@jr2/orchestrator 0.2.1 → 0.4.1

package/src/run-host.ts

@@ -7,7 +7,7 @@
 //     closures over their own `sendBack` — so delivery lands on the invoking state at any
 //     nesting depth and the host routes nothing.
 //   - Two thin surfaces sit on that table, and NEITHER is MCP (ADR-0013 — the Orchestrator does
-//     not speak it): `agentSurface` / `sendToAgent` serve the Agent's Adapter (`/agents/:iid/*`),
+//     not speak it): `agentSurface` / `sendToAgent` serve the Agent's Harness (`/agents/:iid/*`),
 //     `gates` / `sendToGate` serve humans, webhooks and CI (`/runs/:id/gates/*`). Lookup,
 //     validation, delivery and lifecycle stay implemented once, in the table.
 //   - The run's Agent children report their durable admissions through the run binding into
@@ -21,29 +21,82 @@
 
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
-import { createActor, type AnyActor, type AnyActorLogic, type AnyActorRef, type AnyStateMachine } from "xstate";
-import type { EventSemantics } from "@jr2/agent-protocol";
+import {
+  createActor,
+  type AnyActor,
+  type AnyActorLogic,
+  type AnyActorRef,
+  type AnyEventObject,
+  type AnyMachineSnapshot,
+  type AnyStateMachine,
+} from "xstate";
+import { SENDER_KEY, type EventDef, type EventSemantics, type Sender } from "@jr2/agent-protocol";
+import { partiesAt, seatOf, senderText } from "./party.ts";
+import { placeAnswers, type AnswerSeat } from "./pick.ts";
 import { inputSchemaOf } from "./vocabulary.ts";
-import type { EchoEvent, EchoStatusChild } from "./wire.ts";
+import type { EchoEvent, EchoStatusChild, LiveConversation, PickAnswer } from "./wire.ts";
+import { answerOf, childErrorOf, replyOf, type Hold } from "./holds.ts";
+import { restOf, runningBelow } from "./rest.ts";
 import {
+  acceptsNow,
   agentAddress,
+  allowedPicks,
   bindRun,
   EventValidationError,
   gateAddress,
-  mayMove,
+  NotTakenError,
+  OutstandingError,
   RegistrationTable,
+  refuseSenderField,
   UnknownAddressError,
   wouldMove,
+  targetsOf,
+  leftAgain,
+  type Registration,
   type RetryTelemetry,
   type RunBinding,
-  type TurnMarker,
+  type RunMarker,
 } from "./registration.ts";
-import type { SandboxPort } from "./workspace.ts";
+import { NoticeLedger, type NoticeLedgerState } from "./notices.ts";
+import { pendingTimers, startAndRearm, watchTimers, type PendingTimer } from "./timers.ts";
+import {
+  DEFAULT_LEASE_INTERVAL_MS,
+  WORKSPACE_WAIT_KEY,
+  leaseDelay,
+  workspaceName,
+  type SandboxPort,
+  type WorkspaceWait,
+} from "./workspace.ts";
+import { INSTANCE_HARNESS_SERVICE } from "./names.ts";
+import { composesSandbox } from "./parts.ts";
 import { fingerprintOf } from "./fingerprint.ts";
-import { serializeMachine, type MachineDoc } from "./machine-doc.ts";
+import {
+  serializeMachine,
+  type ChildMachineDoc,
+  type MachineBodyDoc,
+  type MachineDoc,
+  type MachineStateDoc,
+} from "./machine-doc.ts";
 import type { SnapshotStore } from "./snapshot-store.ts";
 import type { AgentAdmission } from "./actor.ts";
+import { dropSavedTails, type EffectRow } from "./effect.ts";
+import type { EffectorPlacement, EffectorTarget } from "./http-effect.ts";
 import { reattachAgentRuns, serializeSnapshot } from "./durability.ts";
+import { admitChart, chartBriefingOf, chartHash, ChartRefusal, isChartSchema, type ChartText } from "./chart.ts";
+import type { ChartOrigin, NamedChart } from "./charts.ts";
+import {
+  admitBodyChart,
+  admitWrapperChart,
+  boundChartRoutesOf,
+  chartWrapperMachineOf,
+  boundMachineOf,
+  compileChart,
+  isOpenBody,
+  lentIn,
+  openBodiesOf,
+  openBodyDeclarationOf,
+  type BoundChartRoute,
+} from "./open-body.ts";
 
 /** The actors filled into a run's named slots — `.provide()` is the unit-test seam (ADR-0015);
  * production instances inject nothing. Built fresh at start and at restore. */
@@ -56,8 +109,111 @@ export type WorkflowDef = {
   machine: AnyStateMachine;
   /** Build this run's live providers. A test seam (ADR-0015): discovery injects nothing. */
   provide: (ctx: { instanceId: string }) => RunProviders;
+  /**
+   * The hash of the Assembly this Machine came from (ADR-0069): set at register for the current
+   * Assembly, and by `resolveDef` for a held one at restore. A run holds the Assembly it started
+   * under, so every save of the run stamps this hash. Absent only for a def that no Assembly
+   * loaded: an in-process test host, which stamps nothing.
+   */
+  assembly?: string;
+  /**
+   * The def is a Chart wrapper (ADR-0070): `body` is its (first) Open body's slot key, and
+   * `chartFields` are the door's fields that are `chartSchema` — empty for a wrapper whose Charts
+   * only its own states supply. `register` reads both off the Machine when the caller leaves this
+   * out.
+   */
+  wrapper?: { body: string; chartFields: string[] };
+  /**
+   * The def is a named Chart (ADR-0070): the Workflow `<wrapper>/<name>`, whose `machine` is its
+   * wrapper's. A start supplies every Chart field of the wrapper's door from `text` and takes the
+   * rest from the caller.
+   */
+  chart?: { wrapper: string; name: string; text: ChartText; hash: string; origin: ChartOrigin };
 };
 
+/**
+ * One entry of `GET /workflows` (ADR-0070): a Workflow and where it came from. A Chart wrapper's
+ * entry carries its Open body, whether its door takes a Chart (`oneShot`), and its named Charts.
+ */
+export type WorkflowListing = {
+  name: string;
+  origin: "machine" | ChartOrigin;
+  wrapper?: {
+    body: string;
+    oneShot: boolean;
+    charts: Array<{ name: string; origin: ChartOrigin; unrunnable?: string }>;
+  };
+  unrunnable?: string;
+};
+
+/** What makes a Machine a Chart wrapper (ADR-0070), read off it: its first Open body's slot key and
+ * the door's fields that are `chartSchema`. The bodies are seen through jr2's transparent wrappers
+ * (a Chart wrapper that is a `workspace()`'s body), and the door is the registered Machine's.
+ * Undefined for a Machine with no Open body. */
+function wrapperOf(machine: AnyStateMachine): WorkflowDef["wrapper"] | undefined {
+  const bodies = openBodiesOf(chartWrapperMachineOf(machine).machine);
+  if (!bodies.length) return undefined;
+  const shape = (inputSchemaOf(machine)?.shape ?? {}) as Record<string, unknown>;
+  return { body: bodies[0]!.slot, chartFields: Object.keys(shape).filter((k) => isChartSchema(shape[k])) };
+}
+
+/** A pick one of whose parameters is a Chart (by schema identity, ADR-0070) is marked with that
+ * grammar's briefing, for the Turn part. */
+function briefingOf(input: z.ZodObject): { briefing?: string } {
+  const shape = input.shape as Record<string, unknown>;
+  for (const key of Object.keys(shape)) {
+    const briefing = chartBriefingOf(shape[key]);
+    if (briefing !== undefined) return { briefing };
+  }
+  return {};
+}
+
+/** The short wrapper name of a Workflow name: `<wrapper>` of `<wrapper>/<name>`, else the name. */
+function wrapperName(workflow: string): string {
+  const at = workflow.indexOf("/");
+  return at > 0 ? workflow.slice(0, at) : workflow;
+}
+
+/**
+ * Why a run's bound Charts no longer read under `machine` (ADR-0070, D-B), or undefined when each
+ * does: every bound Chart is admitted again against the Open body slot it binds, resolved on the
+ * Machine through `implementations.actors` (a lent child Machine's own slots included), with the
+ * lent set that Machine has now. A text whose hash does not match is drift too: a hand-edited
+ * volume.
+ */
+function chartDrift(machine: AnyStateMachine, routes: readonly BoundChartRoute[]): string | undefined {
+  for (const route of routes) {
+    const where = `chart "${route.path.join("/")}" under body "${route.src}"`;
+    let at: AnyStateMachine = machine;
+    let resolved = true;
+    for (const src of route.srcs.slice(0, -1)) {
+      const logic = (at.implementations.actors as Record<string, unknown>)[src];
+      // The lent parts a bound body's Chart invokes are its wrapper's: the next hop is resolved there.
+      if (isOpenBody(logic)) continue;
+      const child = (logic as AnyStateMachine | undefined)?.root ? (logic as AnyStateMachine) : undefined;
+      if (!child) {
+        resolved = false;
+        break;
+      }
+      at = child;
+    }
+    const logic = resolved ? (at.implementations.actors as Record<string, unknown>)[route.src] : undefined;
+    if (!isOpenBody(logic)) return `${where}: the Machine has no Open body "${route.src}" now`;
+    const hash = chartHash(route.chart);
+    if (hash !== route.chartHash) {
+      return `${where}: its hash ${route.chartHash} does not match its text (${hash}); the stored run was edited`;
+    }
+    const decl = openBodyDeclarationOf(logic);
+    try {
+      admitBodyChart(route.chart, decl, lentIn(at.implementations as never, decl));
+    } catch (err) {
+      if (!(err instanceof ChartRefusal)) throw err;
+      return `${where}: ${err.report.join("; ")}`;
+    }
+  }
+  return undefined;
+}
+
 /** The serializable identity of a run — what reconcile sees and what restore rebuilds from. */
 export type RunRecord = { runId: string; workflow: string; instanceId: string };
 
@@ -101,6 +257,191 @@ function runChildren(snapshot: unknown): RunChild[] {
   return out;
 }
 
+/**
+ * One Workspace of a run waiting for capacity (ADR-0064): its Sandbox has no node. `child` is the
+ * Workspace's actor path below the run root — the {@link RunChild} ids down to it, joined by `/`,
+ * and `""` when the run's root IS the Workspace. `on` is what it waits for: a node from the
+ * scheduler, or room under the cluster owner's quota; `message` is the scheduler's or the API
+ * server's own words; `since` (ISO) is when the wait began, kept across a changed reason and a
+ * restart.
+ */
+export type RunWaiting = { child: string; on: "node" | "quota"; message: string; since: string };
+
+/**
+ * Every Workspace in `placing` with a reason, at any depth, read off the snapshot tree in the two
+ * shapes {@link runChildren} walks — the wait rides each Workspace's own persisted context, so a
+ * restored run reports it before its watch has said a word. A live child is held to being a
+ * `workspace()` by its logic; a persisted one has none, and the state key and the context's shape
+ * are the test. Only an ACTIVE run and an active Workspace wait: a run that ended — faulted,
+ * cancelled, done — has deleted what never ran, so a `placing` left in its snapshot waits for nothing.
+ */
+function runWaiting(snapshot: unknown, logic?: unknown, path: string[] = []): RunWaiting[] {
+  const out: RunWaiting[] = [];
+  const snap = snapshot as { status?: unknown; value?: unknown; context?: Record<string, unknown> } | undefined;
+  if (snap?.status !== undefined && snap.status !== "active") return out;
+  const wait = snap?.context?.[WORKSPACE_WAIT_KEY] as WorkspaceWait | undefined;
+  const isWorkspace = logic == null || composesSandbox(logic as AnyStateMachine);
+  if (isWorkspace && snap?.value === "placing" && (wait?.on === "node" || wait?.on === "quota")) {
+    out.push({ child: path.join("/"), on: wait.on, message: String(wait.message), since: String(wait.since) });
+  }
+  const children = (snapshot as { children?: Record<string, unknown> } | undefined)?.children ?? {};
+  for (const [id, entry] of Object.entries(children)) {
+    const child = entry as { snapshot?: unknown; getSnapshot?: () => unknown; logic?: unknown };
+    const live = typeof child.getSnapshot === "function";
+    const childSnap = live ? child.getSnapshot!() : child.snapshot;
+    if ((childSnap as { value?: unknown } | undefined)?.value === undefined) continue;
+    out.push(...runWaiting(childSnap, live ? child.logic : undefined, [...path, id]));
+  }
+  return out;
+}
+
+/**
+ * The Sandbox of every live Workspace under `actor`, at any depth, by CR name — what a cancel
+ * destroys (ADR-0025). Read off the run's own live actor tree: each Workspace holds its `wsId` in
+ * context, and the name is a function of the run and that id, the same one its `teardown` deletes.
+ * Correct after a restart by construction: `restore()` rebuilds this tree from the persisted
+ * snapshot, so a restored run names its Sandboxes before its watch has listed. The Sandbox watch's
+ * set, filtered by the run's label, is not: before the watch has listed it holds nothing, and
+ * unknown is never absent (ADR-0063).
+ *
+ * Left out: a Workspace in `placing`, which deletes its own Sandbox when its wait is aborted — and
+ * only once any write in flight has settled, so a delete from here could race the apply and leave
+ * the CR behind (ADR-0064); and one that is `done` or ended, whose `teardown` already ran.
+ */
+function runSandboxes(actor: AnyActorRef, runId: string): string[] {
+  const out: string[] = [];
+  const snap = actor.getSnapshot() as
+    | { status?: string; value?: unknown; context?: { wsId?: unknown }; children?: Record<string, AnyActorRef> }
+    | undefined;
+  if (snap?.status !== "active") return out;
+  const logic = (actor as AnyActorRef & { logic?: unknown }).logic;
+  if (
+    logic != null &&
+    composesSandbox(logic as AnyStateMachine) &&
+    snap.value !== "placing" &&
+    typeof snap.context?.wsId === "string"
+  ) {
+    out.push(workspaceName(runId, snap.context.wsId));
+  }
+  for (const child of Object.values(snap.children ?? {})) out.push(...runSandboxes(child, runId));
+  return out;
+}
+
+/**
+ * Stop every actor under `actor`, at any depth, deepest first. A machine that ended in `error` has
+ * stopped processing — its own stop is a no-op — so its children are reached through its snapshot
+ * rather than asked to stop through it.
+ */
+function stopTree(actor: AnyActorRef): void {
+  const children = (actor.getSnapshot() as { children?: Record<string, AnyActorRef> } | undefined)?.children ?? {};
+  for (const child of Object.values(children)) {
+    stopTree(child);
+    // `_stop` is what xstate's own `stopChild` calls: a child cannot be stopped through `stop()`.
+    (child as AnyActorRef & { _stop?: () => void })._stop?.();
+  }
+}
+
+/** One outstanding pick, as `RunStatus.held` reports it: the Agent slot, its pick, and the ISO time
+ * it was delivered. */
+export type RunHeld = { agent: string; pick: string; since: string };
+
+/** The pick being delivered now (ADR-0024): its registration, every reply from below its Agent's
+ * state inside its own send, and what an `answer` action set there (ADR-0067). */
+type Sending = {
+  reg: Registration;
+  pick: string;
+  chain: PickAnswer[];
+  shaped?: { value: unknown };
+};
+
+/**
+ * Whose pick started a child (ADR-0067): the Agent's slot, and the invoke id of the Agent's state the
+ * pick was made at, which tells one slot's two regions apart. `invoke` is absent when the event that
+ * started the child named the Agent and not where (a pick taken outside its own send).
+ */
+type StartedBy = { agent: string; invoke?: string };
+
+/**
+ * The key of the child `childId` of `parent` in the run's record of which Agent started each child
+ * (`startedBy`, ADR-0067): the invoke ids from below the root down to `parent`, then `childId`, each
+ * encoded and joined by `/`. An invoke id is local to its Machine — two Machines of one tree, and
+ * every worker of a pool, may each have a child `job` — and the chain is not. A child of the root
+ * keeps its bare id. The ids are the snapshot's, so a restore gives the same key.
+ */
+function childKey(parent: AnyActorRef, childId: string): string {
+  const ids = [childId];
+  for (let at: AnyActorRef | undefined = parent; at?._parent !== undefined; at = at._parent) ids.unshift(at.id);
+  return ids.map(encodeURIComponent).join("/");
+}
+
+/**
+ * The Agent whose event `event` is, as `taker` takes it (ADR-0024, ADR-0067): a pick's sender, or
+ * the Agent whose pick started the child of `taker` whose done or error event it is (`startedBy`).
+ * Undefined when the event names no Agent: a timer, a Gate's answer, an outside send, a child no
+ * Agent's pick started. `sending`'s invoke is where a pick in its own send was made.
+ */
+function agentOfEvent(
+  event: AnyEventObject,
+  startedBy: Record<string, StartedBy>,
+  taker: AnyActorRef,
+  sending?: Sending,
+): StartedBy | undefined {
+  const sender = (event as { [SENDER_KEY]?: Sender })[SENDER_KEY];
+  if (sender?.party === "agent") {
+    const invoke = sending?.reg.sender?.id === sender.id ? sending.reg.invokeId : undefined;
+    return invoke !== undefined ? { agent: sender.id, invoke } : { agent: sender.id };
+  }
+  const child = /^xstate\.(?:done|error)\.actor\.(.+)$/.exec(event.type)?.[1];
+  if (child === undefined) return undefined;
+  const key = childKey(taker, child);
+  return Object.hasOwn(startedBy, key) ? startedBy[key] : undefined;
+}
+
+/** How many of `snapshot`'s active states invoke an Agent. With two or more, an event that names no
+ * Agent cannot say whose pick an `answer` below no Agent's state shapes (ADR-0024). */
+function activeAgentStates(snapshot: AnyMachineSnapshot): number {
+  const machine = snapshot.machine as AnyStateMachine;
+  const active = (snapshot as { _nodes?: AnyStateMachine["root"][] })._nodes ?? [];
+  return active.filter((node) => partiesAt(node, machine).some((party) => party.party === "agent")).length;
+}
+
+/** The `childKey` of every child in `actor`'s tree, at any depth. */
+function liveChildKeys(actor: AnyActorRef, into = new Set<string>()): Set<string> {
+  const children = (actor.getSnapshot() as { children?: Record<string, AnyActorRef> } | undefined)?.children ?? {};
+  for (const child of Object.values(children)) {
+    if (!child) continue;
+    into.add(childKey(actor, child.id));
+    liveChildKeys(child, into);
+  }
+  return into;
+}
+
+/** `startedBy` as the save keeps it: only children still in the run's tree (ADR-0067). Read at the
+ * save, a microtask after the snapshot, so a done event the Machine took has run its route. */
+function liveStartedBy(startedBy: Record<string, StartedBy>, actor: AnyActorRef): Record<string, StartedBy> {
+  const live = liveChildKeys(actor);
+  for (const id of Object.keys(startedBy)) if (!live.has(id)) delete startedBy[id];
+  return startedBy;
+}
+
+/** An `answer` action's value as the hold keeps it: JSON, because it rides the run blob and the
+ * wire (ADR-0067). `undefined`, or a value with no JSON form, sets no answer — the default stands. */
+function jsonOf(value: unknown): { value: unknown } | undefined {
+  try {
+    const text = JSON.stringify(value);
+    return text === undefined ? undefined : { value: JSON.parse(text) as unknown };
+  } catch {
+    return undefined;
+  }
+}
+
+/** The outstanding picks among a run's holds. */
+function heldOf(holds: Iterable<Hold>): RunHeld[] {
+  return [...holds]
+    .filter((hold) => hold.answer === undefined)
+    .map((hold) => ({ agent: hold.agent, pick: hold.pick, since: hold.since }));
+}
+
 /** A run's current observable state. `fault` carries the error message when status is "error"
  * (e.g. a gate invoked with a name outside the workflow's manifest — ADR-0011). */
 export type RunStatus = RunRecord & {
@@ -109,6 +450,14 @@ export type RunStatus = RunRecord & {
   context: unknown;
   /** The live child machines beneath the root — where most of a run actually is. */
   children: RunChild[];
+  /** Every Workspace waiting for capacity, and why (ADR-0064). Behind the token: the reason is
+   * the scheduler's or the quota's own words, which can name nodes and taints, so {@link observe}
+   * never carries it — the open band sees only that a Workspace is in `placing`. */
+  waiting: RunWaiting[];
+  /** Every pick of this run that is outstanding (ADR-0024): the Agent, its pick, and since when —
+   * the Console's "held since". There is no default time bound on a held Turn; this is how a
+   * human sees one. Behind the token, like `context`: a pick names what the Agent did. */
+  held: RunHeld[];
   fault?: string;
   /**
    * Why the HOST set this status, for the statuses the Machine did not choose — today `drifted`
@@ -117,6 +466,15 @@ export type RunStatus = RunRecord & {
    * route could read it.
    */
   reason?: string;
+  /** The hash of the Assembly the run started under (ADR-0069). Absent for a run no Assembly
+   * started. */
+  assembly?: string;
+  /** The run binds at least one Chart (ADR-0070): its Machine is the bound one, `runMachine`. */
+  bound?: true;
+  /** The hashes of the Charts the run binds now, distinct and sorted (ADR-0070). A run can bind a
+   * second Chart in its life (a planner whose first Chart reaches a ceiling picks again), so these,
+   * not the run id, say which bound Machine `runMachine` draws. Absent when it binds none. */
+  chartHashes?: string[];
 };
 
