@jr2/orchestrator 0.3.0 → 0.5.1

package/src/actor.ts

@@ -8,9 +8,9 @@
 //      pod's Custodian (`/agents/<iid>/events` — ADR-0013), are validated by the table, and land on the
 //      state that invoked the agent — at any nesting depth, no routing, no `instanceId` on
 //      domain events (the closure IS the provenance). `/agents/<iid>/surface` serves exactly
-//      this registration, so menus are state-scoped by lifecycle (ADR-0006's dynamic
-//      advertisement, for free — and, per ADR-0013, with no `list_changed` needed: the
-//      Harness re-lists per Submission).
+//      this registration: the Agent's Menu, fixed for the conversation, and the Allowed picks,
+//      state-scoped by lifecycle (ADR-0029 — with no `list_changed` needed, per ADR-0013: the
+//      Harness re-reads per Submission).
 //
 //   2. ADMITS the run over the Harness at `input.endpoint` — the port is constructed
 //      per-invocation from serializable input (ADR-0007/0011 doctrine), and a dev stub is just
@@ -51,8 +51,14 @@ import {
   type WorkspaceAccess,
 } from "./agent.ts";
 import { ambientHandlesFor, type AmbientHandles } from "./ambient.ts";
+import type { HarnessRestarts, MemoryKill } from "./workspace.ts";
 import { INSTANCE_HARNESS_SERVICE } from "./names.ts";
-import { agentAddress, continuedIid, resolveAccepts, runBindingOf } from "./registration.ts";
+import { SENDER_KEY } from "@jr2/agent-protocol";
+import { agentAddress, continuedIid, allowedPicks, resolveAccepts, runBindingOf } from "./registration.ts";
+import type { NoticeScope } from "./notices.ts";
+import { restOf } from "./rest.ts";
+import { SUBMISSION_HARNESS_RESTARTED, SUBMISSION_RUNAWAY, type Notice, type PodMemoryKill } from "./wire.ts";
+import type { AbortCause } from "./wire.ts";
 
 /**
  * One admitted Submission — the durable re-attach handle (ADR-0016). The wire fields are
@@ -75,6 +81,47 @@ export type AgentAdmission = {
    * aborts the LIVE conversation, never the dead original the ledger is keyed by.
    */
   instanceId?: string;
+  /**
+   * The Turn that ledgered this admission — the input's `turnId`, stamped by the ACTOR at ledger
+   * time. The ledger is keyed by `instanceId`, which a continued Turn shares with the Turn before
+   * it, so a restore compares this with the restored input's own: a mismatch is an admission of an
+   * EARLIER Turn, and the restored Turn was not admitted yet (ADR-0016).
+   */
+  turnId?: string;
+  /**
+   * The Harness container's restart count when this admission was answered (ADR-0021) — stamped by
+   * the ACTOR, for a Turn in a Sandbox Workspace whose watch had spoken. A count above it means
+   * the process holding the conversation died; a restore holds the re-attached Turn to the same
+   * mark.
+   */
+  harnessRestarts?: number;
+  /**
+   * When this admission's Turn started — stamped by the ACTOR on every admission of a Turn in a
+   * Workspace, so a restore reads back the real start, not the restore's: a kernel kill is held against it
+   * (ADR-0061), and a guard kill too when the Turn's first read of the pod's kills failed.
+   */
+  turnStarted?: string;
+  /**
+   * The newest guard kill in the pod's list when the Turn's first read of it was answered
+   * (ADR-0062), or {@link NO_KILLS} for an empty list — stamped by the ACTOR on every admission of
+   * a Turn in a Workspace. A nudge or a wake carries only kills after it, so it never tells the Agent of a kill
+   * from before its Turn. Absent when that first read failed.
+   */
+  killMark?: string;
+  /**
+   * The Turn's task, its Frame's prompt — stamped by the ACTOR on every admission of the Turn,
+   * because a restore drops `prompt` from the input: a re-admission onto a conversation the
+   * Harness lost must send the task again, and has no other copy of it (ADR-0062).
+   */
+  task?: string;
+  /**
+   * The Agent and the Harness base URL this admission was answered by — stamped by the ACTOR at
+   * ledger time, like `instanceId`. Together with `instanceId` they name the conversation on its
+   * Harness, which is what the live set is built from (ADR-0031): the host states the Instance
+   * Harness's live conversations from these ledger entries alone.
+   */
+  agent?: string;
+  endpoint?: string;
 };
 
 /**
@@ -117,6 +164,8 @@ export type AgentTurnInput = {
    * ADR-0028's containment claim, which per-invocation escalation would void.
    */
   model?: string;
+  /** Omitted → the definition's, else `off`. A model with no `off` runs at the level its provider
+   * chooses; the printed conversation names it. */
   thinkingLevel?: ThinkingLevel;
   /**
    * Continue this Agent's ONE conversation in this Machine instance (ADR-0016, ADR-0057) — the
@@ -131,7 +180,8 @@ export type AgentTurnInput = {
    * share a conversation (the name is in the id), and two Pool children never collide (each
    * worker is its own Machine instance). A conversation jr2 has faulted is never continued: the
    * next `continue` lands on a virgin one (ADR-0035, ADR-0057) — and re-briefing that Turn is the
-   * author's, because jr2 cannot write that prompt.
+   * author's, because jr2 cannot write that prompt. A Harness restart is the exception: it cut the
+   * Turn, and the rebuilt Harness holds the conversation (ADR-0031).
    */
   continue?: true;
 };
@@ -161,6 +211,14 @@ export type AgentRunInput = {
    * is what the Harness route, the minted iid, the markers and the telemetry all name. */
   agentName: string;
   instanceId: string;
+  /**
+   * This Turn's Turn ID — minted by the input mapper, one per invocation, and persisted with the
+   * input (ADR-0016). Two Turns that continue one conversation share `instanceId`, the ledger's
+   * key, and not this: the actor stamps it on every admission it ledgers, and a restore
+   * re-attaches only an admission that this Turn ledgered. Absent (a plain `setup()` machine that
+   * passes finalized input), the key alone decides, as before.
+   */
+  turnId?: string;
   /**
    * The Harness base URL, EXPLICIT (ADR-0016): only for a workspace-less run (the mechanics
    * tier's stub Harness, a dev endpoint — just a URL, ADR-0011). Inside a `workspace()` leave it
@@ -202,17 +260,38 @@ export type AgentRunInput = {
    *     fresh invocation, which already mints its own conversation.
