapabilities(process.env, deps.bindHost).singleProject) {
+                const bootId = deps.bootProjectId ?? 'default';
+                void sharedContexts.warmAll(all.filter((project) => project.id !== bootId && project.root !== deps.repoRoot))
+                    .catch(() => undefined);
+            }
             // #801: with automations off there is nothing to warm — no remote to resolve, no receipts
-            // to reconcile, and above all no scheduler to start. The skills-update coordinator above is
-            // a separate feature and starts either way.
+            // to reconcile, and above all no scheduler to start.
             if (!automationsEnabled())
                 return;
             void Promise.all(all.map(async (project) => {
@@ -6108,31 +5276,34 @@ export function startServer(deps, port, listener) {
         server.once('listening', startBackgroundServices);
     // The boot store's preview leftovers and run deletions; lazy projects arm theirs at build.
     armPreview(deps.store, join(deps.repoRoot, '.ai/cezar'), deps.previewHost);
-    const previewSocket = createPreviewSocket({
-        host: deps.previewHost,
+    const previewSockets = createPreviewSockets({
+        host: deps.previewHost, cockpitOrigin: () => cockpitOrigin,
         verify: (req) => verifyWsUpgrade(req, deps.bindHost),
         resolveProject: async (projectId) => projectLookup.resolve?.(projectId),
     });
     server.once('close', () => {
         unsubscribe();
-        coordinator.stop();
+        archiveOnMerge.stop();
+        completionActions.stop();
         automationScheduler.stop();
         sharedContexts.disposeAll();
         void deps.delegation?.close();
         socketHub.close();
-        previewSocket.close();
+        previewSockets.close();
         void deps.previewHost?.close().catch(() => undefined);
     });
-    // The one `upgrade` listener: the subscription bus and the preview pane's socket (#781).
-    attachUpgradeRouter(server, [socketHubRoute(socketHub, (req) => verifyWsUpgrade(req, deps.bindHost)), previewSocket.route]);
+    // The one `upgrade` listener: the subscription bus and the preview's sockets (hearsay-tools/cezarion#781).
+    attachUpgradeRouter(server, [socketHubRoute(socketHub, (req) => verifyWsUpgrade(req, deps.bindHost)), ...previewSockets.routes]);
     const shutdownForRestart = async () => {
+        archiveOnMerge.stop();
+        completionActions.stop();
         sharedContexts.disposeAll(); // close every built secondary project before old process exits
         deps.store.flush();
         socketHub.close();
         // Dev servers run in their own process groups: they outlive cezar unless stopped here.
         // A failed release must not abort the restart halfway, with the store flushed and the port still bound.
         await deps.previewHost?.close().catch(() => undefined);
-        previewSocket.close();
+        previewSockets.close();
         await deps.delegation?.close();
         await new Promise((resolve) => {
             server.close(() => resolve());
@@ -6150,7 +5321,14 @@ export function startServer(deps, port, listener) {
         const address = server.address();
         const bound = address && typeof address === 'object' ? address.port : port;
         listeningPort = bound;
-        taskWebhooks.setOrigin(`http://${taskWebhookHost(deps.bindHost)}:${bound}`);
+        cockpitOrigin = cockpitOriginFor(deps.bindHost, bound);
+        taskWebhooks.setOrigin(cockpitOrigin);
+        addressManager({ id: bootProjectId, manager: deps.manager });
+        for (const id of sharedContexts.ids()) {
+            const context = sharedContexts.peek(id);
+            if (context)
+                addressManager(context);
+        }
     };
     if (server.listening)
         setTaskWebhookOrigin();
@@ -6159,37 +5337,9 @@ export function startServer(deps, port, listener) {
     return Object.assign(server, { shutdownForRestart });
 }
 /**
- * The WebSocket twin of the `/api/*` request-origin guard (#426), applied
- * before the `/api/v1/ws` handshake. WebSocket is NOT subject to CORS — any web
- * page may open `ws://127.0.0.1:<port>/api/v1/ws` and, unlike a forced HTTP GET,
- * would get to READ what comes back — so this guard is load-bearing:
- *
- *   1. Host allowlist (local mode): a non-loopback Host is a DNS-rebound
- *      request; kill it before the handshake. Same anchored
- *      `isLoopbackHostHeader` rules as the HTTP guard.
- *   2. Origin check: browsers always attach `Origin` to a WS handshake. A
- *      same-authority Origin is the cockpit itself. A LOOPBACK origin with a
- *      loopback Host is also admitted — that is the `npm run dev` Vite proxy
- *      (`changeOrigin` rewrites Host, the browser's `localhost:5173` Origin
- *      survives). Unlike the HTTP write guard we cannot REQUIRE `Sec-Fetch-Site`
- *      here — Safari sends no `Sec-Fetch-*` at all and requiring it would lock
- *      the dev proxy out of it — but we do honor it when it is there: Chromium
- *      does send it on a WS handshake, and page JS cannot forge it (forbidden
- *      header name), so a cross-port attacker page announcing `same-site` is
- *      rejected on the browser that ships it while Safari/Firefox still fall
- *      back to the loopback rule. Best available, not fail-open.
- *      No Origin at all is a non-browser client — same stance as the HTTP guard.
- *
- * The loopback-origin fallback still admits, on a browser that sends no
- * `Sec-Fetch-Site`, a page served from ANOTHER loopback port. That is no longer
- * a caveat the caller must remember: the verdict carries a `trusted` flag, and
- * the hub only lets an UNtrusted connection subscribe to topics a publisher
- * marked `loopbackReadable`. `health` is flagged so (the CORS-open discovery
- * payload, #431); every other topic stays trusted-only by default, so a topic
- * carrying run or repo content is mechanically unreachable from a foreign local
- * page without any per-topic vigilance. A connection is `trusted` when it is
- * provably the cockpit itself: a same-authority Origin, a no-Origin native
- * client, or a dev proxy the browser vouches for via `Sec-Fetch-Site`.
+ * Validate topic-bus upgrades before handshake. Local Host must be loopback. Same-authority or
+ * native clients are trusted; verified dev proxies are trusted. Metadata-free foreign loopback
+ * origins are untrusted and may read only loopbackReadable topics.
  */
 export function verifyWsUpgrade(req, bindHost) {
     const host = req.headers.host;
@@ -6287,20 +5437,8 @@ export function isSafeSessionId(sessionId) {
     return SAFE_SESSION_ID.test(sessionId);
 }
 /**
- * The CLI command that reopens a run's session for interactive take-over, per
- * backend. Legacy/undefined records default to Claude. Returns null when the id
- * is not a shape we recognise — callers degrade (no take-over) rather than
- * splice it into a shell.
- *
- * Validate, don't quote (#431): the session id is the only variable spliced
- * into the command string, and `openInTerminal` runs that string through bash
- * on darwin/linux but through `cmd /K` on win32. cmd.exe does not treat `'` as
- * a quote character, so POSIX-quoting the id handed Windows users a literal
- * `claude --resume '9f8e…'` and Claude answered "no conversation found".
- * Constraining the charset to one with no metacharacter in ANY of those shells
- * needs no quoting at all and fails closed on an unexpected id — a stronger
- * guarantee than escaping, and platform-independent. Ids are UUID/CLI-minted
- * today; this keeps a future source safe.
+ * Build native session takeover commands. Legacy/undefined backend defaults to Claude. Refuse
+ * unrecognized session-id shapes rather than embedding unsafe or platform-misquoted values.
  */
 export function resumeCommand(runner, sessionId) {
     if (!isSafeSessionId(sessionId))