 /**
@@ -142,6 +500,12 @@ export type RunObservation = {
   status: string;
   value: unknown;
   children: RunChild[];
+  /** The run binds a Chart (ADR-0070): the Console draws `GET /workflows/:name/runs/:runId/machine`.
+   * Structure, like `value`. */
+  bound?: true;
+  /** The hashes of the Charts it binds now (see {@link RunStatus.chartHashes}). Structure: a hash
+   * of a Chart's text, which `runMachine` already serves on the open band. */
+  chartHashes?: string[];
 };
 
 /** Project a full status down to what an observer may see. The one place the line is drawn. */
@@ -152,9 +516,31 @@ export function observe(status: RunStatus): RunObservation {
     status: status.status,
     value: status.value,
     children: status.children,
+    ...(status.bound ? { bound: true as const } : {}),
+    ...(status.chartHashes ? { chartHashes: status.chartHashes } : {}),
   };
 }
 
+/** An Agent registration's Menu (ADR-0029): the one it registered, or — registered with none, by a
+ * plain `setup()` machine — its derived set. */
+function menuOf(reg: Registration): Map<string, EventDef> {
+  return reg.menu ?? reg.defs;
+}
+
+/** The invoking Machine's state value, as one comparable string; undefined when it cannot be read. */
+function stateValueOf(invoker: AnyActorRef | undefined): string | undefined {
+  try {
+    return invoker ? JSON.stringify(invoker.getSnapshot().value) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** The Allowed picks (ADR-0029), as the Agent's nudge and wake read them too. */
+function allowedOf(reg: Registration): string[] {
+  return allowedPicks(reg);
+}
+
 /** One open gate as external callers discover it (`GET /runs/:id` — ADR-0011): the accepted
  * events with their input schemas as JSON Schema (what drives a form or a `jr2 send` prompt),
  * plus the workflow-supplied `meta` (what a UI renders and a webhook translator matches on). */
@@ -165,28 +551,50 @@ export type GateView = {
    * id was authored ("F-12") or derived. Never parse `gate` for this. */
   path: string[];
   accepts: Array<{ name: string; description?: string; input: unknown }>;
+  /** The names of `accepts` the run would take from this Gate NOW, payload-blind (ADR-0011,
+   * ADR-0029): a send of another name is refused 409. `accepts` stays whole — it drives the forms. */
+  acceptsNow: string[];
   meta?: Record<string, unknown>;
 };
 
+/** One event on an Agent's Menu, as the surface serves it: a tool, its `input` schema the tool's
+ * parameters. `semantics` rides along so the Harness refuses a reserved one (ADR-0013). */
+/** One pick on the surface. `briefing` marks a pick whose parameter is a Chart: jr2's text on how a
+ * Chart runs (`CHART_BRIEFING`, ADR-0070), which the Harness says in the Turn part when the pick is
+ * Allowed, so only the Turns that may write a Chart carry it. */
+export type SurfaceEvent = {
+  name: string;
+  description?: string;
+  input: unknown;
+  semantics: EventSemantics;
+  briefing?: string;
+};
+
 /**
- * One live agent surface, as its Adapter reads it (`GET /agents/:iid/surface` — ADR-0013). The
- * Adapter renders this as `tools/list`: each accepted event becomes a tool, its `input` schema the
- * tool's input schema. `semantics` rides along so the Adapter can tell an awaiting tool from a
- * fire-and-forget one — the room ADR-0006's deferred results will land in, unbuilt today.
+ * One live agent surface, as the Harness reads it through its Custodian (`GET /agents/:iid/surface`
+ * — ADR-0013, ADR-0029). Two answers, because they change at different rates:
+ *
+ *   - `menu` is the Agent's MENU — every pick any state invoking this Agent offers, in a fixed
+ *     order. The Harness presents it as the tools block, which is then byte-identical for every
+ *     Turn of the conversation and never breaks the provider's prompt cache.
+ *   - `allowed` is this Turn's ALLOWED PICKS — the invoking state's derived set, narrowed to what its
+ *     guards would accept now, in Menu order. The Harness states it in the Briefing's Turn part,
+ *     after the Frame's prompt (ADR-0062). Enforced at delivery, not here.
  *
- * `sandbox` is the Sandbox that may deliver here. It is not a secret from the Adapter (that pod IS
- * the sandbox), and serving it lets the Adapter fail loudly on a surface that is not its own.
+ * `sandbox` is the Sandbox that may deliver here. It is not a secret from that pod (the pod IS the
+ * sandbox), and serving it lets a caller fail loudly on a surface that is not its own.
  */
 export type AgentSurfaceView = {
   instanceId: string;
   runId: string;
   sandbox?: string;
-  accepts: Array<{ name: string; description?: string; input: unknown; semantics: EventSemantics }>;
+  menu: SurfaceEvent[];
+  allowed: string[];
 };
 
 /**
  * The answer to one Agent delivery (`POST /agents/:iid/events`) — a receipt that DESCRIBES ITSELF
- * (ADR-0024). The Adapter renders it as prose, because a bare `deliveryId` told the Agent nothing
+ * (ADR-0024). The Harness renders it as prose, because a bare `deliveryId` told the Agent nothing
  * about whether it was finished, and the model answered that silence by calling again.
  *
  * `turnComplete` is the HINT, never the guarantee (the abort on invocation end is): it is read off
@@ -194,10 +602,30 @@ export type AgentSurfaceView = {
  * turn has stopped waiting. It fails conservatively — anything that made the read unreliable reads
  * `false`, which is today's behavior, never a false claim.
  *
- * `deliveryId` is unchanged from ADR-0013: an outcome stays ADDRESSABLE after the fact, the room a
- * deferred result needs when it lands. Nothing polls it today, deliberately.
+ * `deliveryId` keeps the outcome ADDRESSABLE after the fact (ADR-0013): a pick the workflow is still
+ * running when the POST answers is OUTSTANDING (`outstanding: true`), and its answer is read at
+ * `GET /agents/:iid/deliveries/:id` — the same shape, `answered: true`, once the workflow is back at
+ * Rest in the Agent's state or has left it (ADR-0024).
  */
 export type AgentDeliveryReceipt = {
+  /** The workflow is running the pick: the answer comes on the delivery's poll. `allowed` is empty:
+   * no other pick is taken until it answers. */
+  outstanding?: true;
+  /** ISO time the pick was delivered — with `outstanding`. */
+  since?: string;
+  /** This receipt is a pick's answer, read at Rest (or once the Turn left the Agent's state): an outstanding
+   * pick's, a reply inside the pick's own send, or a guard straight back with no reply. */
+  answered?: true;
+  /** With `answered`: a guard straight back (ADR-0024) — the pick entered a state below the Agent's
+   * and came back inside its own send, nothing replying. The one answer that says "moved; nothing
+   * ran"; an outstanding pick's answer never carries it. */
+  straightBack?: true;
+  /** The last reply since the pick (ADR-0024); absent with `answered`: no reply came. */
+  answer?: PickAnswer;
+  /** With `answered` and `turnComplete`: something other than the pick's route left the Agent's
+   * state while the pick's work ran, and that exit stopped the work before it finished. `answer`,
+   * if any, is an earlier link's reply, kept (ADR-0024). */
+  stopped?: true;
   delivered: true;
   /** The event delivered — the Agent reads its own pick back, by name. */
   event: string;
@@ -212,6 +640,12 @@ export type AgentDeliveryReceipt = {
   moved: boolean;
   /** The invoking state stopped waiting: this Agent's turn is over. */
   turnComplete: boolean;
+  /**
+   * The Allowed picks read AFTER the delivery (ADR-0029): what this Turn may pick now — narrowed by
+   * a pick that moved the Machine within the invoking state, empty once the Turn is over. The
+   * Harness renders it ("Allowed now: `finish`"); it does not pre-check against it.
+   */
+  allowed: string[];
   deliveryId: string;
 };
 
@@ -226,7 +660,7 @@ export type AgentDeliveryReceipt = {
 export type RunFeedEvent =
   | { kind: "status"; status: RunStatus }
   | { kind: "emit"; event: { type: string } & Record<string, unknown> }
-  | TurnMarker
+  | RunMarker
   // Absorbed-retry telemetry (ADR-0016): `{ child, attempt }` is state-key-class data — no iids
   // ride the feed (ADR-0014). `reason` is mechanism text, guarded like `fault`.
   | RetryTelemetry
@@ -234,9 +668,10 @@ export type RunFeedEvent =
 
 /**
  * The feed-so-far cap. The buffer exists so a Workspace attaching mid-run can open its log with
- * the run's preamble (ADR-0023); a run long enough to blow past it loses its OLDEST frames, which
- * is the same trade kubelet's log rotation already makes on the printed side — the feed remains
- * the record, the buffer serves a courtesy view.
+ * the run's preamble (ADR-0023); a run long enough to blow past it loses its OLDEST markers and
+ * Emits, which is the same trade kubelet's log rotation already makes on the printed side — the
+ * feed remains the record, the buffer serves a courtesy view. Statuses do not count against it:
+ * the buffer keeps only the latest (a status is a level — ADR-0023).
  */
 const FEED_SO_FAR_CAP = 1000;
 
@@ -264,6 +699,51 @@ function echoEventOf(event: RunFeedEvent, target: string): EchoEvent | undefined
   return undefined;
 }
 