    */
   continuation?: boolean;
-  /** Event names (from the invoking Machine's vocabulary) this invocation accepts over MCP. */
+  /** Event names (from the invoking Machine's vocabulary) this invocation accepts: the invoking
+   * state's derived set, which delivery validates against and the Allowed picks narrow. */
   tools: readonly string[];
+  /**
+   * The Agent's MENU (ADR-0029): the union of `tools` over every state of this Machine that invokes
+   * an Agent of this name, in a fixed order — what the surface serves as the tools block, the same
+   * for every Turn of the conversation. `jr2Setup` always sets it; absent (a plain `setup()`
+   * machine passing finalized input), `tools` is the Menu.
+   */
+  menu?: readonly string[];
 };
 
-/** Telemetry sent up when the run is out of options: the Submission settled failed/aborted
- * (infra fault after the turn's own provider retries — ADR-0027), the no-signal nudge budget ran
- * dry, or the runaway reroll budget did (ADR-0035). The ONE terminal event (ADR-0016) — where it
- * routes is workflow policy. */
+// Sent when the run is out of options: the Submission settled failed/aborted (infra fault after
+// the turn's own provider retries — ADR-0027), the no-signal nudge budget ran dry, or the runaway
+// reroll budget did (ADR-0035). The ONE terminal event (ADR-0016) — where it routes is workflow
+// policy.
+/** jr2 sends `agent.fault` to the Machine when an Agent's Turn cannot go on: the Harness failed
+ * the Turn, or the Agent ended its Turns with no pick after every nudge. The Machine decides what
+ * to do next. Route it in the state that invokes the Agent, or in a state above it, with
+ * `on: { "agent.fault": … }`; one route on the root is a route for each state. `jr2 check` and
+ * `jr2 up` refuse a state that invokes an Agent, or an Open body that can run one, with no route for
+ * it. When the event comes and no transition takes it (the route's guard is false), the run ends
+ * `error`, with the event, the state and the reason in its fault. In a Chart the route is optional:
+ * when no transition of the Chart takes the event, the Open body sends it, unchanged, to the Machine
+ * that invoked the body, whose route takes it. */
 export type FaultTelemetry = {
   type: "agent.fault";
+  /** The Instance ID of the Agent's conversation that failed: the same id on each Turn that
+   * continues it. */
   instanceId: string;
+  /** Why the Turn failed, as text for a person or a log: the Harness's error, or that the Agent
+   * ended its Turns without a pick after every nudge. Route on the event, not on this text. */
   reason: string;
 };
 
@@ -238,24 +317,104 @@ export interface AgentRunPort {
   admit(input: AgentRunInput, opts: AgentAdmitOptions): Promise<AgentAdmission>;
   /**
    * Follow an admitted submission until it settles. Resolving means the submission completed;
-   * rejecting means it settled failed/aborted (or the conversation is gone).
+   * rejecting means it settled failed/ended/aborted (or the conversation is gone).
    */
-  settle(admission: AgentAdmission, opts?: { signal?: AbortSignal }): Promise<void>;
+  settle(admission: AgentAdmission, opts?: AgentSettleOptions): Promise<void>;
+  /**
+   * Does the Harness still hold this conversation (ADR-0062)? Asked before a continued Turn whose
+   * conversation was admitted before: a Harness that restarted between the Turns lost it with no
+   * fault to say so, and the Turn is told its conversation is new. Answers `true` whenever it
+   * cannot tell — unknown is never loss. A wrong `true` is caught at the admission that follows:
+   * it says `kept`, and a Harness that keeps no such conversation refuses it.
+   */
+  holds(agentName: string, instanceId: string, opts?: { signal?: AbortSignal }): Promise<boolean>;
+  /**
+   * The pod's guard kills (ADR-0061, ADR-0062), every one with `told`: the conversations whose
+   * running `bash` call answered its verdict. A stream is read only while a Submission's wait
+   * runs, and a kill while none runs, or after the wait stopped, reaches no reader there. Asked before a Turn's admission into a
+   * Workspace. A read changes nothing on the Harness; the notice ledger keeps each kill's id.
+   * Answers `undefined` whenever it cannot tell — not `[]`, which says the list is empty — and the
+   * kill stays on the Harness for the next read.
+   */
+  memoryKills(opts?: { signal?: AbortSignal }): Promise<ListedKill[] | undefined>;
   /**
    * End the instance's in-flight (and queued) work — the turn is over (ADR-0024). Resolving means
    * the intent is RECORDED, not that the submission has settled; jr2 never observes that outcome,
    * because the actor is already stopped by the time this is called. The actor passes no `signal`
    * for exactly that reason — its own controller is already aborted — but the option is here for
-   * parity with the other two.
+   * parity with the other two. `cause: "pick"` says the Turn's own pick ended it, so the Harness
+   * settles the Submission `ended`; with no cause it settles `aborted`.
    */
-  abort(agentName: string, instanceId: string, opts?: { signal?: AbortSignal }): Promise<void>;
+  abort(
+    agentName: string,
+    instanceId: string,
+    opts?: { signal?: AbortSignal; cause?: AbortCause; submissionId?: string },
+  ): Promise<void>;
 }
 
 /** What every admission carries beside the input: the Agent definition this Turn runs (ADR-0049),
  * plus the local abandon signal. Not part of {@link AgentRunInput} on purpose — that shape is
  * PERSISTED as the child's input, and a definition frozen into a snapshot would outlive the
  * Machine edit that changed it. */
-export type AgentAdmitOptions = { definition: AgentDefinition; signal?: AbortSignal };
+export type AgentAdmitOptions = {
+  definition: AgentDefinition;
+  signal?: AbortSignal;
+  /** The pending notices in this admission's scope (ADR-0062), for the Briefing's Turn part. Not
+   * on the persisted input either: they are the Orchestrator's, and delivered once. */
+  notices?: Notice[];
+  /** The admission is for a conversation that `holds` said the Harness keeps (ADR-0062): the
+   * re-admission after a cut, and a continued Turn. That "kept" can be a timeout's, so a Harness
+   * that keeps none refuses it and seats none; `admit` then rejects with an error whose `notKept`
+   * is true (the wire client's `ConversationNotKept`). */
+  kept?: boolean;
+};
+
+/** A memory kill by the Harness's own guard (ADR-0061, layer 4), as the Orchestrator reads it on
+ * an updates stream — the twin of {@link ListedKill}, which it reads in the pod's list:
+ * the guard's `peak` and `limit` — absent when what the stream said was not a size — and the
+ * kill's `id`, the same on every stream that carries it and in the pod's list
+ * (`AgentRunPort.memoryKills`), so every witness of one kill is one notice. `legacy`: an older
+ * Harness's event, which has no id; `id` is then the source the Orchestrator raised such an event
+ * with before, its place on the stream, so a replayed read is still the same kill. */
+export type StreamedKill = { id: string; legacy?: true; peak?: string; limit?: string };
+
+/** A kill read from the pod's list, as the port answers it: the wire's, but `peak` and `limit` are
+ * absent when the list's were not sizes — the kill is kept, and worded with no sizes (ADR-0062). */
+export type ListedKill = Omit<PodMemoryKill, "peak" | "limit"> & { peak?: string; limit?: string };
+
+/** The source a guard kill's notice is raised with: the Workspace and the kill's id. Both paths use
+ * it — the stream and the pod's list — so the ledger's `seen` makes them one notice. */
+const guardSource = (sandbox: string, id: string): string => `${sandbox}@guard:${id}`;
+
+/** The source a kernel kill's notice is raised with (ADR-0061, layer 5): the Workspace and when the
+ * Harness container ended, which names that one end. Both paths use it — the fault of a Turn the
+ * kill ended, and the read before an admission — so the ledger's `seen` makes them one notice. */
+const kernelSource = (sandbox: string, at: string): string => `${sandbox}@${at}`;
+
+/** How long the read of the pod's kills may take before it counts as none. */
+const MEMORY_KILLS_READ_MS = 5_000;
+
+/** How long "does the Harness still hold this conversation?" is asked again before the answer is
+ * taken as "held" — unknown is never loss, but a container that is starting is not unknown yet. */
+const HOLDS_READ_MS = 30_000;
+
+/** A `killMark` for a list that was empty: every kill read after it is the Turn's. Kill ids start
+ * `k-`, so it is never one. */
+export const NO_KILLS = "none";
+
+/** How far the pod's clock may run behind this one when a kill's `at` is held against a Turn's
+ * start — only when the Turn has no `killMark`: a kill stamped up to this much before the start
+ * still counts as in the Turn, so a slow pod clock does not hide a kill of this Turn. The two
+ * clocks are a node's and the Orchestrator's, both kept by the cluster's time service; one second
+ * is far more than they drift, and far less than a Turn. */
+const KILL_CLOCK_SKEW_MS = 1_000;
+
+/** What following a settlement may be told beside the settlement itself. */
+export type AgentSettleOptions = {
+  signal?: AbortSignal;
+  /** The Harness's guard killed the Agent's processes during this Submission (ADR-0061). */
+  onMemoryLimit?: (kill: StreamedKill) => void;
+};
 
 /** Build a port for one invocation from its serializable input (ADR-0011 static-import doctrine),
  * plus the Harness bearer for the placement that input resolved to (ADR-0058) — absent where no
@@ -281,30 +440,114 @@ export type AgentRunOptions = {
    * pathological, which belongs with the workflow's fault routing.
    */
   runawayBudget?: number;
+  /**
+   * How long the read of the pod's guard kills (ADR-0062) may take before it counts as none and
+   * the Turn is admitted without it. Default 5000 ms; a seam for tests, never an author dial.
+   */
+  memoryKillsReadMs?: number;
+  /**
+   * How long the actor asks whether a restarted Harness still holds a conversation before it
+   * takes "held" for an answer: the new container may not listen yet (ADR-0062). Default 30 s; a
+   * seam for tests, never an author dial.
+   */
+  holdsReadMs?: number;
 };
 
 /**
  * The runaway settlement class (ADR-0035), read STRUCTURALLY off a settle rejection: the wire
- * client's `SettlementFault` carries the Settlement, but this module is wire-free (see header),
- * so the literal is restated (`SUBMISSION_RUNAWAY` in `./wire.ts`) and the shape
- * duck-typed. A lost conversation (404) carries no settlement, so it stays terminal like every
- * other class.
+ * client's `SettlementFault` carries the Settlement, but this module never loads the wire client
+ * (see header), so the shape is duck-typed. The literal is the wire's own `SUBMISSION_RUNAWAY` —
+ * `./wire.ts` is shapes and constants, nothing a test load path pays for — and wire-types.test.ts
+ * holds it to the Harness's. A lost conversation (404) carries no settlement, so it stays
+ * terminal like every other class.
  */
 function runawayReason(err: unknown): string | undefined {
   if (typeof err !== "object" || err === null) return undefined;
   const error = (err as { settlement?: { error?: { type?: string; message?: string } } }).settlement?.error;
-  return error?.type === "runaway" ? (error.message ?? "runaway") : undefined;
+  return error?.type === SUBMISSION_RUNAWAY ? (error.message ?? SUBMISSION_RUNAWAY) : undefined;
 }
 
-/** The forced-final-pick re-prompt (ADR-0006, absorbed here by ADR-0016). */
-function nudgePrompt(tools: readonly string[]): string {
-  return (
-    `Your previous turn ended without calling one of the required workflow tools. ` +
-    `You MUST end your turn by calling exactly one of: ${tools.join(", ")}. ` +
-    `Pick the one that matches the true state of your work and call it now.`
-  );
+/** The Harness's fixed prefix for a provider that refused the load (ADR-0064), restated like the
+ * runaway literal: `PROVIDER_LIMIT` in `@jr2/harness`. */
+const PROVIDER_LIMIT = "provider limit";
+
+/**
+ * A provider limit (ADR-0064), read STRUCTURALLY like {@link runawayReason}: the Settlement's own
+ * message, unwrapped, so the fault reason STARTS with the fixed prefix — as a memory kill's does
+ * (ADR-0061) — and the Machine and `jr2 status` can key on it.
+ */
+function providerLimitReason(err: unknown): string | undefined {
+  if (typeof err !== "object" || err === null) return undefined;
+  const message = (err as { settlement?: { error?: { message?: unknown } } }).settlement?.error?.message;
+  return typeof message === "string" && message.startsWith(PROVIDER_LIMIT) ? message : undefined;
+}
+
+/** The kubelet's reason for a container the kernel killed at its memory limit (ADR-0061). */
+const OOM_KILLED = "OOMKilled";
+
+/** Why a Turn failed when its Harness restarted under it (ADR-0021), in the kubelet's words. */
+function harnessRestartReason(seen: HarnessRestarts): string {
+  const last = seen.lastTerminated;
+  return `Turn lost (Harness restarted: ${last?.reason ?? "unknown"}, exit ${last?.exitCode ?? "?"})`;
+}
+
+/**
+ * A Submission the Harness settled `failed` because it restarted under it (ADR-0031): the rebuilt
+ * stream says so, so the Orchestrator reads a Settlement, not a 404. Read STRUCTURALLY off the
+ * Settlement's typed error, like {@link runawayReason} — the wire's `SUBMISSION_HARNESS_RESTARTED`,
+ * held to the Harness's by wire-types.test.ts — and the message is only what the fault quotes.