+/**
+ * The echo's outbox (ADR-0023): one push in flight per attachment, and whatever the feed produces
+ * meanwhile rides the NEXT push, together — a burst of transitions costs the Harness one push per
+ * flush, not one per transition.
+ *
+ * A status is a level, so a pending status is REPLACED by a newer one, never queued behind it. The
+ * ordering rule, exactly: markers and Emits keep feed order among themselves, and the one pending
+ * status sits where the NEWEST status arrived — after every marker and Emit fed before it, before
+ * every one fed after it. A superseded status drops out; nothing else moves. So a Harness that
+ * answers slowly holds at most one status plus the markers since its last push.
+ *
+ * Fire-and-forget: a failed push goes to `report` and the outbox drains on — nothing here can
+ * fail a turn, a state, or a run. Exported for its unit test; {@link RunHost} is its one caller.
+ */
+export function echoOutbox(
+  push: (events: EchoEvent[]) => Promise<void>,
+  report: (err: unknown) => void,
+): (events: EchoEvent[]) => void {
+  let pending: EchoEvent[] = [];
+  let flushing = false;
+  const flush = async (): Promise<void> => {
+    while (pending.length > 0) {
+      const batch = pending;
+      pending = [];
+      try {
+        await push(batch);
+      } catch (err) {
+        report(err);
+      }
+    }
+    flushing = false;
+  };
+  return (events) => {
+    for (const event of events) {
+      if (event.kind === "status") pending = pending.filter((p) => p.kind !== "status");
+      pending.push(event);
+    }
+    if (flushing || pending.length === 0) return;
+    flushing = true;
+    // A microtask, so a synchronous burst (the replay; one transition's Emits and status) leaves
+    // as one push rather than as its first event alone.
+    queueMicrotask(() => void flush());
+  };
+}
+
 /** The child-machine tree for the echo's status: spawn ids and state values alone — a root's
  * value says almost nothing about where a run is, and a {@link RunChild} is already context-free
  * by construction. `src`/`status` stay behind: they are join keys for the Console, not story. */
@@ -304,6 +784,19 @@ export type RunHostOptions = {
   reconcile?: (run: RunRecord) => boolean | Promise<boolean>;
   /** Injectable id generator (deterministic ids in tests). Default: `crypto.randomUUID`. */
   newId?: () => string;
+  /**
+   * Resolve a stamped blob's Workflow inside the Assembly it names (ADR-0069): the Machine that
+   * Assembly's `workflows/<name>.ts` exports, as a def stamped with that hash, or why it cannot be
+   * read (`drifted`: not on the volume, published for another Kit version, does not import). The
+   * host never learns the volume layout; `startInstance` supplies this over `assemblies/<hash>`.
+   * A def it returns is NOT registered: the registry is the current Assembly's alone. A throw is a
+   * fault, not a verdict: the row stays live for the next boot (`failed`).
+   *
+   * Absent (an in-process host): a stamped blob resolves to the registered def of its name only
+   * when that def came from the same Assembly hash, since one hash names one tree and so one
+   * Machine; otherwise the run is `drifted`.
+   */
+  resolveDef?: (blob: { workflow: string; assembly: string }) => Promise<WorkflowDef | { drifted: string }>;
   /** Report a run that threw during restore (ADR-0030). The row is left `live` for the next boot,
    * so this is the only account of why — the entrypoint logs it. Default: silent. */
   onRestoreError?: (runId: string, err: unknown) => void;
@@ -316,6 +809,9 @@ export type RunHostOptions = {
    * signing key. Handed to every run's binding, and to the echo pusher below. Absent, no Harness
    * call bears one: only the stub Harness answers such a host. */
   harnessBearer?: (placement: string) => string;
+  /** Where an Effector placement is, and its key (ADR-0068) — `startInstance` derives both, the key
+   * from the signing key. Handed to every run's binding; absent, an http Effect faults pointedly. */
+  effector?: (placement: EffectorPlacement) => EffectorTarget | undefined;
   /**
    * Build the run-narrative echo pusher for one Workspace's Harness (ADR-0023) — the seam a fake
    * echo server rides in tests; `startInstance` binds the real wire push (harness-client.ts).
@@ -324,10 +820,22 @@ export type RunHostOptions = {
    * never a dependency of the run.
    */
   echo?: (endpoint: string, bearer: string | undefined) => (events: EchoEvent[]) => Promise<void>;
+  /**
+   * Build the live-set statement to the Instance Harness (ADR-0031) — the seam a fake rides in
+   * tests; `startInstance` binds the real wire push (harness-client.ts). `bearer` is the Instance
+   * Harness's (ADR-0058). Absent, or with no `instanceHarness`, nothing is stated.
+   */
+  liveSet?: (endpoint: string, bearer: string | undefined) => (live: LiveConversation[]) => Promise<unknown>;
+  /** How often the live set is stated, before jitter. Default: the Lease's cadence (ADR-0021).
+   * Tests shrink it. */
+  liveSetIntervalMs?: number;
+  /** The wall clock a run's timer table is written and read on (ADR-0007, timers.ts): each pending
+   * timer's deadline is a time on it. Default: `Date.now`. Tests pass a clock that does not step. */
+  now?: () => number;
 };
 
 /** What we persist per run: the machine snapshot wrapped with the run metadata restore needs.
- * `agents` is the admission LEDGER (ADR-0016) — iid → durable admission, reported by the Agent actor
+ * `agents` is the admission LEDGER (ADR-0016) — iid → durable admission, reported by the Agent's Actor
  * through the run binding and saved in the same blob (same store, same atomicity). */
 type RunBlob = {
   workflow: string;
@@ -337,6 +845,10 @@ type RunBlob = {
    * Absent means written before the stamp existed, which restore treats as drift — the point is to
    * never interpret a snapshot whose Machine cannot be vouched for. */
   machine?: string;
+  /** The hash of the Assembly the run started under (ADR-0069), stamped on every save. A blob
+   * without one cannot be vouched for, so restore treats it as drift, as it treats a blob with no
+   * `machine` stamp. */
+  assembly?: string;
   snapshot: unknown;
   agents?: Record<string, AgentAdmission>;
   /**
@@ -352,6 +864,47 @@ type RunBlob = {
    * `<id>/<epoch>`), so one conversation has exactly one counter however often it burns.
    */
   epochs?: Record<string, number>;
+  /**
+   * The pending NOTICES (ADR-0062): what the next Turn in a scope must be told — a memory kill in
+   * its Workspace, a conversation that is new. The Orchestrator is their only keeper, so they ride
+   * this blob beside the two ledgers, for the same reasons: the run's exact lifetime, and the
+   * snapshot's atomicity. A notice leaves it in the save that ledgers the admission that carried
+   * it, so a restart before that save delivers it again and a restart after does not.
+   */
+  notices?: NoticeLedgerState;
+  /**
+   * The pending TIMERS (`after`, named delays, delayed `raise` and `sendTo`), each with its
+   * absolute deadline (ADR-0007, timers.ts). xstate 5 keeps them on the actor system, not in the
+   * snapshot, so a restore without this table loses every one. Same blob for the snapshot's
+   * atomicity: the timers saved are exactly the ones the saved states scheduled.
+   */
+  timers?: PendingTimer[];
+  /**
+   * The outstanding picks (ADR-0024, holds.ts): each conversation's latest pick that the workflow ran, its
+   * delivery id, the last reply since it, and its answer once read at Rest. Same blob for the
+   * snapshot's atomicity: a restored host answers the same poll from the same Machine.
+   */
+  holds?: Hold[];
+  /**
+   * The Effect LEDGER (ADR-0067): one row per Effect, by its id — `intent` before the call,
+   * `settled` with its output, `aborted` when its state exited while it ran. Same blob for the
+   * snapshot's atomicity: an intent row is saved with the snapshot that holds its Effect, so a restore
+   * reads which Effects may have acted and runs none of them twice. A row is never dropped: the
+   * settled and aborted rows keep id, kind and outcome, the record of what the run's Effects did; a
+   * settled row's output tail is dropped once a save carries its transition (`dropSavedTails`).
+   */
+  effects?: Record<string, EffectRow>;
+  /**
+   * Which Agent started each live child (ADR-0067), by the child's key — the invoke ids from below
+   * the root down to the child, encoded and joined by `/` (`childKey`), so a child of one Machine is
+   * never another Machine's child of the same local id: the Agent whose pick's
+   * own send started it, or whose event the Machine was taking when it started. A done event of that
+   * child names that Agent, so an `answer` on a transition below no Agent's state that the done event
+   * takes shapes that Agent's pick and no other — whether the pick that started it is still
+   * outstanding or not. Same blob, so a restore names the same Agent. A child no longer in the tree
+   * is dropped at the save.
+   */
+  startedBy?: Record<string, StartedBy>;
   fault?: string;
 };
 
@@ -366,15 +919,27 @@ type LiveRun = {
   agents: Record<string, AgentAdmission>;
   /** The live epoch ledger (ADR-0057): persisted as `RunBlob.epochs`, seeded on restore. */
   epochs: Record<string, number>;
+  /** The pending notices (ADR-0062): persisted as `RunBlob.notices`, seeded on restore. */
+  notices: NoticeLedger;
+  /** The outstanding picks by Agent address (ADR-0024): persisted as `RunBlob.holds`, seeded on restore. */
+  holds: Map<string, Hold>;
+  /** The Effect ledger (ADR-0067): persisted as `RunBlob.effects`, seeded on restore. */
+  effects: Record<string, EffectRow>;
+  /** Which Agent started each live child (ADR-0067): persisted as `RunBlob.startedBy`, seeded on restore. */
+  startedBy: Record<string, StartedBy>;
   /** The error that killed the run, if it errored (xstate serializes Error to `{}`, so the
    * message is captured here at the observer and persisted onto the blob for `read`). */
   fault?: string;
   /** Per-run observers fed by `persist()` (status) and the actor's `emit` (emit) — SSE/CLI watch. */
   listeners: Set<(e: RunFeedEvent) => void>;
   /** The run's feed-so-far (ADR-0023): what a Workspace attaching mid-run gets replayed as its
-   * log's preamble. In-memory and this-boot only — a restored run's preamble starts at restore,
-   * the same live-only contract the printed log already has. Capped ({@link FEED_SO_FAR_CAP}). */
+   * log's preamble — its markers and Emits, in feed order. In-memory and this-boot only — a
+   * restored run's preamble starts at restore, the same live-only contract the printed log already
+   * has. Capped ({@link FEED_SO_FAR_CAP}). */
   feedSoFar: RunFeedEvent[];
+  /** The preamble's last line: where the run stands now. A status is a level (ADR-0023), so the
+   * buffer keeps the latest alone — old statuses are not interleaved between old markers. */
+  latestStatus?: RunFeedEvent & { kind: "status" };
 };
 
 export class RunHost {
@@ -386,15 +951,30 @@ export class RunHost {
   private readonly reconcile: (run: RunRecord) => boolean | Promise<boolean>;
   private readonly newId: () => string;
   private readonly onRestoreError?: (runId: string, err: unknown) => void;
+  private readonly resolveDef?: RunHostOptions["resolveDef"];
   private readonly sandbox?: SandboxPort;
   private readonly instanceHarness?: string;
   private readonly harnessBearer?: (placement: string) => string;
+  private readonly effector?: (placement: EffectorPlacement) => EffectorTarget | undefined;
   private readonly echoFactory?: (
     endpoint: string,
     bearer: string | undefined,
   ) => (events: EchoEvent[]) => Promise<void>;
+  private readonly liveSetPush?: (live: LiveConversation[]) => Promise<unknown>;
+  private readonly liveSetIntervalMs: number;
+  private readonly now: () => number;
+  private liveSetTimer?: ReturnType<typeof setTimeout>;
+  /** Whether the last live-set statement failed — a failing streak logs one line (ADR-0031). */
+  private liveSetFailing = false;
   private readonly workflowDefs = new Map<string, WorkflowDef>();
   private readonly runs = new Map<string, LiveRun>();
+  /**
+   * The admission ledgers of the runs restore could not host this boot (a `reconcile` that threw).
+   * Their rows stay `live` for the next boot to retry, so their conversations on the Instance
+   * Harness are still held: the live set names them from here (ADR-0031), or the retry would find
+   * nothing to re-attach to.
+   */
+  private readonly unhosted = new Map<string, Record<string, AgentAdmission>>();
   /**
    * Workflow name → its observers. Deliberately on the HOST and not on `LiveRun`: a workflow's
    * watcher outlives every individual run it watches, and `persist()` clears a settled run's own
@@ -402,16 +982,58 @@ export class RunHost {
    * than a comment asking the next reader not to clear the wrong Set.
    */
   private readonly workflowListeners = new Map<string, Set<WorkflowListener>>();
+  /** Every timer a run's actor system has armed and not yet fired or cleared: an `after`, a Chart's
+   * wall clock (ADR-0070). `close()` unrefs them, so a timer of hours never holds the process. */
+  private readonly timers = new Set<ReturnType<typeof setTimeout>>();
+  /** The clock every run's actor system arms its timers on: xstate's own, with each timer kept in
+   * {@link timers} and unref'd once the host is closing. The scheduled events stay in the system's
+   * snapshot, so a restore arms them again. */
+  private readonly clock = {
+    setTimeout: (fn: (...args: unknown[]) => void, ms: number) => {
+      const timer = setTimeout(() => {
+        this.timers.delete(timer);
+        fn();
+      }, ms);
+      this.timers.add(timer);
+      if (this.#stopping) (timer as { unref?: () => void }).unref?.();
+      return timer;
+    },
+    clearTimeout: (timer: ReturnType<typeof setTimeout>) => {
+      this.timers.delete(timer);
+      clearTimeout(timer);
+    },
+  };
+  /** The registration each hold was opened under, this boot: the same address re-registered by
+   * another invocation (`continue: true`) is another Turn. A restored hold adopts the first. */
+  private readonly holdRegs = new WeakMap<Hold, Registration>();
+  /** The long polls waiting on each open hold (ADR-0024). */
+  private readonly holdWaiters = new Map<Hold, Set<() => void>>();
+  /** The pick being delivered now, and the last reply from below its Agent's state inside its own
+   * send (ADR-0024). A child that settles in the same macrostep as the pick — a decision Machine
+   * that is final as it starts — replies before a hold can exist, so the chain records it here. */
+  private sending: Sending | undefined;
+  /** `<iid> <deliveryId>` of every outstanding pick of a run this host parked (`stop`). */
+  private readonly parked = new Set<string>();
+  #stopping = false;
+  #restorePending = false;
 
   constructor(opts: RunHostOptions) {
     this.store = opts.store;
     this.reconcile = opts.reconcile ?? (() => true);
     this.newId = opts.newId ?? (() => randomUUID());
     this.onRestoreError = opts.onRestoreError;
+    this.resolveDef = opts.resolveDef;
     this.sandbox = opts.sandbox;
     this.instanceHarness = opts.instanceHarness;
     this.harnessBearer = opts.harnessBearer;
+    this.effector = opts.effector;
     this.echoFactory = opts.echo;
+    this.liveSetPush =
+      opts.instanceHarness && opts.liveSet
+        ? opts.liveSet(opts.instanceHarness, opts.harnessBearer?.(INSTANCE_HARNESS_SERVICE))
+        : undefined;
+    this.liveSetIntervalMs = opts.liveSetIntervalMs ?? DEFAULT_LEASE_INTERVAL_MS;
+    this.now = opts.now ?? Date.now;
   }
 
   /** Register a workflow so `start`/`restore` can run it. Re-registering replaces (dev reload).
@@ -419,7 +1041,56 @@ export class RunHost {
    * declared them and resolved at invoke time off the invoking Machine (ADR-0011, ADR-0049), so
    * a nested Machine's defs are never the root's — or this host's — to hold. */
   register(def: WorkflowDef): void {
-    this.workflowDefs.set(def.name, def);
+    const wrapper = def.wrapper ?? wrapperOf(def.machine);
+    this.workflowDefs.set(def.name, wrapper ? { ...def, wrapper } : def);
+  }
+
+  /**
+   * Register a named Chart as the Workflow `<wrapper>/<name>` (ADR-0070). The registry of named
+   * Charts (charts.ts) calls this for each runnable one; it keeps where the Charts are stored, and
+   * the unrunnable ones, itself. Replacing a Chart a live run holds is fine: the run holds its text.
+   */
+  registerChart(def: WorkflowDef & { chart: NonNullable<WorkflowDef["chart"]> }): void {
+    this.register(def);
+  }
+
+  /** Drop a named Chart's Workflow. A live run of it keeps its text and runs on. */
+  unregisterChart(wrapper: string, name: string): void {
+    const key = `${wrapper}/${name}`;
+    if (this.workflowDefs.get(key)?.chart) this.workflowDefs.delete(key);
+  }
+
+  /** The registered named Chart `<wrapper>/<name>`, or undefined. */
+  namedChart(wrapper: string, name: string): NamedChart | undefined {
+    const chart = this.workflowDefs.get(`${wrapper}/${name}`)?.chart;
+    return (
+      chart && { wrapper: chart.wrapper, name: chart.name, text: chart.text, hash: chart.hash, origin: chart.origin }
+    );
+  }
+
+  /**
+   * Every registered Workflow with its origin (ADR-0070): a Machine, or a named Chart from a file or
+   * at run time. A Chart wrapper's entry carries its Open body, whether its door takes a Chart, and
+   * its named Charts: a named Chart lists inside its wrapper's entry, not beside it, and has an
+   * entry of its own only when its wrapper is not registered.
+   */
+  workflowList(): WorkflowListing[] {
+    const defs = [...this.workflowDefs.values()];
+    const wrappers = new Set(defs.filter((d) => !d.chart && d.wrapper).map((d) => d.name));
+    return defs.flatMap((def): WorkflowListing[] => {
+      if (def.chart) return wrappers.has(def.chart.wrapper) ? [] : [{ name: def.name, origin: def.chart.origin }];
+      if (!def.wrapper) return [{ name: def.name, origin: "machine" }];
+      const charts = defs
+        .filter((d) => d.chart?.wrapper === def.name)
+        .map((d) => ({ name: d.chart!.name, origin: d.chart!.origin }));
+      return [
+        {
+          name: def.name,
+          origin: "machine",
+          wrapper: { body: def.wrapper.body, oneShot: def.wrapper.chartFields.length > 0, charts },
+        },
+      ];
+    });
   }
 
   /** Drop a workflow's registration (a workflow the host no longer discovers). In-flight
@@ -437,12 +1108,79 @@ export class RunHost {
     return [...this.workflowDefs.keys()];
   }
 
+  /** The runs this process hosts, by the hash of the Assembly each started under (ADR-0069). A
+   * run from a def with no Assembly holds none. The store's live rows are the hold
+   * (`SnapshotStore.liveAssemblies`); this adds a run started a moment ago, before its first save. */
+  assemblyHolds(): Map<string, string[]> {
+    const holds = new Map<string, string[]>();
+    for (const [runId, run] of this.runs) {
+      const hash = run.def.assembly;
+      if (hash === undefined) continue;
+      holds.set(hash, [...(holds.get(hash) ?? []), runId]);
+    }
+    return holds;
+  }
+
   /** The registered template Machine's serialized structure (`GET /workflows/:name/machine`). */
   machine(name: string): MachineDoc | undefined {
     const def = this.workflowDefs.get(name);
     return def && serializeMachine(name, def.machine);
   }
 
+  /**
+   * The run's bound Machine (ADR-0070): the Workflow's Machine with each bound Open body's subgraph
+   * the compiled Chart's (its `src` stays the slot key, so the live child joins it as before) —
+   * from the live actor's bound Machine, or, for a stored run, compiled again from the text its
+   * blob holds. Undefined for an unknown run, and for a stored run whose Workflow is not registered.
+   */
+  async runMachine(runId: string): Promise<MachineDoc | undefined> {
+    const live = this.runs.get(runId);
+    let workflow: string;
+    let machine: AnyStateMachine;
+    let bodies: Array<{ route: BoundChartRoute; compiled: AnyStateMachine | string }>;
+    if (live) {
+      workflow = live.record.workflow;
+      machine = live.def.machine;
+      const refs = new Map<string, AnyActorRef>();
+      const collect = (ref: AnyActorRef, path: string[]): void => {
+        for (const [id, child] of Object.entries(childrenOfRef(ref))) {
+          refs.set([...path, id].join("/"), child);
+          collect(child, [...path, id]);
+        }
+      };
+      collect(live.actor, []);
+      bodies = boundChartRoutesOf(live.actor.getSnapshot()).map((route) => {
+        const ref = refs.get(route.path.join("/"));
+        return { route, compiled: (ref && boundMachineOf(ref)) ?? "the live body holds no compiled Chart" };
+      });
+    } else {
+      const stored = await this.store.load(runId);
+      const blob = stored?.snapshot as RunBlob | null | undefined;
+      if (!blob) return undefined;
+      const def = this.workflowDefs.get(blob.workflow) ?? this.workflowDefs.get(wrapperName(blob.workflow));
+      if (!def) return undefined;
+      workflow = blob.workflow;
+      machine = def.machine;
+      bodies = boundChartRoutesOf(blob.snapshot).map((route) => ({
+        route,
+        compiled: compileStored(def.machine, route),
+      }));
+    }
+    const doc = serializeMachine(workflow, machine);
+    const notDrawn: NonNullable<MachineDoc["chartsNotDrawn"]> = [];
+    for (const { route, compiled } of bodies) {
+      if (typeof compiled === "string") {
+        // The doc keeps the slot's own subgraph, and says so: a doc that drew the wrapper's body
+        // with no word would disagree with the run's `bound` (ADR-0070, D-B).
+        notDrawn.push({ path: route.path.join("/"), src: route.src, reason: compiled });
+        continue;
+      }
+      const { workflow: _w, opaqueStates: _o, ...body } = serializeMachine(route.src, compiled);
+      placeBody(doc, route.srcs, body);
+    }
+    return notDrawn.length ? { ...doc, chartsNotDrawn: notDrawn } : doc;
+  }
+
   /**
    * The workflow's declared run-input contract as JSON Schema (ADR-0033) — what the workflow
    * detail serves and the Console's start form generates from. `null` for a machine that
@@ -452,7 +1190,11 @@ export class RunHost {
   inputSchema(name: string): Record<string, unknown> | null | undefined {
     const def = this.workflowDefs.get(name);
     if (!def) return undefined;
-    const schema = inputSchemaOf(def.machine);
+    let schema = inputSchemaOf(def.machine);
+    // A named Chart's door is its wrapper's minus the Chart fields, which the Chart supplies (ADR-0070).
+    if (schema && def.chart && def.wrapper?.chartFields.length) {
+      schema = schema.omit(Object.fromEntries(def.wrapper.chartFields.map((f) => [f, true])) as never);
+    }
     // `io: "input"`: this schema describes what a caller SENDS — a defaulted field is optional
     // at the door (the default is applied by `start`'s parse), not required of the form.
     return schema ? (z.toJSONSchema(schema, { io: "input" }) as Record<string, unknown>) : null;
@@ -463,6 +1205,13 @@ export class RunHost {
     const def = this.workflowDefs.get(workflow);
     if (!def) throw new Error(`no workflow registered as "${workflow}"`);
 
+    // A named Chart supplies every Chart field of its wrapper's door, and the caller the rest
+    // (ADR-0070): what the caller sent under a Chart field is not the run's.
+    if (def.chart && def.wrapper) {
+      input = { ...input };
+      for (const field of def.wrapper.chartFields) input[field] = def.chart.text;
+    }
+
     // A declared schema is enforced at the door (ADR-0033), and what starts the run is the
     // PARSED shape (defaults applied, unknown keys stripped) — exactly what a gate delivery
     // lands as, and the same error class: `EventValidationError`, which the wire maps to a 400
@@ -482,6 +1231,10 @@ export class RunHost {
     const record: RunRecord = { runId, workflow, instanceId };
 
     const machine = this.assemble(def, instanceId);
+    // Every Chart field of a Chart wrapper's door is admitted BEFORE the run exists (ADR-0070): a
+    // refusal throws `ChartRefusal`, which the wire answers `422 { error: "refused", report }`. The
+    // lent set is the run's own Machine's, with its providers in.
+    this.admitDoorCharts(def, machine, runInput);
     // The root machine gets the parsed door PLUS what the host injects beside it —
     // `HostInjectedInput` (vocabulary.ts): the seed Instance ID, added after the parse because no
     // caller sends it and nothing serves it (ADR-0033). Only the root: a machine invoked below is
@@ -492,6 +1245,46 @@ export class RunHost {
     return { runId, instanceId };
   }
 
+  /**
+   * Admit every Chart field present in a Chart wrapper's parsed door (ADR-0070): the whole door,
+   * the compile included, against each Open body (the door cannot tell which body a field feeds).
+   * `input.*` references are the body's to check at its start: the Chart's `input` is what the
+   * wrapper's invoke sends, which is not the door. Throws ChartRefusal.
+   */
+  private admitDoorCharts(def: WorkflowDef, machine: AnyStateMachine, input: Record<string, unknown>): void {
+    for (const field of def.wrapper?.chartFields ?? []) {
+      if (input[field] === undefined) continue;
+      admitWrapperChart(machine, input[field]);
+    }
+  }
+
+  /**
+   * The def that reads `blob` (ADR-0069), or the verdict when none can. A stamped blob resolves
+   * inside the Assembly it names, through `resolveDef`; an unstamped blob resolves by name in the
+   * registry, and only on a host that loads no Assembly. A blob that names no Workflow the
+   * registry holds is `lost`: there is nothing it could ever be read by.
+   */
+  private async defFor(blob: RunBlob): Promise<WorkflowDef | { drifted: string } | { lost: string }> {
+    const registered = this.workflowDefs.get(blob.workflow);
+    if (blob.assembly !== undefined) {
+      const ref = { workflow: blob.workflow, assembly: blob.assembly };
+      if (this.resolveDef) {
+        const found = await this.resolveDef(ref);
+        return "drifted" in found ? found : { ...found, assembly: blob.assembly };
+      }
+      if (registered?.assembly === blob.assembly) return registered;
+      return {
+        drifted: `workflow "${blob.workflow}" saved under Assembly ${blob.assembly}, which this host does not hold`,
+      };
+    }
+    // A blob that names no Assembly cannot be vouched for on a host that loads Assemblies:
+    // greenfield, no migration (ADR-0069).
+    if (this.resolveDef || registered?.assembly !== undefined) {
+      return { drifted: `workflow "${blob.workflow}": saved under no Assembly` };
+    }
+    return registered ?? { lost: `no workflow "${blob.workflow}"` };
+  }
+
   /**
    * Restore every persisted live run: hydrate, reconcile against the live world, and either
    * re-attach (re-spawn from the rewritten child input), mark lost, or refuse as drifted. Returns
@@ -503,8 +1296,10 @@ export class RunHost {
    * later run in the store never restored at all. One run that cannot be resumed is one run, not an
    * outage.
    *
-   * `drifted` and `failed` are different claims, deliberately. Drift is a DURABLE verdict — the
-   * Machine changed, and it will still have changed on the next boot — so it is written to the row.
+   * `drifted` and `failed` are different claims, deliberately. Drift is a DURABLE verdict — this
+   * Orchestrator cannot read what it saved (the Assembly is gone, at another Kit version, does not
+   * load, or its Machine's shape does not match), and the next boot will not read it either — so it
+   * is written to the row.
    * A throw is not: `reconcile` talks to a cluster, and a kubectl blip must not permanently condemn
    * a run. Those rows are left `live` to be retried on the next boot, and reported every time until
    * they stop failing.
@@ -515,30 +1310,72 @@ export class RunHost {
     const drifted: string[] = [];
     const failed: string[] = [];
 
-    for (const stored of await this.store.list()) {
-      if (stored.status !== "live") continue;
+    for (const stored of await this.store.live()) {
+      // A run this process hosts already is not restored a second time. A deferred restore
+      // (ADR-0069) that throws as a whole stays pending, and the next publish tries it again; a run
+      // started under the current Assembly between those two publishes has a live row and a live
+      // actor, and must not get a second actor.
+      if (this.runs.has(stored.runId)) continue;
       const blob = stored.snapshot as RunBlob | null;
-      const def = blob ? this.workflowDefs.get(blob.workflow) : undefined;
-      if (!blob || !def) {
-        await this.store.markLost(stored.runId, blob ? `no workflow "${blob.workflow}"` : "empty snapshot");
+      if (!blob) {
+        await this.store.markLost(stored.runId, "empty snapshot");
         lost.push(stored.runId);
         continue;
       }
 
-      // The workflow name resolved a def; this asks whether that def is still the Machine this
-      // snapshot was written by (ADR-0030). Refused BEFORE `reconcile`, which talks to the cluster:
-      // there is no point proving a Sandbox is alive for a run that cannot be read.
+      // Which Machine reads this snapshot (ADR-0069). One rule: a stamped blob restores from its
+      // Assembly; an unstamped blob restores from the registry; a stamped host never has unstamped
+      // blobs it can vouch for. So a publish strands nothing: the def comes from the Assembly the
+      // run started under, never from the current one. Drift is only "I can no longer read what I
+      // saved", and it keeps the snapshot (`markDrifted`), so `jr2 status` still reads the run.
+      let def: WorkflowDef;
+      try {
+        const found = await this.defFor(blob);
+        if ("lost" in found) {
+          await this.store.markLost(stored.runId, found.lost);
+          lost.push(stored.runId);
+          continue;
+        }
+        if ("drifted" in found) {
+          await this.store.markDrifted(stored.runId, found.drifted);
+          drifted.push(stored.runId);
+          continue;
+        }
+        def = found;
+      } catch (err) {
+        // A fault while reading the Assembly, not a verdict on it: left live, as below.
+        this.onRestoreError?.(stored.runId, err);
+        failed.push(stored.runId);
+        this.unhosted.set(stored.runId, blob.agents ?? {});
+        continue;
+      }
+
+      // The def is the Machine this snapshot names; this asks whether it is still the shape this
+      // snapshot was written by (ADR-0030). Inside one Assembly the same bytes give the same
+      // Machine, so this guards a hash collision or a hand-edited volume. Refused BEFORE
+      // `reconcile`, which talks to the cluster: there is no point proving a Sandbox is alive for
+      // a run that cannot be read.
       const expected = fingerprintOf(def.machine);
       if (blob.machine !== expected) {
         await this.store.markDrifted(
           stored.runId,
-          `workflow "${blob.workflow}" changed shape since this run was saved ` +
+          `workflow "${blob.workflow}"${def.assembly !== undefined ? ` in Assembly ${def.assembly}` : ""} changed shape since this run was saved ` +
             `(saved under ${blob.machine ?? "an unstamped Machine"}, now ${expected})`,
         );
         drifted.push(stored.runId);
         continue;
       }
 
+      // The Charts the run binds (ADR-0070, D-B): the shape stamp is the wrapper's, and each Chart's
+      // identity is its text, kept in its body's snapshot. Each is admitted again against the Open
+      // body it binds and the lent set the Machine has now; one that no longer admits is drift.
+      const charts = chartDrift(def.machine, boundChartRoutesOf(blob.snapshot));
+      if (charts !== undefined) {
+        await this.store.markDrifted(stored.runId, charts);
+        drifted.push(stored.runId);
+        continue;
+      }
+
       const record: RunRecord = { runId: stored.runId, workflow: blob.workflow, instanceId: blob.instanceId };
 
       try {
@@ -557,38 +1394,124 @@ export class RunHost {
           this.assemble(def, blob.instanceId),
           { snapshot: hydrated as never },
           record,
+          // The def of the Assembly the run started under (ADR-0069), so every later save names
+          // that hash. The config the run provisions under is the CURRENT Assembly's all the same:
+          // the ports read it through the binding a publish replaces, and a held Assembly lends
+          // only its Machines (ADR-0069).
           def,
           agents,
           // The burned conversations come back with the admissions (ADR-0057): a restored run's
           // next `continue` must land where this run's last one did, not on a dead conversation.
           blob.epochs ?? {},
+          // …and so do the undelivered notices (ADR-0062), reservations forgotten: a notice whose
+          // admission never reached the ledger is delivered again.
+          blob.notices,
+          // …and the outstanding picks (ADR-0024): the restored Machine says when each is answered.
+          blob.holds,
+          // …and the Effect ledger (ADR-0067): a restored Effect reads its row and never runs twice.
+          blob.effects ?? {},
+          // …and which Agent started each child (ADR-0067): its done event names the same Agent.
+          blob.startedBy ?? {},
         );
-        actor.start();
+        // `start()`, then the pending timers again (ADR-0007, see `startAndRearm`). The next save
+        // records them again.
+        startAndRearm(actor, blob.timers ?? [], this.now());
+        // A run an earlier restore left live to retry is hosted now.
+        this.unhosted.delete(stored.runId);
         reattached.push(stored.runId);
       } catch (err) {
         // Left `live` on purpose — see the note above. The row is unchanged, so the next boot tries
         // again; what must not happen is this taking the remaining runs down with it.
         this.onRestoreError?.(stored.runId, err);
         failed.push(stored.runId);
+        this.unhosted.set(stored.runId, blob.agents ?? {});
       }
     }
 
+    // Every run this boot will host is live now, so the set is whole: state it, and keep stating it
+    // (ADR-0031). Not before — a statement ahead of restore would free the conversations of the
+    // runs about to be re-attached.
+    this.stateLiveSet();
+    this.scheduleLiveSet();
+
+    this.#restorePending = false;
     return { reattached, lost, drifted, failed };
   }
 