+ * It can reach the actor BEFORE the watch's restart count does, and it is the only restart signal
+ * an Instance Harness gives — the watch does not see that pod.
+ */
+function settledByRestart(err: unknown): string | undefined {
+  if (typeof err !== "object" || err === null) return undefined;
+  const settlement = (err as { settlement?: { outcome?: unknown; error?: { type?: unknown; message?: unknown } } })
+    .settlement;
+  if (settlement?.outcome !== "failed" || settlement.error?.type !== SUBMISSION_HARNESS_RESTARTED) return undefined;
+  const message = settlement.error.message;
+  return typeof message === "string" ? message : "Harness restarted";
+}
+
+const errorMessage = (err: unknown): string => (err instanceof Error ? err.message : String(err));
+
+/**
+ * A lost conversation (ADR-0027), read STRUCTURALLY like {@link runawayReason}: the wire client's
+ * `SettlementFault` marks a 404 `lost`, and this module is wire-free. The one fault class a
+ * memory kill can hide behind (ADR-0061).
+ */
+function isLostConversation(err: unknown): boolean {
+  return typeof err === "object" && err !== null && (err as { lost?: unknown }).lost === true;
+}
+
+/** An admission for a kept conversation that the Harness refused: it keeps none (ADR-0062). Read
+ * structurally, as {@link isLostConversation} is: the wire client's `ConversationNotKept`. */
+function isNotKept(err: unknown): boolean {
+  return typeof err === "object" && err !== null && (err as { notKept?: unknown }).notKept === true;
 }
 
+/**
+ * The nudge (ADR-0006, absorbed here by ADR-0016). It names no picks: the Harness writes the Turn
+ * part after it, stating the Allowed picks in the model's own tool names and narrowed by the guards
+ * (ADR-0029, ADR-0062) — a list here would be a second one, in other names, that a closed guard
+ * makes wrong. Its first sentence stays true after a pick that left the Turn open, and for the
+ * wake: the ask-again rule asks whenever picks are allowed after a settle, picked or not, at once
+ * or when they open.
+ */
+const NUDGE_PROMPT =
+  `Your previous turn ended, and the workflow is still waiting for your pick. ` +
+  `You MUST end your turn by calling exactly one of the workflow tools allowed below. ` +
+  `Pick the one that matches the true state of your work and call it now.`;
+
+/**
+ * The re-admission after a Harness restart cut the Turn while the workflow was busy (ADR-0031). The
+ * Harness writes a cut call's history result itself ("its result comes in the next message") and the
+ * answer rides this admission as a `pick-answer` notice in the Briefing's Turn part, with the Allowed
+ * picks after it; this prompt says only what happened to the Turn.
+ */
+const READMIT_PROMPT =
+  `Your previous turn was cut: the process that ran you restarted while the workflow was busy. ` +
+  `The workflow did not stop. Continue your task from here.`;
+
 /**
  * Where this Turn works — the Frame's other half (ADR-0057), resolved before admission.
  *
@@ -316,8 +559,8 @@ function nudgePrompt(tools: readonly string[]): string {
  * slot's Worktree, which privileges nothing because there is nothing to choose between (ADR-0051);
  * a Workspace with more REFUSES the Turn, naming the slots in declaration order and the line that
  * ends it, because the kit gives no slot a meaning and a wrong guess is the silent failure
- * ADR-0057 was written for; and a run outside any Workspace frames nothing, so the Harness keeps
- * `/work`.
+ * ADR-0057 was written for; and a Workspace with no Repo Slot, or a run outside any Workspace,
+ * frames nothing, so the Harness keeps `/work`, the folder a slotless Workspace's steps share.
  *
  * Resolution counts SLOTS, and a slot's Worktree is the writable branch checkout. The detached
  * review Worktree (`AmbientHandles.review`, ADR-0028's reviewer seat) is never resolved to: it is
@@ -356,7 +599,10 @@ function frameCwd(
  *
  * The brand is a RUNTIME property, read back through `isAgent`, and deliberately NOT part of this
  * type: the unit-test seam is `provide({ actors: { coder: fake } })` (ADR-0049), and a required
- * `definition` here would make every fake carry a definition it never uses. */
+ * `definition` here would make every fake carry a definition it never uses.
+ *
+ * @internal
+ */
 export type AgentLogic = CallbackActorLogic<
   AgentRunReceiveEvent,
   AgentTurnInput | (AgentTurnInput & AgentTurnPlacement) | AgentRunInput
@@ -385,6 +631,8 @@ export function agentActorWith(
 ): AgentLogic {
   const nudgeBudget = options.nudgeBudget ?? 2;
   const runawayBudget = options.runawayBudget ?? 1;
+  const memoryKillsReadMs = options.memoryKillsReadMs ?? MEMORY_KILLS_READ_MS;
+  const holdsReadMs = options.holdsReadMs ?? HOLDS_READ_MS;
   // Typed as the union so BOTH shapes typecheck on an invoke: jr2Setup machines write
   // AgentTurnInput (and the config wrapper finalizes it before the actor ever runs); plain
   // setup() machines must pass the finalized shape themselves — checked loudly below.
@@ -460,8 +708,10 @@ export function agentActorWith(
     // Register this invocation's event surface (throws on a name outside the INVOKING MACHINE's
     // vocabulary — ADR-0011's invoke-time check, scoped to `self._parent.logic` because names are
     // per-Machine — which errors the run loudly at the invoking state).
-    // `signaled` is the no-signal detector: a delivered menu event means the Agent ended its
-    // turn the intended way, so a completed settlement needs no nudge. ONE invocation can hold
+    // `signaled`: a Menu pick was delivered in this invocation. It closes the runaway REROLL gate
+    // (below): replaying the identical prompt would deliver it again. It does not decide the nudge
+    // — the ask-again rule does, from the Allowed picks after the settle, because a delivered pick
+    // may leave the Turn open (a mode change, a pick with no target). ONE invocation can hold
     // more than one surface: a runaway reroll (ADR-0035) is a fresh conversation whose menu
     // dials `/mcp/<derived iid>`, so its address must be live too — same defs, same deliver,
     // because whichever conversation answers, it answers THIS invocation.
@@ -473,7 +723,17 @@ export function agentActorWith(
     // already ended.
     let currentIid = input.attach?.instanceId ?? instanceId;
     const defs = resolveAccepts(self, input.tools);
+    // The Menu (ADR-0029): resolved against the same vocabulary, and served as the tools block.