+  /**
+   * The conversations the live runs hold on the Instance Harness (ADR-0031): every admission in
+   * their ledgers whose endpoint is the Instance Harness, as the `(agent, instanceId)` pair it runs
+   * under. From MEMORY, never the store: the store also holds runs this process does not host, and
+   * a run this process hosts is exactly one that may still continue its conversation — and so is a
+   * run restore left `live` to retry (`unhosted`). A Sandbox's Harness is not in it — its
+   * Workspace's teardown frees everything there.
+   */
+  liveConversations(): LiveConversation[] {
+    const live = new Map<string, LiveConversation>();
+    const ledgers = [...[...this.runs.values()].map((run) => run.agents), ...this.unhosted.values()];
+    for (const agents of ledgers) {
+      for (const [iid, admission] of Object.entries(agents)) {
+        if (admission.endpoint !== this.instanceHarness || admission.agent === undefined) continue;
+        const instanceId = admission.instanceId ?? iid;
+        live.set(JSON.stringify([admission.agent, instanceId]), { agent: admission.agent, instanceId });
+      }
+    }
+    return [...live.values()];
+  }
+
+  /**
+   * State the live set to the Instance Harness (ADR-0031), which frees every other conversation.
+   * FIRE-AND-FORGET: level-triggered and idempotent, so a missed statement costs nothing and the
+   * next one says it all again. A failing streak logs one line; nothing here can touch a run.
+   */
+  private stateLiveSet(): void {
+    const push = this.liveSetPush;
+    if (!push || this.#stopping) return;
+    push(this.liveConversations()).then(
+      () => {
+        this.liveSetFailing = false;
+      },
+      (err: unknown) => {
+        if (this.liveSetFailing) return;
+        this.liveSetFailing = true;
+        console.error(
+          `live-set statement to ${this.instanceHarness} failed (the Instance Harness keeps what it holds): ` +
+            (err instanceof Error ? err.message : String(err)),
+        );
+      },
+    );
+  }
+
+  /** Every Lease interval, ±20% (ADR-0021's cadence, which ADR-0031 names). The timer holds no
+   * process alive, and `close()` clears it. */
+  private scheduleLiveSet(): void {
+    if (!this.liveSetPush || this.liveSetTimer !== undefined || this.#stopping) return;
+    const next = () => {
+      this.liveSetTimer = setTimeout(
+        () => {
+          if (this.#stopping) return;
+          this.stateLiveSet();
+          next();
+        },
+        leaseDelay(this.liveSetIntervalMs, "next", Math.random()),
+      );
+      this.liveSetTimer.unref?.();
+    };
+    next();
+  }
+
   /**
    * An agent instance's LIVE surface (`GET /agents/:iid/surface` — ADR-0013): what the state that
    * invoked this Agent accepts, right now. Undefined once nothing is registered (the state exited,
-   * the run settled, the iid is unknown) — the one catch point, and the reason the Adapter never
+   * the run settled, the iid is unknown) — the one catch point, and the reason the Harness never
    * has to learn which turn is live: it asks, per turn, and the answer IS the turn.
    *
-   * "Right now" is load-bearing (ADR-0029): the registered defs are the state's VOCABULARY, derived
-   * statically from its transitions, and the guards on those transitions are asked here — so an
-   * event the Machine cannot currently accept is not offered. The pick has not happened yet, so the
-   * question is `mayMove`, not `wouldMove`: a guard that would have judged the Agent's arguments is
-   * left on the menu and settled at delivery. The Adapter rebuilds this per MCP connection and the
-   * Harness re-lists per Submission, so the filter lands at turn boundaries and never moves under
-   * an Agent mid-turn.
+   * "Right now" is the Allowed picks' half (ADR-0029): the registered defs are the state's
+   * VOCABULARY, derived statically from its transitions, and the guards on those transitions are
+   * asked here, as this Agent's sender (`allowedPicks`, ADR-0015). The pick has not happened yet, so
+   * the question is payload-blind: a guard that would have judged the Agent's arguments is left
+   * allowed and settled at delivery. The Menu does not move with them — it is the conversation's,
+   * fixed at the Machine's build.
    */
   agentSurface(instanceId: string): AgentSurfaceView | undefined {
     const reg = this.table.lookup(agentAddress(instanceId));
@@ -597,28 +1520,79 @@ export class RunHost {
       instanceId,
       runId: reg.runId,
       sandbox: reg.sandbox,
-      accepts: [...reg.defs.values()]
-        .filter((def) => mayMove(reg.invoker, def.name))
-        .map((def) => ({
-          name: def.name,
-          description: def.description,
-          input: z.toJSONSchema(def.input),
-          semantics: def.semantics,
-        })),
+      menu: [...menuOf(reg).values()].map((def) => ({
+        name: def.name,
+        description: def.description,
+        input: z.toJSONSchema(def.input),
+        semantics: def.semantics,
+        ...briefingOf(def.input),
+      })),
+      allowed: allowedOf(reg),
     };
   }
 
+  /** The Harness read this Turn's surface and was answered (ADR-0026): the notices its admission
+   * carried reach a model now, so an end to the Turn no longer raises them again (ADR-0062). */
+  agentSurfaceServed(instanceId: string): void {
+    this.table.lookup(agentAddress(instanceId))?.served?.();
+  }
+
   /**
-   * Deliver one event from an Agent's Adapter (`POST /agents/:iid/events` — ADR-0013). Validation
-   * and delivery are the table's; this only agent-scopes the address and mints the receipt.
+   * Deliver one event from an Agent's Harness (`POST /agents/:iid/events` — ADR-0013). Validation
+   * and delivery are the table's; this only agent-scopes the address and mints the receipt. (A
+   * `poll` event never reaches here: `jr2Setup` refuses to build a Machine that declares one —
+   * ADR-0013.)
    */
   sendToAgent(instanceId: string, event: { type?: unknown } & Record<string, unknown>): AgentDeliveryReceipt {
     const { type, ...payload } = event;
     if (typeof type !== "string" || !type) {
-      throw new EventValidationError(`event body must carry a string "type" (one of the surface's accepted names)`);
+      throw new EventValidationError(`event body must carry a string "type" (one of the surface's Allowed picks)`);
     }
+    refuseSenderField(payload);
     const address = agentAddress(instanceId);
     const invoking = this.table.lookup(address);
+    const run = invoking ? this.runs.get(invoking.runId) : undefined;
+    // One pick at a time per Turn (ADR-0024): while a pick is outstanding, or the Agent's state is
+    // busy with work it started in, every pick is refused — `finish` included, and before any other
+    // judgment. Decided from the Machine (the Rest rule) and the run's holds, both of which a
+    // restore brings back, so it holds after a restart. xstate itself would take the pick, and one
+    // the Agent's state handles would exit the child state and stop the work running there.
+    if (invoking && run) {
+      this.settleHolds(run);
+      const hold = run.holds.get(instanceId);
+      const out = hold?.answer === undefined ? hold?.pick : undefined;
+      if (out !== undefined || restOf(invoking) === "busy") {
+        throw new OutstandingError(
+          out !== undefined
+            ? `"${type}" was not delivered: the pick "${out}" is still running in the workflow, and no other pick is taken until it answers`
+            : `"${type}" was not delivered: the workflow is still running work in the state that asked for this Turn, and no pick is taken until it is back at rest`,
+          out,
+        );
+      }
+    }
+    if (invoking && !invoking.defs.has(type)) {
+      // A pick on the Menu that another state of this Agent handles (ADR-0029): answered, not
+      // refused — `moved: false` is the correction receipt, whatever its arguments, so the payload
+      // is not read. It never reaches the Machine: the invoking state does not handle it, so it
+      // could move nothing of this Turn's, and only a state the Agent does not own (a nested
+      // Agent's, a Gate's) could act on it — a widening the audience rule forbids (ADR-0015).
+      if (menuOf(invoking).has(type)) {
+        return {
+          delivered: true,
+          event: type,
+          moved: false,
+          turnComplete: false,
+          allowed: allowedOf(invoking),
+          deliveryId: this.newId(),
+        };
+      }
+      // A name off the Menu is refused HERE, in the Agent's own terms: the table's refusal lists the
+      // derived set, bare and unnarrowed, where the Harness is about to write the Allowed picks in
+      // the model's tool names (ADR-0029, ADR-0062) — two lists that disagree.
+      const refused = new EventValidationError(`the workflow's current state does not accept "${type}"`);
+      refused.allowed = allowedOf(invoking);
+      throw refused;
+    }
 
     // Ask the guard question BEFORE delivering, and ask it with the VALIDATED payload — this is the
     // exact form of the check the surface build can only approximate payload-blind (ADR-0029).
@@ -628,9 +1602,45 @@ export class RunHost {
     // makes this unreliable and `deliver` throws on the next line anyway — so it fails open.
     const def = invoking?.defs.get(type);
     const parsed = def?.input.safeParse(payload ?? {});
-    const moved = wouldMove(invoking?.invoker, parsed?.success ? { type, ...parsed.data } : { type, ...payload });
-
-    this.table.deliver(address, type, payload);
+    const probe = {
+      ...(parsed?.success ? { type, ...parsed.data } : { type, ...payload }),
+      ...(invoking?.sender ? { [SENDER_KEY]: invoking.sender } : {}),
+    };
+    const moved = wouldMove(invoking?.invoker, probe);
+    // The states the pick names as targets, and the state value it leaves: after the send, the same
+    // value with a target no longer active means it entered a state and came straight back
+    // (ADR-0024); a new value, an in-Turn mode move.
+    const targets = moved ? targetsOf(invoking?.invoker, probe) : [];
+    const before = targets.length > 0 ? stateValueOf(invoking?.invoker) : undefined;
+
+    const outer = this.sending;
+    const sending: Sending | undefined = invoking && { reg: invoking, pick: type, chain: [] };
+    this.sending = sending;
+    try {
+      this.table.deliver(address, type, payload);
+    } catch (err) {
+      // The writing xstate would run for this pick is another party's (ADR-0015, ADR-0029): the
+      // pick is ANSWERED, never delivered — `moved: false`, and the Harness picks the receipt by
+      // whether the name is in `allowed`. Not in it: the correction receipt. In it: a guard that
+      // read the payload turned the selection outward, and the receipt says to change the arguments.
+      if (err instanceof NotTakenError && invoking) {
+        return {
+          delivered: true,
+          event: type,
+          moved: false,
+          turnComplete: false,
+          allowed: allowedOf(invoking),
+          deliveryId: this.newId(),
+        };
+      }
+      // A refused pick names the Allowed picks, read after the refusal (ADR-0029): one refusal
+      // naming them is what brings a wrong pick back — the statement in the Briefing carries the
+      // everyday case, and this is the net under it.
+      if (err instanceof EventValidationError && invoking) err.allowed = allowedOf(invoking);
+      throw err;
+    } finally {
+      this.sending = outer;
+    }
     // Read AFTER the delivery, off the SAME table the ADR-0024 guarantee uses — so the receipt
     // reports what happened rather than what was hoped. `deliver` reached the invoking state's
     // `sendBack` synchronously, so a pick that moved the Machine out of that state has already
@@ -638,15 +1648,331 @@ export class RunHost {
     //
     // IDENTITY, not existence: under `continue: true` the next state re-registers the SAME
     // address for its own turn, and that is a new turn — this one still ended.
+    const turnComplete = this.table.lookup(address) !== invoking;
+    // A reply from below the Agent's state inside the pick's own send (ADR-0024): a child that
+    // settled in the same macrostep. It is the answer's default as any later reply would be.
+    const replied = moved && sending ? answerOf(sending) : undefined;
+    // Where the answer goes if the route leaves the Agent's state: the conversation the picking
+    // Turn continues. A fresh Turn has none — its conversation is never heard again, and a later
+    // continued Turn of the same slot never made this pick.
+    const conversation = invoking?.conversation;
+    // The pick moved the workflow to work inside the Agent's state (ADR-0024): it is OUTSTANDING,
+    // answered once the workflow is back at Rest there — read after the mailbox drains, by the
+    // persist that follows every transition (`settleHolds`). The POST answers now, with the delivery
+    // id the Harness polls; no single request waits on the work (ADR-0013).
+    if (!turnComplete && invoking && run && moved && restOf(invoking) === "busy") {
+      const deliveryId = this.newId();
+      const since = new Date(this.now()).toISOString();
+      const hold: Hold = {
+        instanceId,
+        deliveryId,
+        pick: type,
+        agent: invoking.sender?.id ?? "",
+        since,
+        ...(invoking.sandbox !== undefined ? { sandbox: invoking.sandbox } : {}),
+        ...(invoking.invokeId !== undefined ? { invokeId: invoking.invokeId } : {}),
+        ...(conversation !== undefined ? { conversation } : {}),
+        ...(sending && sending.chain.length > 0 ? { chain: [...sending.chain] } : {}),
+        ...(sending?.shaped !== undefined ? { shaped: sending.shaped } : {}),
+      };
+      this.closeHold(run.holds.get(instanceId));
+      run.holds.set(instanceId, hold);
+      this.holdRegs.set(hold, invoking);
+      this.persist(run);
+      return {
+        delivered: true,
+        event: type,
+        moved: true,
+        turnComplete: false,
+        allowed: [],
+        deliveryId,
+        outstanding: true,
+        since,
+      };
+    }
+    // The child replied and the route ran inside the send: the pick is answered on its own POST,
+    // as its poll would have answered it — back at Rest with the Allowed picks read after the
+    // route, or out of the Agent's state with the answer as a notice to the conversation the picking
+    // Turn continued (none for a fresh Turn).
+    if (replied !== undefined && invoking) {
+      if (turnComplete && conversation !== undefined && run) {
+        run.notices.raise(
+          { kind: "pick-answer", scope: "conversation", pick: type, cut: false, answer: replied },
+          conversation,
+        );
+      }
+      return {
+        delivered: true,
+        event: type,
+        moved: true,
+        turnComplete,
+        allowed: turnComplete ? [] : allowedOf(invoking),
+        deliveryId: this.newId(),
+        answered: true,
+        answer: replied,
+      };
+    }
+    // It entered a state below the Agent's and came straight back inside its own send — a guard
+    // back (an `always`), nothing replying: answered, "moved; nothing ran" (ADR-0024). A pick that
+    // changed the state value moved to a mode, and one whose target is still active (the state it
+    // was taken in) entered nothing it left: both get the plain receipt below.
+    if (
+      !turnComplete &&
+      invoking &&
+      before !== undefined &&
+      stateValueOf(invoking.invoker) === before &&
+      leftAgain(invoking.invoker, targets)
+    ) {
+      return {
+        delivered: true,
+        event: type,
+        moved: true,
+        turnComplete: false,
+        allowed: allowedOf(invoking),
+        deliveryId: this.newId(),
+        answered: true,
+        straightBack: true,
+      };
+    }
     return {
       delivered: true,
       event: type,
       moved,
-      turnComplete: this.table.lookup(address) !== invoking,
+      turnComplete,
+      // Read off the SAME registration, after the delivery: a pick that moved the Machine within
+      // the invoking state may have changed its guards. A Turn that is over may pick nothing.
+      allowed: turnComplete || !invoking ? [] : allowedOf(invoking),
       deliveryId: this.newId(),
     };
   }
 