+    const menu = resolveAccepts(self, input.menu ?? input.tools);
     const disposers: Array<() => void> = [];
+    // Who this Turn's picks are from (ADR-0015): the slot, written on every event it delivers; and
+    // the invoke id that finds its state in the Machine. Both static, so a restore recomputes them.
+    const seat = { sender: { party: "agent", id: input.agentName } as const, invokeId: self.id };
+    // This Agent's continued conversation in this Machine (ADR-0057) — the base id the epoch ledger
+    // burns. This Turn is PART of it only when it continues it: a fresh Turn is new by definition.
+    const conversation = continuedIid(self._parent, binding.runId, input.agentName);
+    // The iids whose surface the Harness has read (see `carried` below).
+    const served = new Set<string>();
     const registerSurface = (iid: string) =>
       disposers.push(
         binding.table.register({
@@ -482,13 +742,15 @@ export function agentActorWith(
           kind: "agent",
           id: iid,
           defs,
+          menu,
           sandbox,
           deliver: (event) => {
             signaled = true;
             // The settlement-pick marker (ADR-0023), BEFORE the delivery moves the Machine: the pick
             // must land on the feed ahead of the status delta it causes, or the narrative reads
-            // effect-then-cause.
-            const { type, ...payload } = event;
+            // effect-then-cause. The sender is the Orchestrator's field, not the pick's payload: the
+            // printed conversation shows what the Agent picked, nothing more.
+            const { type, [SENDER_KEY]: _sender, ...payload } = event;
             binding.marker?.({
               kind: "pick",
               agent: input.agentName,
@@ -498,10 +760,16 @@ export function agentActorWith(
             });
             sendBack(event);
           },
+          // The Harness read this Turn's surface: it has the Turn in hand, and prompts it.
+          served: () => served.add(iid),
           // The state that invoked us — the machine the menu derived from, so the only one whose
           // guards can say whether a pick would move anything (ADR-0029). Same `_parent` the ambient
           // walk above uses; structural, so a sibling's snapshot is unreachable.
           invoker: self._parent,
+          ...seat,
+          // Where a pick's answer goes when its route leaves the Agent's state (ADR-0024): the
+          // conversation this Turn continues, and none for a fresh Turn — no later Turn heard it.
+          ...(input.continuation ? { conversation } : {}),
         }),
       );
     registerSurface(currentIid);
@@ -510,19 +778,342 @@ export function agentActorWith(
     // delivery scope: the pod hosting this Turn. One name, both directions — the Custodian there may
     // speak for these picks, and only this bearer may drive the conversation there.
     const client = portFactory(endpoint, sandbox === undefined ? undefined : binding.harnessBearer?.(sandbox));
-    const controller = new AbortController();
+    // When this Turn started: a memory kill that ended the Harness before it is not this Turn's
+    // (ADR-0061). Undefined from a backend that cannot see the container — and never throws:
+    // naming the fault is a courtesy, the fault itself lands either way.
+    // Read back on a restore: the start is the Turn's, not this process's.
+    const turnStarted = input.attach?.turnStarted ? new Date(input.attach.turnStarted) : new Date();
+    const memoryFault = (name: string): Promise<MemoryKill | undefined> =>
+      binding.sandbox?.memoryFault(name, turnStarted).catch(() => undefined) ?? Promise.resolve(undefined);
+    // Replaced after a Harness restart that cut the Turn while its state was busy: the cut aborted it.
+    let controller = new AbortController();
+
     // Shared per run, created on demand so the ordering guarantee holds for any binding.
     const pendingAborts = (binding.pendingAborts ??= new Map<string, Promise<void>>());
     let stopped = false;
+
+    // A Harness restart ends its Turns (ADR-0021): the Submission it held is cut (ADR-0031 keeps
+    // the conversation, not the Turn), and a Harness that crash-loops only ever refuses
+    // connections, so `wait` would reconnect forever. The watch sees the restart count pass its value at this Turn's
+    // admission, and the Turn fails at once — not its Workspace: the pod and `/work` survive.
+    // Sandbox Workspaces only: the Instance Harness is a StatefulSet the watch does not see, and
+    // its rebuilt stream settles the Turn `failed` instead (ADR-0031, `settledByRestart`).
+    let heardRestarts: HarnessRestarts | undefined;
+    let restartMark = input.attach?.harnessRestarts;
+    let restarted: HarnessRestarts | undefined;
+    // Whether a Harness has answered an admission of this Turn — before that there is nothing to
+    // lose, and nothing to hold a restart count against.
+    let admitted = input.attach !== undefined;
+    if (workspace !== "none" && sandbox !== undefined && binding.sandbox !== undefined) {
+      disposers.push(
+        binding.sandbox.harnessRestarts(sandbox, (seen) => {
+          heardRestarts = seen;
+          if (stopped || restarted !== undefined || !admitted) return;
+          if (restartMark === undefined) {
+            restartMark = seen.restartCount;
+            return;
+          }
+          if (seen.restartCount > restartMark) {
+            restarted = seen;
+            controller.abort(new Error("the Harness restarted"));
+          }
+        }),
+      );
+    }
     // Ledgered under the ORIGINAL iid — the persisted input's key, like a nudge's — with the
     // LIVE conversation stamped on the record, so a restore settle-follows the live submission
-    // AND re-addresses it (see `currentIid` above).
-    const ledger = (admission: AgentAdmission) =>
-      binding.recordAdmission?.(instanceId, { ...admission, instanceId: currentIid });
+    // AND re-addresses it (see `currentIid` above). The notices the admission carried are
+    // delivered by this same write (ADR-0062).
+    const ledger = (admission: AgentAdmission, delivered: readonly string[]) =>
+      binding.recordAdmission?.(
+        instanceId,
+        {
+          ...admission,
+          instanceId: currentIid,
+          agent: input.agentName,
+          endpoint,
+          ...(input.turnId === undefined ? {} : { turnId: input.turnId }),
+        },
+        delivered,
+      );
+
+    // Where this Turn hears notices (ADR-0062). Its continued conversation's — the base id the
+    // epoch ledger burns — only when it CONTINUES one: a fresh Turn is new by definition, and the
+    // notice waits for the `continue` whose context is gone. Its Workspace's only when it works in
+    // one: a Menu-only Agent hears conversation notices alone.
+    const noticeWorkspace = workspace !== "none" ? sandbox : undefined;
+    const noticeScope: NoticeScope = {
+      ...(input.continuation ? { conversation } : {}),
+      ...(noticeWorkspace !== undefined ? { workspace: noticeWorkspace } : {}),
+    };
+    // No `agent`: the notice names no Turn — what the pod's list says (below).