+  /**
+   * Answer every outstanding pick of `run` that can be answered now (ADR-0024). Called by the persist that
+   * follows every transition — a microtask after the snapshot, so the mailbox has drained — and
+   * before any read of a hold, so no reader sees a hold the Machine already answered.
+   *
+   *   - The Agent's state is busy: still outstanding.
+   *   - Back at Rest in it: answered with the last reply since the pick and the Allowed picks read
+   *     AFTER the route — the guards read the context the route wrote (ADR-0029).
+   *   - It left the Agent's state (the registration is gone, or is another invocation's): the Turn
+   *     is over, and the answer goes as a notice to the next Turn of the conversation the picking
+   *     Turn continued; a fresh picking Turn's answer goes nowhere (ADR-0062).
+   */
+  private settleHolds(run: LiveRun): void {
+    for (const hold of run.holds.values()) {
+      if (hold.answer !== undefined) continue;
+      const reg = this.table.lookup(agentAddress(hold.instanceId));
+      let same = reg !== undefined && reg.runId === run.record.runId && reg.invokeId === hold.invokeId;
+      if (same) {
+        const opened = this.holdRegs.get(hold);
+        if (opened === undefined) this.holdRegs.set(hold, reg!);
+        else same = opened === reg;
+      }
+      const reading = same ? restOf(reg!) : "gone";
+      if (reading === "busy") continue;
+      // The answer's default is the last reply since the pick, whatever moved the Machine after it
+      // (ADR-0024); with none, the answer carries no reply. Never `straightBack`: an outstanding
+      // pick's work was running, so "nothing ran" is not this answer's to say.
+      const answered = answerOf(hold);
+      const answer = answered ? { answer: answered } : {};
+      if (reading === "gone") {
+        // Left by the route of the last reply — its own events and the events it sent itself at once
+        // included — or by something else while work below still ran (a timer the Machine set, an
+        // outside event): then the exit stopped that work, and the answer says so. It keeps the last
+        // reply an earlier link gave.
+        const stopped = hold.cutShort === true ? { stopped: true as const } : {};
+        hold.answer = { turnComplete: true, allowed: [], ...answer, ...stopped };
+        if (hold.conversation !== undefined) {
+          run.notices.raise(
+            {
+              kind: "pick-answer",
+              scope: "conversation",
+              pick: hold.pick,
+              cut: false,
+              ...answer,
+              ...stopped,
+            },
+            hold.conversation,
+          );
+        }
+      } else {
+        hold.answer = { turnComplete: false, allowed: allowedOf(reg!), ...answer };
+      }
+      // The answer is fixed: nothing reads the chain or the shaped value again, so the next save
+      // drops them. A loop below the Agent's state grows the blob by its tails only while one pick
+      // is outstanding (ADR-0067, ADR-0065).
+      delete hold.chain;
+      delete hold.shaped;
+      this.closeHold(hold);
+    }
+  }
+
+  /**
+   * The pick an `answer` action in `machine` shapes (ADR-0067), from `seat`, the one place it runs
+   * from (`placeAnswers`). At an Agent's state: only a pick of the Agent seated there — the one in
+   * its own send, else the one outstanding. On a transition below no Agent's state (`null`): the
+   * event that took the transition names the Agent — the sender of a pick, or the Agent whose pick
+   * started the child whose done or error event it is — and that Agent's pick is the one shaped, and
+   * no other; none when that Agent has no pick being answered. When one slot is invoked in two
+   * regions, the event names an invoke too, and only the pick at that invoke is shaped: the sending
+   * pick, or the pick at the invoke whose pick started the child; none when that pick is not being
+   * answered (its Turn ended, and its child runs on). An event that names no Agent (a timer,
+   * a Gate's answer, an outside send) shapes the pick in its own send. Outside one, it shapes the one
+   * outstanding pick only while one Agent's state is active; while two Agents' states are active it
+   * shapes none, whatever is outstanding: the event cannot say whose pick it is, and the other
+   * Agent's pick keeps its default answer.
+   */
+  private answeringIn(
+    machine: AnyActorRef,
+    seat: AnswerSeat,
+    runId: string,
+    holds: Map<string, Hold>,
+    startedBy: Record<string, StartedBy>,
+    event?: AnyEventObject,
+  ): Sending | Hold | undefined {
+    const seatedFor = (reg: Registration | undefined): boolean => {
+      if (reg?.invoker !== machine) return false;
+      if (seat === null) return true;
+      const snapshot = machine.getSnapshot() as AnyMachineSnapshot;
+      return reg.invokeId !== undefined && seatOf(snapshot, reg.invokeId) === seat;
+    };
+    const regOf = (hold: Hold): Registration | undefined =>
+      this.holdRegs.get(hold) ?? this.table.lookup(agentAddress(hold.instanceId));
+    const sending = this.sending && this.sending.reg.runId === runId ? this.sending : undefined;
+    const open = [...holds.values()].filter((hold) => hold.answer === undefined && seatedFor(regOf(hold)));
+    if (seat === null && event !== undefined) {
+      const named = agentOfEvent(event, startedBy, machine, sending);
+      if (named !== undefined) {
+        const { agent } = named;
+        const own = sending && sending.reg.sender?.id === agent ? sending : undefined;
+        // That Agent's picks being answered: the one in its own send, and the ones outstanding at
+        // its other invokes (one slot invoked in two regions). The event names the invoke of the
+        // pick that sent it or started its child, and only the pick at that invoke is shaped; none
+        // when that pick is not being answered, and each other pick keeps its default answer.
+        const held = open.filter((hold) => hold.agent === agent && hold.instanceId !== own?.reg.id);
+        const picks = [...(own ? [own] : []), ...held];
+        const at = (pick: Sending | Hold): string | undefined =>
+          pick === own ? own.reg.invokeId : (pick as Hold).invokeId;
+        const same = named.invoke === undefined ? picks : picks.filter((pick) => at(pick) === named.invoke);
+        if (same.length !== 1) return undefined;
+        const pick = same[0]!;
+        if (pick === own) return seatedFor(own.reg) ? own : undefined;
+        return pick;
+      }
+    }
+    if (sending && seatedFor(sending.reg)) return sending;
+    if (seat === null && activeAgentStates(machine.getSnapshot() as AnyMachineSnapshot) > 1) return undefined;
+    return open.length === 1 ? open[0] : undefined;
+  }
+
+  /**
+   * The Agent whose outstanding pick holds the child `childId` that `machine` just started, or
+   * undefined: the child is invoked on a state strictly below that Agent's state, so by the Rest rule
+   * it is that pick's work (ADR-0024). Below two such states (one Agent's state inside another's),
+   * it is the work of the nearer one's pick. `snapshot` is `machine`'s snapshot after the step.
+   */
+  private outstandingAbove(
+    machine: AnyActorRef,
+    snapshot: AnyMachineSnapshot,
+    childId: string,
+    holds: Map<string, Hold>,
+  ): StartedBy | undefined {
+    const node = seatOf(snapshot, childId);
+    if (node === undefined) return undefined;
+    const byState = new Map<unknown, StartedBy>();
+    for (const hold of holds.values()) {
+      if (hold.answer !== undefined) continue;
+      const reg = this.holdRegs.get(hold) ?? this.table.lookup(agentAddress(hold.instanceId));
+      if (reg?.invoker !== machine || reg.invokeId === undefined) continue;
+      const agentState = seatOf(snapshot, reg.invokeId);
+      if (agentState !== undefined) byState.set(agentState, { agent: hold.agent, invoke: reg.invokeId });
+    }
+    // The nearest Agent's state above the child: with B's state inside A's, the child is B's work.
+    for (let n = node.parent; n; n = n.parent) {
+      const starter = byState.get(n);
+      if (starter !== undefined) return starter;
+    }
+    return undefined;
+  }
+
+  /** Wake every long poll on a hold: it was answered, replaced, or the host is going away. */
+  private closeHold(hold: Hold | undefined): void {
+    if (hold === undefined) return;
+    const waiters = this.holdWaiters.get(hold);
+    this.holdWaiters.delete(hold);
+    for (const wake of waiters ?? []) wake();
+  }
+
+  /** An outstanding pick's delivery: its run and hold, by Agent address and delivery id. */
+  private holdAt(instanceId: string, deliveryId: string): { run: LiveRun; hold: Hold } | undefined {
+    for (const run of this.runs.values()) {
+      const hold = run.holds.get(instanceId);
+      if (hold?.deliveryId === deliveryId) return { run, hold };
+    }
+    return undefined;
+  }
+
+  /** Is this delivery an outstanding pick of a run this host parked? Its poll is asked again. */
+  parkedDelivery(instanceId: string, deliveryId: string): boolean {
+    return this.parked.has(`${instanceId} ${deliveryId}`);
+  }
+
+  /** The Sandbox that may read a delivery's answer (ADR-0013), or undefined for an unknown one. */
+  deliveryScope(instanceId: string, deliveryId: string): { sandbox?: string } | undefined {
+    const found = this.holdAt(instanceId, deliveryId);
+    return found && { ...(found.hold.sandbox !== undefined ? { sandbox: found.hold.sandbox } : {}) };
+  }
+
+  /**
+   * One long poll of an outstanding pick's answer (`GET /agents/:iid/deliveries/:id` — ADR-0013, ADR-0024):
+   * the answer when the workflow is back at Rest in the Agent's state or has left it, else
+   * `outstanding` after at most `waitMs`, and the Harness asks again. Undefined for a delivery this
+   * host does not hold — a pick that was never outstanding, or a run that ended.
+   *
+   * `signal` is the poll's connection. A poll whose caller went away (a killed Harness) ends then,
+   * `outstanding`, and never marks the answer read: no model read it, so the re-admission after
+   * the restart must still carry it (ADR-0031).
+   */
+  async awaitDelivery(
+    instanceId: string,
+    deliveryId: string,
+    waitMs = 25_000,
+    signal?: AbortSignal,
+  ): Promise<AgentDeliveryReceipt | undefined> {
+    const found = this.holdAt(instanceId, deliveryId);
+    if (!found) return undefined;
+    const { run, hold } = found;
+    this.settleHolds(run);
+    if (hold.answer === undefined && !this.#stopping && !signal?.aborted) {
+      await new Promise<void>((resolve) => {
+        let waiters = this.holdWaiters.get(hold);
+        if (!waiters) this.holdWaiters.set(hold, (waiters = new Set()));
+        const timer = setTimeout(wake, waitMs);
+        signal?.addEventListener("abort", wake, { once: true });
+        function wake(): void {
+          clearTimeout(timer);
+          signal?.removeEventListener("abort", wake);
+          waiters!.delete(wake);
+          resolve();
+        }
+        waiters.add(wake);
+      });
+    }
+    const base = { delivered: true as const, event: hold.pick, moved: true, deliveryId };
+    if (hold.answer === undefined || signal?.aborted) {
+      return { ...base, turnComplete: false, allowed: [], outstanding: true, since: hold.since };
+    }
+    hold.fetched = true;
+    return {
+      ...base,
+      turnComplete: hold.answer.turnComplete,
+      allowed: hold.answer.allowed,
+      answered: true,
+      ...(hold.answer.answer !== undefined ? { answer: hold.answer.answer } : {}),
+      ...(hold.answer.stopped ? { stopped: true as const } : {}),
+    };
+  }
+
   /** A run's open gates as callers discover them (`GET /runs/:id` — ADR-0011). Settled/unknown
    * run → empty: a gate is a LIVE surface, it does not outlive its state. */
   gates(runId: string): GateView[] {
@@ -661,20 +1987,50 @@ export class RunHost {
           description: def.description,
           input: z.toJSONSchema(def.input),
         })),
+        acceptsNow: acceptsNow(reg),
         meta: reg.meta,
       }));
   }
 
-  /** Deliver one external event to a run's open gate (`POST /runs/:id/gates/:gate/events`).
-   * Validation and delivery are the table's — this only run-scopes the address. */
+  /**
+   * Deliver one external event to a run's open gate (`POST /runs/:id/gates/:gate/events`).
+   * Validation and delivery are the table's — this run-scopes the address, and returns only when
+   * the run TOOK the event (ADR-0013): one that would run another party's writing, or that no
+   * writing would take with this payload, throws {@link NotTakenError} naming what the Gate takes
+   * now, and nothing is delivered.
+   */
   sendToGate(runId: string, gate: string, event: { type?: unknown } & Record<string, unknown>): void {
     const { type, ...payload } = event;
     if (typeof type !== "string" || !type) {
       throw new EventValidationError(`event body must carry a string "type" (one of the gate's accepted names)`);
     }
+    const reg = this.table.lookup(gateAddress(runId, gate));
+    const refused = (why: string): NotTakenError =>
+      new NotTakenError(
+        `gate "${gate}" is open, and the run does not take "${type}" now: ${why} — not delivered ` +
+          `(takes now: ${reg ? acceptsNow(reg).join(", ") || "nothing" : "nothing"})`,
+      );
     try {
+      // Exact, with the validated payload: a send no writing would move on is refused, never
+      // answered `{ ok: true }`. A bad payload or an unaccepted name falls through to the table,
+      // which refuses it with its own words.
+      const def = reg?.defs.get(type);
+      const parsed = def && !(payload && SENDER_KEY in payload) ? def.input.safeParse(payload ?? {}) : undefined;
+      if (reg && parsed?.success && !wouldMove(reg.invoker, { type, ...parsed.data, [SENDER_KEY]: reg.sender })) {
+        throw refused("no writing of it would move the run with this payload");
+      }
       this.table.deliver(gateAddress(runId, gate), type, payload);
     } catch (err) {
+      if (err instanceof NotTakenError && err.writings.length) {
+        throw refused(
+          err.writings
+            .map(
+              (w) =>
+                `it would run the writing on "${w.state}"${w.owners.length ? `, which is ${w.owners.map(senderText).join(" and ")}'s` : ""}`,
+            )
+            .join("; "),
+        );
+      }
       if (err instanceof UnknownAddressError) {
         const open = this.gates(runId).map((g) => g.gate);
         throw new UnknownAddressError(
@@ -697,7 +2053,10 @@ export class RunHost {
     const run = this.runs.get(runId);
     if (!run) return () => {};
     run.listeners.add(listener);
-    listener({ kind: "status", status: this.liveStatus(run) });
+    // The status the feed last carried, the SAME object for every attach, so http.ts renders the
+    // replay once however many readers attach — a reconnect after a close is the common attach
+    // (ADR-0022). A transition not yet persisted follows on the feed within the microtask.
+    listener(run.latestStatus ?? { kind: "status", status: this.liveStatus(run) });
     return () => run.listeners.delete(listener);
   }
 
@@ -752,7 +2111,8 @@ export class RunHost {
    * Read a run's status, **reading through to the store** when it is no longer live (ADR-0009). A
    * completed run's final snapshot is persisted before `persist()` drops it from the registry, so a
    * terminal run reports its `done`/`error` status + final context here rather than 404-ing. Returns
-   * undefined only for a genuinely unknown run (or one marked `lost`, whose snapshot was cleared).
+   * undefined only for a genuinely unknown run (or one marked `lost`, whose snapshot was cleared) —
+   * and a swept one is unknown: a finished run's row lives a week (ADR-0065).
    */
   async read(runId: string): Promise<RunStatus | undefined> {
     const live = this.status(runId);
@@ -761,19 +2121,24 @@ export class RunHost {
     const blob = stored?.snapshot as RunBlob | null | undefined;
     if (!stored || !blob) return undefined;
     const snap = (blob.snapshot ?? {}) as { status?: string; value?: unknown; context?: unknown };
+    // The STORE row is the authority on the run's lifecycle, the snapshot on the Machine's: a
+    // cancelled run's actor reports xstate's "stopped", which is mechanism, not an outcome
+    // (ADR-0025). While the row still says "live", the Machine's own status is the answer.
+    const status = stored.status === "live" ? (snap.status ?? stored.status) : stored.status;
     return {
       runId,
       workflow: blob.workflow,
       instanceId: blob.instanceId,
-      // The STORE row is the authority on the run's lifecycle, the snapshot on the Machine's: a
-      // cancelled run's actor reports xstate's "stopped", which is mechanism, not an outcome
-      // (ADR-0025). While the row still says "live", the Machine's own status is the answer.
-      status: stored.status === "live" ? (snap.status ?? stored.status) : stored.status,
+      status,
       value: snap.value,
       context: snap.context,
       children: runChildren(snap), // the persisted `children` map — same tree, off the store
+      waiting: status === "active" ? runWaiting(snap) : [],
+      held: status === "active" ? heldOf(blob.holds ?? []) : [],
       fault: blob.fault,
       reason: stored.reason,
+      ...(blob.assembly !== undefined ? { assembly: blob.assembly } : {}),
+      ...boundFields(snap),
     };
   }
 
@@ -803,6 +2168,25 @@ export class RunHost {
       .map(observe);
   }
 
+  /** The host is going away (`close()` has begun): its Turns are not over, and the Agents' surface
+   * must not say they are (ADR-0026). */
+  get stopping(): boolean {
+    return this.#stopping;
+  }
+
+  /** The live rows of a prior process are not restored yet: a boot with no current Assembly
+   * deferred their restore to the first publish (ADR-0069). Those Turns are not over, so the
+   * Agents' surface must not say they are (ADR-0026). Set by `deferRestore`, cleared when a
+   * `restore()` completes; a restore that throws as a whole leaves it set. */
+  get restorePending(): boolean {
+    return this.#restorePending;
+  }
+
+  /** Mark the restore deferred: until a `restore()` completes, `restorePending` is true. */
+  deferRestore(): void {
+    this.#restorePending = true;
+  }
+
   /**
    * End every open feed because the host is going away — the shutdown counterpart to `subscribe`.
    *
@@ -813,6 +2197,15 @@ export class RunHost {
    * OBSERVATION, not the work — the snapshots are already durable, and `restore()` picks them up.
    */
   async close(): Promise<void> {
+    // From here on the Orchestrator is going away, not its Turns: `/agents/*` answers 503, which a
+    // Harness re-asks on ADR-0042's ladder, and never 404, which says a Turn is over (ADR-0026).
+    this.#stopping = true;
+    clearTimeout(this.liveSetTimer);
+    // A run's timers stay armed (a run is untouched by a close), but none holds the process alive.
+    for (const timer of this.timers) (timer as { unref?: () => void }).unref?.();
+    // Every long poll answers `outstanding` now, so the server can close; the Harness asks again,
+    // and a restarted Orchestrator answers it from the same hold (ADR-0024).
+    for (const hold of [...this.holdWaiters.keys()]) this.closeHold(hold);
     for (const run of this.runs.values()) {
       for (const listener of run.listeners) listener({ kind: "closed" });
       run.listeners.clear();
@@ -839,6 +2232,14 @@ export class RunHost {
     const run = this.runs.get(runId);
     if (!run) return;
     run.binding.hostStopping = true;
+    // A parked run's outstanding picks are not over (ADR-0024): their polls are answered `503` —
+    // ask again — never `404`, which tells the Harness its Turn ended. The host that restores the
+    // run answers them from the saved holds.
+    for (const hold of run.holds.values()) {
+      if (hold.answer !== undefined) continue;
+      this.parked.add(`${hold.instanceId} ${hold.deliveryId}`);
+      this.closeHold(hold);
+    }
     // Say so BEFORE the actor stops, while there is still a status to read. A stopped run is not a
     // settled one — `persist()` never runs for it (the tracked-run guard drops the scheduled save,
     // keeping the stored status "live" for restore — see `spawn`), so nothing else on this path
@@ -857,14 +2258,37 @@ export class RunHost {
    * Ending the turns and refusing to restore are one decision, not two: a cancelled run that came
    * back would re-attach to submissions that settled `aborted`, and `settle`'s rejection would
    * fault a run whose Agents were stopped on purpose.
+   *
+   * It then destroys every Sandbox the run owns, unless `keep` (`jr2 send <run> --event CANCEL
+   * --keep`): kept, they age out at the operator's idle timeout, and `jr2 ssh` reaches them until
+   * then. A faulted run never comes through here, and keeps its Workspaces (ADR-0012).
    */
-  async cancel(runId: string): Promise<void> {
+  async cancel(runId: string, opts: { keep?: boolean } = {}): Promise<void> {
     const run = this.runs.get(runId);
     if (!run) return;
+    // Named BEFORE the stop, while the tree still says which Workspaces are live.
+    const sandboxes = opts.keep ? [] : runSandboxes(run.actor, runId);
     run.actor.stop();
     // Persist AFTER the stop: the snapshot is final, and `persist` fans out the last status,
     // announces `gone`, and untracks — the same terminal path a run that settled on its own takes.
     this.persist(run, "cancelled");
+    // The run is over, so nothing can use its Workspaces, and each holds its whole Size (ADR-0025).
+    // An actor stop skips the wrapper's `teardown` state, so the host runs the same idempotent
+    // delete here, after the stop, so no lease renews what was deleted. `keep` leaves them to the
+    // operator's idle timeout, for inspection. A delete that fails is the idle GC's, as in
+    // `teardown` (ADR-0012 backstop): the cancel has already happened.
+    const port = this.sandbox;
+    if (!port) return;
+    await Promise.all(
+      sandboxes.map((name) =>
+        port.destroy(name).catch((err: unknown) => {
+          console.error(
+            `run ${runId}: cancel could not delete Sandbox ${name} (the idle timeout will): ` +
+              (err instanceof Error ? err.message : String(err)),
+          );
+        }),
+      ),
+    );
   }
 
   /** Feed a run's final word to both granularities: where it ended, then that it is gone. */
@@ -877,19 +2301,25 @@ export class RunHost {
 
   /** Put one event on the run's feed: buffer it for ADR-0023's backfill, then fan it out. The
    * buffer and the fan-out share one seat so an attached echo and a later attach see the SAME
-   * feed — a projection cannot drift from a record it is read out of. */
+   * feed — a projection cannot drift from a record it is read out of. Every listener is handed the
+   * SAME event object, which is what lets http.ts render each frame once (ADR-0022). */
   private feed(run: LiveRun, event: RunFeedEvent): void {
-    run.feedSoFar.push(event);
-    if (run.feedSoFar.length > FEED_SO_FAR_CAP) run.feedSoFar.shift();
+    if (event.kind === "status") {
+      run.latestStatus = event;
+    } else {
+      run.feedSoFar.push(event);
+      if (run.feedSoFar.length > FEED_SO_FAR_CAP) run.feedSoFar.shift();
+    }
     for (const listener of run.listeners) listener(event);
   }
 
   /**
    * Attach the run-narrative echo (ADR-0023): replay the run's feed-so-far to the Workspace's
-   * Harness at `endpoint` — the backfilled preamble, why this Workspace exists — then tee live
-   * until detached. FIRE-AND-FORGET is this method's contract: pushes are chained so events
-   * arrive in feed order, and a failure is logged once and swallowed — the feed remains the
-   * record, the log is a courtesy view, and nothing here can fail a turn, a state, or a run.
+   * Harness at `endpoint` — the backfilled preamble, why this Workspace exists: its markers and
+   * Emits in feed order, then where the run stands now — then tee live until detached, through an
+   * {@link echoOutbox}, which coalesces statuses. FIRE-AND-FORGET is this method's contract: a
+   * failure is logged once and swallowed — the feed remains the record, the log is a courtesy
+   * view, and nothing here can fail a turn, a state, or a run.
    * Scoped to the OWNING run's lineage by construction: it reads one run's buffer and listeners
    * and nothing else — a sibling run's events cannot reach this endpoint through here.
    */
@@ -897,25 +2327,19 @@ export class RunHost {
     const run = this.runs.get(runId);
     const factory = this.echoFactory;
     if (!run || !factory) return () => {};
-    const push = factory(endpoint, this.harnessBearer?.(placement));
-    let chain = Promise.resolve();
     let reported = false;
-    const enqueue = (events: EchoEvent[]): void => {
-      if (events.length === 0) return;
-      chain = chain
-        .then(() => push(events))
-        .catch((err) => {
-          // Log-and-continue, ONCE per attachment — an unreachable Harness must not turn every
-          // transition into an error line, and must not surface anywhere a run could trip on.
-          if (reported) return;
-          reported = true;
-          console.error(
-            `run ${runId}: echo to ${endpoint} failed (log only — the run is unaffected): ` +
-              (err instanceof Error ? err.message : String(err)),
-          );
-        });
-    };
-    enqueue(run.feedSoFar.map((ev) => echoEventOf(ev, endpoint)).filter((ev): ev is EchoEvent => ev !== undefined));
+    const enqueue = echoOutbox(factory(endpoint, this.harnessBearer?.(placement)), (err) => {
+      // Log-and-continue, ONCE per attachment — an unreachable Harness must not turn every
+      // transition into an error line, and must not surface anywhere a run could trip on.
+      if (reported) return;
+      reported = true;
+      console.error(
+        `run ${runId}: echo to ${endpoint} failed (log only — the run is unaffected): ` +
+          (err instanceof Error ? err.message : String(err)),
+      );
+    });
+    const preamble = run.latestStatus ? [...run.feedSoFar, run.latestStatus] : run.feedSoFar;
+    enqueue(preamble.map((ev) => echoEventOf(ev, endpoint)).filter((ev): ev is EchoEvent => ev !== undefined));
     const listener = (ev: RunFeedEvent): void => {
       const projected = echoEventOf(ev, endpoint);
       if (projected) enqueue([projected]);
@@ -933,7 +2357,11 @@ export class RunHost {
       value: snap.value,
       context: snap.context,
       children: runChildren(snap),
+      waiting: runWaiting(snap, run.actor.logic),
+      held: heldOf(run.holds.values()),
       fault: run.fault,
+      ...(run.def.assembly !== undefined ? { assembly: run.def.assembly } : {}),
+      ...boundFields(snap),
     };
   }
 