+    // No `limit`: the sizes read were not sizes, and the notice says none.
+    const memoryLimit = ({ limit, peak, agent }: { limit?: string; peak?: string; agent?: string }): Notice => ({
+      kind: "memory-limit",
+      scope: "workspace",
+      ...(agent === undefined ? {} : { agent }),
+      ...(limit === undefined ? {} : { limit, ...(peak === undefined ? {} : { peak }) }),
+    });
+    // The Harness's guard killed this Workspace's processes while this Turn's Submission ran
+    // (ADR-0061, layer 4), read on its stream while the wait is live — so the notice can name this
+    // Turn's Agent. A stopped actor's last poll names nothing: the state that asked for the Turn has
+    // exited, and the pod's list carries the kill. Keyed by the kill's id, so a second running
+    // conversation's stream, or the pod's list, adds nothing.
+    const onMemoryLimit = (kill: StreamedKill): void => {
+      if (stopped || noticeWorkspace === undefined) return;
+      binding.raiseNotice?.(
+        memoryLimit({ limit: kill.limit, peak: kill.peak, agent: input.agentName }),
+        noticeWorkspace,
+        kill.legacy ? kill.id : guardSource(noticeWorkspace, kill.id),
+      );
+    };
+    // …but a stream is not every kill's path. A kill while no Submission ran — a process an earlier
+    // Turn left running, killed while the workflow waited at a Gate — is on no stream, and a kill
+    // after a wait stopped (the Agent's state exited, its abort not yet landed) is on a stream that
+    // no one reads. The Harness keeps every kill, so the pod's list is read before notices are
+    // taken, and this admission carries what it finds. Keyed as on the stream: the ledger's `seen`,
+    // persisted with the run, makes a kill read on both paths, or read again after a restart of
+    // either side, one notice. The notice names no Turn: the list cannot say whose Turn a kill
+    // ended. One read raises at most one notice, the newest kill's; the older kills in it are only
+    // marked seen, so they never give a notice. A read that fails or times out is none: the list
+    // keeps the kill, and the next admission reads again.
+    //
+    // The Turn's first read sets its `killMark`, the newest kill it saw, ledgered with every
+    // admission of the Turn. Answers the sources a nudge or a wake of THIS conversation may carry:
+    // the kills after that mark — none from before the Turn, which would tell the Agent that
+    // processes it started in this Turn died — and after the newest kill its own `bash` call
+    // answered, whose answer said all its processes died. Those stay pending for the next Turn.
+    // Only when the first read failed is the Turn's start time the mark, held against `at`.
+    // A kernel kill (ADR-0061, layer 5) ends the Harness container, so no list keeps it and no
+    // stream carries it. A Turn it ended faults on it, and the fault raises its notice (below). A
+    // kill while no Turn ran faults nothing: the restarted Harness rebuilds its conversations. But
+    // the operator publishes the container's last end on the Sandbox, and the watch keeps it until
+    // the next end. So before each admission into the Workspace, a last end `OOMKilled` raises the
+    // notice, keyed by that end as the fault keys it: one notice for one kill, whichever path saw
+    // it first, and none again after a restart of either side. It names no Turn: the end cannot say
+    // whose Turn it was. A watch that has not listed yet says nothing; the next admission asks again.
+    // Not after a restart this Turn's watch saw: the Turn faults on it, or is re-admitted, and the
+    // fault's notice names this Turn's Agent — a raise here would take its source first.
+    const hearKernelKill = async (): Promise<void> => {
+      if (restarted !== undefined) return;
+      const last = heardRestarts?.lastTerminated;
+      if (noticeWorkspace === undefined || last?.reason !== OOM_KILLED || last.finishedAt === undefined) return;
+      const kill = await binding.sandbox
+        ?.memoryFault(noticeWorkspace, new Date(last.finishedAt))
+        .catch(() => undefined);
+      if (kill?.at === undefined) return;
+      binding.raiseNotice?.(
+        memoryLimit({ limit: kill.limit }),
+        noticeWorkspace,
+        kernelSource(noticeWorkspace, kill.at),
+      );
+    };
+    let killMark = input.attach?.killMark;
+    let firstRead = input.attach === undefined;
+    // `known: false`: the read could not tell, so which kills this conversation was told is not
+    // known either — an admission of the same Turn then takes no guard kill at all.
+    const hearPodKills = async (): Promise<{ known: boolean; unsaid: string[]; said: string[] }> => {
+      const none = { known: true, unsaid: [], said: [] };
+      if (noticeWorkspace === undefined) return none;
+      const first = firstRead;
+      firstRead = false;
+      let kills: ListedKill[] | undefined;
+      try {
+        kills = await client.memoryKills({
+          signal: AbortSignal.any([controller.signal, AbortSignal.timeout(memoryKillsReadMs)]),
+        });
+      } catch (err) {
+        // Stopped while it read: nothing more is admitted, and nothing is taken.
+        if (controller.signal.aborted) throw err;
+        return { ...none, known: false };
+      }
+      // Could not tell: no mark — an empty list is not what was seen — so the clock is the mark.
+      if (kills === undefined) return { ...none, known: false };
+      if (first) killMark = kills.at(-1)?.id ?? NO_KILLS;
+      const newest = kills.at(-1);
+      if (newest === undefined) return none;
+      binding.raiseNotice?.(
+        memoryLimit({ limit: newest.limit, peak: newest.peak }),
+        noticeWorkspace,
+        guardSource(noticeWorkspace, newest.id),
+        kills.slice(0, -1).map((kill) => guardSource(noticeWorkspace, kill.id)),
+      );
+      const toldHere = (kill: ListedKill): boolean =>
+        kill.told.some((t) => t.agent === input.agentName && t.instanceId === currentIid);
+      // The first kill after the Turn's mark. A mark no longer in the bounded list is older than
+      // every kill in it.
+      let from = 0;
+      kills.forEach((kill, i) => {
+        if (kill.id === killMark || toldHere(kill)) from = i + 1;
+      });
+      const inThisTurn = (kill: ListedKill): boolean =>
+        killMark !== undefined || Date.parse(kill.at) >= turnStarted.getTime() - KILL_CLOCK_SKEW_MS;
+      const unsaid = kills.slice(from).filter(inThisTurn);
+      return {
+        known: true,
+        unsaid: unsaid.map((kill) => guardSource(noticeWorkspace, kill.id)),
+        said: kills.filter((kill) => !unsaid.includes(kill)).map((kill) => guardSource(noticeWorkspace, kill.id)),
+      };
+    };
+
+    // The Turn's admission and a reroll's carry the pending notices in scope — a reroll's
+    // conversation is fresh, and has heard nothing. A nudge's and a wake's carry only the guard
+    // kills of this Turn that came after its own `bash` call's last kill verdict (`hearPodKills`):
+    // they re-prompt the Turn within itself (ADR-0016), so a kill that verdict covers is already in
+    // its context, and is for the next Turn in the Workspace (ADR-0062). A later kill — while its
+    // model wrote text, while it waited for its wake, or answered in another conversation — this
+    // Agent was never told. Reserved
+    // first, so no concurrent admission carries them too; delivered by the ledger write; released
+    // when the admission fails, for the next one to carry.
+    //
+    // What the last carrying admission took, and under which iid: delivered is not HEARD. If this
+    // actor ends the Turn before the Harness reads that iid's surface, the Harness finds the Turn
+    // over and settles it with no model asked (ADR-0026) — so `abandon` raises them again.
+    // Per conversation the Turn admitted on: the notices its admissions carried — `unheard` since
+    // the Harness last read its surface, `heard` before that — and whether an unheard one carried
+    // the Turn's task. Collected across the Turn, so a re-admission onto a lost conversation tells
+    // the Agent all of them again.
+    type Raised = { notice: Notice; source?: string };
+    // `fresh`: a fresh Turn's "this conversation is new", which rides an admission as `extra` and so
+    // is kept in no ledger — an unread one is carried again by the next re-admission.
+    const carriedBy = new Map<string, { heard: Raised[]; unheard: Raised[]; task: boolean; fresh: Notice[] }>();
+    // `notices`: "turn" takes every notice in scope; "same-turn" too, but the guard kills the Turn's own
+    // conversation was told (a re-admission after a cut continues the same Turn); "nudge" takes the
+    // guard kills this conversation was not told alone.
+    // `include`: sources restored for this admission, taken whatever the scope leaves out. `task`:
+    // this admission's prompt holds the Turn's task. `kept`: the admission is for a conversation
+    // that `holds` said the Harness keeps; a Harness that keeps none refuses it (`isNotKept`), and
+    // the refusal is thrown as any failed admission is.
+    const admitTurn = async (
+      turn: AgentRunInput,
+      opts: {
+        notices: "turn" | "same-turn" | "nudge";
+        extra?: Notice[];
+        include?: readonly string[];
+        task?: boolean;
+        kept?: boolean;
+      } = { notices: "turn", task: true },
+    ) => {
+      await hearKernelKill();
+      const { known, unsaid, said } = await hearPodKills();
+      // A read that could not tell leaves the same Turn no way to know which kills its own `bash`
+      // reported: it takes none, as a nudge takes none then, and they stay for the next Turn.
+      const sameTurn: NoticeScope = known
+        ? { ...noticeScope, except: said }
+        : {
+            ...noticeScope,
+            ...(noticeWorkspace === undefined ? {} : { exceptPrefix: guardSource(noticeWorkspace, "") }),
+          };
+      const scope: NoticeScope | undefined =
+        opts.notices === "turn"
+          ? noticeScope
+          : opts.notices === "same-turn"
+            ? sameTurn
+            : unsaid.length > 0
+              ? { workspace: noticeWorkspace, only: unsaid }
+              : undefined;
+      const none = { ids: [] as string[], notices: [] as Notice[], raised: [] as Raised[] };
+      const restored =
+        opts.include && opts.include.length > 0
+          ? (binding.takeNotices?.({ ...noticeScope, only: opts.include }) ?? none)
+          : none;
+      const main = (scope ? binding.takeNotices?.(scope) : undefined) ?? none;
+      const taken = {
+        ids: [...restored.ids, ...main.ids],
+        notices: [...restored.notices, ...main.notices],
+        raised: [
+          ...(restored.raised ?? restored.notices.map((notice) => ({ notice }))),
+          ...(main.raised ?? main.notices.map((notice) => ({ notice }))),
+        ],
+      };
+      // `extra`: a notice this admission carries straight from the actor, never kept — the answer a
+      // cut pick never got (ADR-0031), whose one path to the model is this admission. One "this
+      // conversation is new" is enough, whichever path brought it.
+      let fresh = false;
+      const notices = [...taken.notices, ...(opts.extra ?? [])].filter((n) => {
+        if (n.kind !== "conversation-new") return true;
+        if (fresh) return false;
+        fresh = true;
+        return true;
+      });
+      // `served` is per Instance ID, and a nudge or a wake reuses the Turn's: it must be read again
+      // before this admission counts as heard (`reraiseUnheard`). An admission that fails puts the
+      // mark back — what an earlier one carried was heard.
+      const heard = served.has(turn.instanceId);
+      served.delete(turn.instanceId);
+      let admission: AgentAdmission;
+      try {
+        admission = await client.admit(turn, {
+          definition,
+          signal: controller.signal,
+          ...(notices.length ? { notices } : {}),
+          ...(opts.kept ? { kept: true } : {}),
+        });
+      } catch (err) {
+        binding.releaseNotices?.(taken.ids);
+        if (heard) served.add(turn.instanceId);
+        throw err;
+      }
+      // The mark is taken once the Harness has ANSWERED: a restart before the answer took the
+      // admission with it, and the conversation's 404 says so; a restart after it is this Turn's.
+      // Unheard yet (the watch has not listed), the first count heard is the mark.
+      admitted = true;
+      restartMark = heardRestarts?.restartCount;
+      if (restartMark !== undefined) admission = { ...admission, harnessRestarts: restartMark };
+      // The Turn's task rides every ledgered admission: a restore drops `prompt`.
+      const task = input.prompt ?? input.attach?.task;
+      if (task !== undefined) admission = { ...admission, task };
+      // A Turn in a Workspace keeps its start and its kill mark across a restore.
+      if (noticeWorkspace !== undefined) {
+        admission = {
+          ...admission,
+          turnStarted: turnStarted.toISOString(),
+          ...(killMark === undefined ? {} : { killMark }),
+        };
+      }
+      ledger(admission, taken.ids);
+      const bucket = carriedBy.get(turn.instanceId) ?? { heard: [], unheard: [], task: false, fresh: [] };
+      if (heard) {
+        bucket.heard.push(...bucket.unheard);
+        bucket.unheard = [];
+        bucket.task = false;
+        bucket.fresh = [];
+      }
+      bucket.unheard.push(...taken.raised);
+      if (opts.task) bucket.task = true;
+      if (!input.continuation) bucket.fresh.push(...(opts.extra ?? []).filter((n) => n.kind === "conversation-new"));
+      carriedBy.set(turn.instanceId, bucket);
+      return admission;
+    };
+    // The notices unheard admissions carried, pending again for the next Turn in their scope —
+    // each WITH the source it was raised with, so a take by source finds it and no equal notice of
+    // another source swallows it. `lost`: the current conversation, which heard the rest, is gone,
+    // so they are unheard too. Answers the sources restored, which a re-admission of the same Turn
+    // takes whatever else it leaves out.