@@ -958,7 +2386,13 @@ export class RunHost {
     def: WorkflowDef,
     agents: Record<string, AgentAdmission> = {},
     epochs: Record<string, number> = {},
+    noticeState?: NoticeLedgerState,
+    holdState: Hold[] = [],
+    effects: Record<string, EffectRow> = {},
+    startedBy: Record<string, StartedBy> = {},
   ): AnyActor {
+    const notices = new NoticeLedger(noticeState, this.newId);
+    const holds = new Map(holdState.map((hold) => [hold.instanceId, hold]));
     let live: LiveRun | undefined;
     let scheduled = false;
     const schedule = () => {
@@ -972,30 +2406,47 @@ export class RunHost {
     const binding: RunBinding = {
       runId: record.runId,
       workflow: record.workflow,
+      ...(def.assembly !== undefined ? { assembly: def.assembly } : {}),
       table: this.table,
       sandbox: this.sandbox,
       instanceHarness: this.instanceHarness,
       ...(this.harnessBearer ? { harnessBearer: this.harnessBearer } : {}),
-      // The admission ledger's write half (ADR-0016): the Agent actor reports the durable handle the
+      ...(this.effector ? { effector: this.effector } : {}),
+      // The admission ledger's write half (ADR-0016): the Agent's Actor reports the durable handle the
       // moment the Harness admits it, and the ledger hits the store in the same RunBlob save. An
       // admission arriving around stop/untrack still lands in `agents` but skips the save,
       // exactly like the persist scheduler's tracked-run guard.
-      recordAdmission: (instanceId, admission) => {
+      recordAdmission: (instanceId, admission, delivered = []) => {
         agents[instanceId] = admission;
+        // The notices this admission carried are delivered by THIS save (ADR-0062).
+        notices.delivered(delivered);
         const run = this.runs.get(record.runId);
         if (run && run.agents === agents) this.persist(run);
       },
+      admissionOf: (instanceId) => agents[instanceId],
       // The epoch ledger's two halves (ADR-0057). The read is what the input mapper mints from;
       // the write is the terminal `agent.fault` burning the conversation it ended, saved in the
       // same RunBlob as the admission ledger — and, like it, saved AT THE WRITE rather than
       // waiting for the next transition, because a crash between the fault and the next state's
       // invoke would otherwise restore into the burned conversation.
       epochOf: (conversation) => epochs[conversation] ?? 0,
-      bumpEpoch: (conversation) => {
+      bumpEpoch: (conversation, reason) => {
         epochs[conversation] = (epochs[conversation] ?? 0) + 1;
+        // The next `continue` lands on a virgin conversation and is told so, with the fault's own
+        // words (ADR-0062) — raised in the SAME save as the bump, so no restart can split them.
+        notices.raise({ kind: "conversation-new", scope: "conversation", reason }, conversation);
         const run = this.runs.get(record.runId);
         if (run && run.epochs === epochs) this.persist(run);
       },
+      // The notices' other halves (ADR-0062). A raise is saved at the write, like the ledgers; a
+      // take is a reservation in memory, delivered by `recordAdmission` or released on failure.
+      raiseNotice: (notice, to, source) => {
+        if (!notices.raise(notice, to, source)) return;
+        const run = this.runs.get(record.runId);
+        if (run && run.notices === notices) this.persist(run);
+      },
+      takeNotices: (scope) => notices.take(scope),
+      releaseNotices: (ids) => notices.release(ids),
       // Absorbed-retry attempts go straight to the run's observers (SSE/CLI watch) — they are
       // feed events, not machine events (ADR-0016: the workflow sees only the terminal fault).
       telemetry: (event) => {
@@ -1005,15 +2456,83 @@ export class RunHost {
       // Turn markers (ADR-0023) ride the per-run feed alone — the prompt is Instance-token-class
       // data, so they never touch the workflow feed (ADR-0014's open band strips even Emit
       // payloads there).
+      // An Effect's line that comes after its run ended — a stop's answer on a cancel or a final
+      // state (ADR-0067) — has no feed left to ride, so it goes to the Orchestrator's log.
       marker: (event) => {
         const run = this.runs.get(record.runId);
         if (run && run.binding === binding) this.feed(run, event);
+        else if (!run && event.kind === "effect") {
+          console.error(`run ${record.runId}: effect ${event.slot} (${event.effect}) ${event.stage}: ${event.text}`);
+        }
       },
       // The run-narrative echo attach (ADR-0023), called from `workspace()`'s registrar.
       echo: (endpoint, placement) => this.attachEcho(record.runId, endpoint, placement),
+      // The outstanding pick of the Turn now at this address, as the Agent's Actor reads it when its
+      // Harness restarted (ADR-0024/0031). Settled first, so a hold whose Turn is over reads
+      // `turnComplete`: that is an EARLIER Turn's pick (a route left its state, and the answer went as
+      // a notice to the next Turn, or nowhere) — never this Turn's, whatever it continues.
+      outstandingOf: (instanceId) => {
+        const run = this.runs.get(record.runId);
+        if (run && run.holds === holds) this.settleHolds(run);
+        const hold = holds.get(instanceId);
+        if (hold?.answer?.turnComplete) return undefined;
+        return (
+          hold && {
+            pick: hold.pick,
+            answered: hold.answer !== undefined,
+            turnComplete: hold.answer?.turnComplete ?? false,
+            ...(hold.answer?.answer !== undefined ? { answer: hold.answer.answer } : {}),
+            fetched: hold.fetched === true,
+          }
+        );
+      },
+      // The `answer` action's two halves (ADR-0067): the chain of the one pick being answered of an
+      // Agent whose state the action is written below — the one in its own send first, else the one
+      // outstanding — and the value that replaces its default answer.
+      chainOf: (machine, seat, event) => {
+        const pick = this.answeringIn(machine, seat, record.runId, holds, startedBy, event);
+        if (pick === undefined) return undefined;
+        return "reg" in pick ? [...pick.chain] : [...(pick.chain ?? [])];
+      },
+      setAnswer: (machine, seat, value, event) => {
+        const pick = this.answeringIn(machine, seat, record.runId, holds, startedBy, event);
+        if (pick === undefined) return;
+        // Not saved here: the action runs inside a transition, and the persist that follows it carries
+        // the value — a save now would read the Machine before its route, and answer too early.
+        pick.shaped = jsonOf(value);
+      },
+      // The Effect ledger's two halves (ADR-0067). A write is saved AT THE WRITE, like an admission:
+      // an intent row must be on disk, with the snapshot that holds its Effect, before the call
+      // leaves. A row written inside a transition (an abort) waits for the save that carries that
+      // transition — a cancel's final save included, which untracks the run — and is saved after
+      // it only when nothing else did. A row written around a park lands in memory and skips the save.
+      effectRow: (effectId) => effects[effectId],
+      effectRows: () => effects,
+      recordEffect: (effectId, row, save = "now") => {
+        effects[effectId] = row;
+        const persist = (): void => {
+          const run = this.runs.get(record.runId);
+          if (run && run.effects === effects) this.persist(run);
+        };
+        if (save === "now") persist();
+        else queueMicrotask(persist);
+      },
+      heldAnswerDelivered: (instanceId) => {
+        const hold = holds.get(instanceId);
+        if (hold) hold.fetched = true;
+      },
+      // A Chart by name (ADR-0070, D-C): among the Charts of the wrapper that is the run's Workflow.
+      chartNamed: (name) => this.namedChart(wrapperName(record.workflow), name)?.text,
     };
     let bound = false;
+    let firedTimer: ((source: unknown, event: unknown) => boolean) | undefined;
+    // The children each Machine of the tree had after its last microstep: what the next one started
+    // is the difference (ADR-0067's attribution of a child to the pick whose work started it).
+    const childrenAfter = new WeakMap<AnyActorRef, Set<AnyActorRef>>();
+    const childRefsOf = (snapshot: unknown): Set<AnyActorRef> =>
+      new Set(Object.values((snapshot as { children?: Record<string, AnyActorRef> } | undefined)?.children ?? {}));
     const actor = createActor(machine, {
+      clock: this.clock,
       ...options,
       inspect: (ev) => {
         // Bind the run's actor SYSTEM on the ROOT's creation event — the first inspection event,
@@ -1024,12 +2543,64 @@ export class RunHost {
         if (!bound && ev.type === "@xstate.actor") {
           bound = true;
           bindRun((ev.actorRef as AnyActorRef).system, binding);
+          // …and watch its scheduler before anything is armed: whether an event the Machine took
+          // was a timer it set, or an event an actor sent at once, decides `cutShort` below.
+          firedTimer = watchTimers((ev.actorRef as AnyActorRef).system);
+        }
+        // A restored hold is the Turn of the FIRST registration of its address in this tree: bind
+        // it as soon as one exists, before an event can end that Turn and start another at the same
+        // address (`continue: true` re-registers it). Every inspection event, so it is bound before
+        // the restored Machine processes anything: the root's snapshot comes after its children
+        // start and before its mailbox drains.
+        for (const hold of holds.values()) {
+          if (hold.answer !== undefined || this.holdRegs.has(hold)) continue;
+          const reg = this.table.lookup(agentAddress(hold.instanceId));
+          if (reg && reg.runId === record.runId && reg.invokeId === hold.invokeId) this.holdRegs.set(hold, reg);
         }
         // Forward the workflow author's `emit({...})` onto the feeds, from EVERY actor in the
         // tree as it is created: xstate scopes emitted events to the actor that emits them — no
         // bubbling — and a run's Emits mostly happen in child machines (a `workspace()` body IS
         // one). A root-only subscription silently dropped exactly the Emits ADR-0022/0023 exist
         // to surface. The subscription dies with its actor; restore re-creates both.
+        // The children a pick's own send starts are its Agent's (ADR-0067): their done events name
+        // the Agent an `answer` below no Agent's state shapes. Each place an `answer` is written runs
+        // as its own seat: each Machine of the tree is placed as its actor is created, before its
+        // first state is entered (`placeAnswers`).
+        if (ev.type === "@xstate.actor") {
+          const sending = this.sending;
+          const child = ev.actorRef as AnyActorRef;
+          const logic = (child as { logic?: unknown }).logic as AnyStateMachine | undefined;
+          if (logic && typeof logic === "object" && "root" in logic) placeAnswers(logic);
+          if (sending && child._parent !== undefined && child._parent === sending.reg.invoker) {
+            const agent = sending.reg.sender?.id;
+            const invoke = sending.reg.invokeId;
+            const key = childKey(child._parent, child.id);
+            if (agent !== undefined) startedBy[key] = invoke !== undefined ? { agent, invoke } : { agent };
+            else delete startedBy[key];
+          }
+        }
+        // …and so are the children its later work starts: a child started while the Machine takes an
+        // event that is already that Agent's — a done event of a child it started, or its own event —
+        // is that Agent's too, so the work its pick began stays its own (ADR-0067). A child started
+        // on an event that names no Agent (a timer) below the state of an Agent whose pick is
+        // outstanding is that pick's work by the Rest rule, so it is that Agent's (ADR-0024); any
+        // other child started on such an event is no Agent's.
+        if (ev.type === "@xstate.microstep") {
+          const taker = ev.actorRef as AnyActorRef;
+          const before = childrenAfter.get(taker) ?? childRefsOf(taker.getSnapshot());
+          const snapshot = (ev as { snapshot?: unknown }).snapshot;
+          const after = childRefsOf(snapshot);
+          childrenAfter.set(taker, after);
+          const started = [...after].filter((c) => !before.has(c)).map((c) => c.id);
+          if (started.length > 0 && !this.sending) {
+            const agent = agentOfEvent(ev.event as AnyEventObject, startedBy, taker);
+            for (const id of started) {
+              const owner = agent ?? this.outstandingAbove(taker, snapshot as AnyMachineSnapshot, id, holds);
+              if (owner !== undefined) startedBy[childKey(taker, id)] = owner;
+              else delete startedBy[childKey(taker, id)];
+            }
+          }
+        }
         if (ev.type === "@xstate.actor") {
           const ref = ev.actorRef as AnyActorRef & { on?: (type: string, handler: (e: unknown) => void) => unknown };
           ref.on?.("*", (emitted) => {
@@ -1040,10 +2611,61 @@ export class RunHost {
             this.announce(record.workflow, { kind: "emit", runId: record.runId, event });
           });
         }
+        // The chain (ADR-0024): every reply from below the Agent's state while one of its picks is
+        // outstanding — inspected as it is relayed, before the Machine processes it, so the states
+        // it came from are still active — and the last is the answer's default. The Machine's own
+        // events, and events from outside the states below the Agent's, are skipped (`replyOf`).
+        // A reply inside the pick's own send comes before any hold exists: `sending` records it.
+        if (ev.type === "@xstate.event") {
+          const replyTo = (reg: Registration | undefined): PickAnswer | undefined => {
+            if (!reg?.invoker || !reg.invokeId || reg.invoker !== ev.actorRef) return undefined;
+            const seat = seatOf(reg.invoker.getSnapshot() as AnyMachineSnapshot, reg.invokeId);
+            return seat && replyOf(ev.event, ev.sourceRef as AnyActorRef | undefined, reg.invoker, seat);
+          };
+          // A child's error from below the Agent's state is no reply: the pick's answer carries none,
+          // and the operator reads it on the run's feed (ADR-0024).
+          const errorTo = (reg: Registration | undefined, pick: string): void => {
+            if (!reg?.invoker || !reg.invokeId || reg.invoker !== ev.actorRef) return;
+            const seat = seatOf(reg.invoker.getSnapshot() as AnyMachineSnapshot, reg.invokeId);
+            const failed = seat && childErrorOf(ev.event, ev.sourceRef as AnyActorRef | undefined, reg.invoker, seat);
+            const run = this.runs.get(record.runId);
+            if (!failed || !run || run.binding !== binding) return;
+            this.feed(run, { kind: "child-error", agent: reg.sender?.id ?? "", pick, ...failed });
+          };
+          // Every relayed event is asked, so the watch forgets each timer as it fires.
+          const timer = firedTimer?.(ev.sourceRef, ev.event) === true;
+          for (const hold of holds.values()) {
+            if (hold.answer !== undefined) continue;
+            const live = this.table.lookup(agentAddress(hold.instanceId));
+            const reg = this.holdRegs.get(hold) ?? live;
+            const reply = replyTo(reg);
+            if (reply) hold.chain = [...(hold.chain ?? []), reply];
+            errorTo(reg, hold.pick);
+            // While the Agent's state is still the hold's, each event the Machine takes says who would
+            // move it out (`cutShort`), when the Machine that invokes the Agent or one above it takes
+            // it — events between the children below do not move it; once the state is gone, the next
+            // state's events are not the hold's:
+            //   - a reply: its route;
+            //   - an event a Machine sent itself at once (`sendTo(self)`; a `raise` is never relayed):
+            //     part of the route of the event whose actions sent it — no change;
+            //   - anything else — a timer the Machine set, an event from outside the states below, a
+            //     party's event, the Agent's own end: it stops the work below, if any still runs.
+            const taker = ev.actorRef as AnyActorRef;
+            if (reg === undefined || reg !== live || !reg.invoker || !atOrBelow(reg.invoker, taker)) continue;
+            if (reply) delete hold.cutShort;
+            else if (!timer && ev.sourceRef === taker) continue;
+            else if (stillRunning(reg)) hold.cutShort = true;
+            else delete hold.cutShort;
+          }
+          const sending = this.sending;
+          const reply = sending && replyTo(sending.reg);
+          if (sending && reply) sending.chain.push(reply);
+          if (sending) errorTo(sending.reg, sending.pick);
+        }
         if (ev.type === "@xstate.snapshot") schedule();
       },
     });
-    live = this.track(record, actor, def, agents, epochs, binding);
+    live = this.track(record, actor, def, agents, epochs, notices, binding, holds, effects, startedBy);
     return actor;
   }
 
@@ -1053,9 +2675,26 @@ export class RunHost {
     def: WorkflowDef,
     agents: Record<string, AgentAdmission>,
     epochs: Record<string, number>,
+    notices: NoticeLedger,
     binding: RunBinding,
+    holds: Map<string, Hold>,
+    effects: Record<string, EffectRow>,
+    startedBy: Record<string, StartedBy>,
   ): LiveRun {
-    const run: LiveRun = { record, actor, def, agents, epochs, binding, listeners: new Set(), feedSoFar: [] };
+    const run: LiveRun = {
+      record,
+      actor,
+      def,
+      agents,
+      epochs,
+      notices,
+      holds,
+      effects,
+      startedBy,
+      binding,
+      listeners: new Set(),
+      feedSoFar: [],
+    };
     this.runs.set(record.runId, run);
     // Ordinary persistence rides the inspection stream (see `spawn`); the subscription exists
     // for the ERROR channel: an errored actor (an invoke threw — e.g. ADR-0011's invoke-time
@@ -1065,9 +2704,13 @@ export class RunHost {
       error: (err) => {
         run.fault = err instanceof Error ? err.message : String(err);
         this.persist(run);
-        // Nothing to release: a faulted run stops its actors, and each workspace's lease is one
-        // of them (ADR-0021). The pod stays up for inspection (ADR-0012's destroy-less terminal)
-        // and ages out of the operator's idle timeout on its own.
+        // A faulted run stops its actors — each workspace's lease among them (ADR-0021), and a
+        // Workspace still `placing` deletes the Sandbox that never ran (ADR-0064). Said here, not
+        // assumed: xstate ends a machine on an unhandled child error WITHOUT stopping its other
+        // children, so a lease beside the actor that failed would renew for nobody, forever. The
+        // pod that was placed stays up for inspection (ADR-0012's destroy-less terminal) and ages
+        // out of the operator's idle timeout on its own.
+        stopTree(actor);
       },
     });
     // (The author's `emit({...})` forwarding lives in `spawn`'s inspect handler — per actor,
@@ -1096,6 +2739,8 @@ export class RunHost {
    * status and the one the feeds report.
    */
   private persist(run: LiveRun, terminal?: string): void {
+    // The holds first: an answer read at Rest, and a notice a route out raised, ride this same save.
+    this.settleHolds(run);
     const snapshot = run.actor.getPersistedSnapshot();
     const machineStatus = (snapshot as { status?: string }).status ?? "active";
     const serialized = serializeSnapshot(snapshot, {
@@ -1108,13 +2753,31 @@ export class RunHost {
       // Stamped on every save, off the registered TEMPLATE (never the per-run `.provide()` result —
       // providers do not change shape, and `fingerprintOf` memoizes per machine object). ADR-0030.
       machine: fingerprintOf(run.def.machine),
+      // The Assembly the run started under (ADR-0069): the def it was spawned with, never the
+      // current one, so a publish mid-run does not restamp it, and a restore spawns it with the
+      // hash its blob named.
+      ...(run.def.assembly !== undefined ? { assembly: run.def.assembly } : {}),
       snapshot: serialized,
       agents: run.agents,
       epochs: run.epochs,
+      notices: run.notices.state(),
+      timers: pendingTimers(run.actor, this.now()),
+      holds: [...run.holds.values()],
+      effects: run.effects,
+      startedBy: liveStartedBy(run.startedBy, run.actor),
       fault: run.fault,
     };
     const status = terminal ?? (machineStatus === "active" ? "live" : machineStatus);
-    void this.store.save(run.record.runId, blob, status);
+    // A save that fails is this run's fault, never the process's: an unhandled rejection would end
+    // the Orchestrator and every run on it. The run keeps its last saved snapshot.
+    this.store.save(run.record.runId, blob, status).catch((err: unknown) => {
+      console.error(
+        `run ${run.record.runId}: its snapshot was not saved: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    });
+    // The save is on disk (the store writes synchronously, ADR-0065): a settled row whose transition
+    // it carries keeps no tail in the next one (ADR-0067).
+    dropSavedTails(run.effects, snapshot);
 
     // Feed per-run observers (SSE/CLI watch). On the terminal transition emit the final status
     // BEFORE untrack drops the run from the registry, then drop the now-useless listener set.
@@ -1136,3 +2799,76 @@ export class RunHost {
     }
   }
 }
+
+/** Does work still run below the Agent's state of `reg` — a live child of an active state under it?
+ * A timer that holds Rest is no work: when the state exits, nothing it started is stopped. */
+function stillRunning(reg: Registration): boolean {
+  if (!reg.invoker || !reg.invokeId) return false;
+  const seat = seatOf(reg.invoker.getSnapshot() as AnyMachineSnapshot, reg.invokeId);
+  return seat !== undefined && runningBelow(reg.invoker, seat).length > 0;
+}
+
+/** `actor` is `ref`, or `ref` is its parent, its parent's parent, and so on up to the root. */
+function atOrBelow(actor: AnyActorRef, ref: AnyActorRef): boolean {
+  for (let at: AnyActorRef | undefined = actor; at !== undefined; at = at._parent) if (at === ref) return true;
+  return false;
+}
+
+/** A status's bound fields (ADR-0070): `bound`, and the hashes of the Charts bound, distinct and
+ * sorted. Both absent when the snapshot binds no Chart. */
+function boundFields(snap: unknown): { bound?: true; chartHashes?: string[] } {
+  const hashes = [...new Set(boundChartRoutesOf(snap).map((route) => route.chartHash))].sort();
+  return hashes.length ? { bound: true, chartHashes: hashes } : {};
+}
+
+/** A live actor's children, by id. */
+function childrenOfRef(ref: AnyActorRef): Record<string, AnyActorRef> {
+  return (ref.getSnapshot() as { children?: Record<string, AnyActorRef> } | undefined)?.children ?? {};
+}
+
+/** A stored run's bound Chart, compiled again from its text under the Open body it binds, for the
+ * run's doc — or why it is not: the doc then keeps the slot's subgraph and names the reason. */
+function compileStored(machine: AnyStateMachine, route: BoundChartRoute): AnyStateMachine | string {
+  let at: AnyStateMachine = machine;
+  for (const src of route.srcs.slice(0, -1)) {
+    const logic = (at.implementations.actors as Record<string, unknown>)[src];
+    if (isOpenBody(logic)) continue;
+    if (!(logic as AnyStateMachine | undefined)?.root) return `no Machine at slot "${src}"`;
+    at = logic as AnyStateMachine;
+  }
+  const logic = (at.implementations.actors as Record<string, unknown>)[route.src];
+  if (!isOpenBody(logic)) return `slot "${route.src}" is no Open body`;
+  const decl = openBodyDeclarationOf(logic);
+  const lent = lentIn(at.implementations as never, decl);
+  try {
+    return compileChart(admitChart(route.chart, decl, lent), lent, decl, { id: route.src });
+  } catch (err) {
+    return err instanceof ChartRefusal
+      ? `the door refuses the Chart: ${err.report.join("; ")}`
+      : err instanceof Error
+        ? err.message
+        : String(err);
+  }
+}
+
+/** Put a compiled Chart's body under the states of `doc` that invoke the Open body at the end of
+ * `srcs`, descending through the child Machine docs the earlier slots name. */
+function placeBody(doc: MachineBodyDoc, srcs: readonly string[], body: MachineBodyDoc): void {
+  const [src, ...rest] = srcs;
+  if (src === undefined) return;
+  const visit = (state: MachineStateDoc): void => {
+    if (rest.length === 0) {
+      for (const inv of state.invoke) {
+        if (inv.src !== src) continue;
+        const child: ChildMachineDoc = { src, label: inv.id, via: "invoke", machine: body };
+        const at = state.children.findIndex((c) => c.src === src);
+        if (at >= 0) state.children[at] = child;
+        else state.children.push(child);
+      }
+    } else {
+      for (const child of state.children) if (child.src === src && child.machine) placeBody(child.machine, rest, body);
+    }
+    for (const nested of state.states) visit(nested);
+  };
+  visit(doc.root);
+}