+    const reraiseUnheard = (lost = false): string[] => {
+      const restored: string[] = [];
+      for (const [iid, bucket] of carriedBy) {
+        const gone = lost && iid === currentIid;
+        const read = served.has(iid) && !gone;
+        const again = [...(gone ? bucket.heard : []), ...(read ? [] : bucket.unheard)];
+        if (gone) bucket.heard = [];
+        if (!read) bucket.unheard = [];
+        for (const { notice, source } of again) {
+          const to = notice.scope === "conversation" ? conversation : noticeWorkspace;
+          if (to === undefined) continue;
+          if (binding.restoreNotice) binding.restoreNotice(notice, to, source);
+          else binding.raiseNotice?.(notice, to);
+          if (source !== undefined) restored.push(source);
+        }
+      }
+      return restored;
+    };
 
     const abandon = () => {
       if (stopped) return;
       stopped = true;
+      // What ended the Turn, read while its registration is still there (ADR-0024).
+      const byPick = binding.turnEndedByPick?.(currentIid) === true;
       for (const dispose of disposers.splice(0)) dispose();
       // Stop consuming the stream. The remote end of the turn is the next paragraph.
       controller.abort();
@@ -531,17 +1122,227 @@ export function agentActorWith(
       // Pool cancelling a child. The one exception is the host stopping the run for its own
       // reasons, which ADR-0007's restore re-attaches to.
       if (binding.hostStopping) return;
+      reraiseUnheard();
       // Fire-and-forget, and unreportable BY CONSTRUCTION: this actor is stopped, so there is no
       // `agent.fault` left to raise. An orphan that survives a failed abort 404s on every tool
       // call and settles on its own.
       const iid = currentIid;
-      const aborting = client.abort(input.agentName, iid).catch(() => {});
+      // The cause names the Submission it is about: the last one ledgered for this Turn. The ledger
+      // is keyed by the invocation's iid, and stamps the live conversation (a reroll's).
+      const ledgered = binding.admissionOf?.(instanceId);
+      const submissionId = ledgered?.instanceId === iid ? ledgered.submissionId : undefined;
+      const cause = byPick ? { cause: "pick" as const, ...(submissionId ? { submissionId } : {}) } : {};
+      const aborting = client.abort(input.agentName, iid, cause).catch(() => {});
       pendingAborts.set(iid, aborting);
       void aborting.then(() => {
         if (pendingAborts.get(iid) === aborting) pendingAborts.delete(iid);
       });
     };
 
+    // The Allowed picks NOW (ADR-0029), read as the surface reads them: one list for the surface,
+    // the receipts, the nudge and the wake.
+    const allowedNow = (): string[] => allowedPicks({ defs, menu, invoker: self._parent, ...seat });
+    // Resolves with the Allowed picks the first time they are not empty — read a microtask after
+    // every snapshot of the invoking Machine, so a Gate's answer, an outside event, a settled child
+    // or a timer each count — or with `[]` once this actor stops. Never inside the subscriber: a
+    // snapshot between macrosteps (a state that sends to itself) is not Rest until the mailbox
+    // drains (rest.ts), and a wake with an empty list spends the nudge's budget for nothing. Its own
+    // disposer, so `abandon` ends the wait.
+    const picksOpen = (): Promise<string[]> =>
+      new Promise((resolve) => {
+        let done = false;
+        let sub: { unsubscribe(): void } | undefined;
+        const finish = (allowed: string[]): void => {
+          if (done) return;
+          done = true;
+          const at = disposers.indexOf(dispose);
+          if (at >= 0) disposers.splice(at, 1);
+          sub?.unsubscribe();
+          resolve(allowed);
+        };
+        const dispose = (): void => finish([]);
+        const check = (): void => {
+          if (stopped) return finish([]);
+          const allowed = allowedNow();
+          if (allowed.length > 0) finish(allowed);
+        };
+        disposers.push(dispose);
+        check();
+        if (done) return;
+        sub = self._parent?.subscribe({ next: () => queueMicrotask(check), error: dispose, complete: dispose });
+        if (sub === undefined) finish([]);
+      });
+
+    // Resolves once the Agent's state is back at Rest — its outstanding pick answered, or nothing
+    // running below it — or has been left, or with nothing once this actor stops. Read a microtask
+    // after each snapshot of the invoking Machine: the mailbox has drained (rest.ts).
+    const agentState = { invoker: self._parent, invokeId: self.id };
+    const untilRest = (): Promise<void> =>
+      new Promise((resolve) => {
+        let done = false;
+        let sub: { unsubscribe(): void } | undefined;
+        const finish = (): void => {
+          if (done) return;
+          done = true;
+          const at = disposers.indexOf(finish);
+          if (at >= 0) disposers.splice(at, 1);
+          sub?.unsubscribe();
+          resolve();
+        };
+        const check = (): void => {
+          if (stopped) return finish();
+          const held = binding.outstandingOf?.(currentIid);
+          if (held !== undefined && !held.fetched && !held.answered) return;
+          if (restOf(agentState) !== "busy") finish();
+        };
+        disposers.push(finish);
+        check();
+        if (done) return;
+        sub = self._parent?.subscribe({ next: () => queueMicrotask(check), error: finish, complete: finish });
+        if (sub === undefined) finish();
+      });
+
+    // The Harness keeps no such conversation (ADR-0062): it lost it while the Turn waited, and a
+    // `kept` admission found none. Nothing of the Turn is left there, so the Turn is admitted as a
+    // Turn on a new conversation: every notice in scope, `include` whatever the scope leaves out,
+    // and `prompt`, which holds the Turn's task. A continued Turn is told its conversation is new as the
+    // continue path tells it — the notice is kept for its conversation, which this admission takes.
+    // A fresh Turn's conversation is its own: the notice rides this admission alone, so no later
+    // continued Turn of another conversation is told its context is gone. `before` and `after`
+    // ride beside it, in that order.
+    const admitOntoLost = async (
+      prompt: string,
+      before: Notice[],
+      after: Notice[],
+      include: readonly string[],
+    ): Promise<AgentAdmission> => {
+      const extra = [...before];
+      const fresh: Notice = {
+        kind: "conversation-new",
+        scope: "conversation",
+        reason: "the Harness no longer holds it",
+      };
+      if (input.continuation) binding.raiseNotice?.(fresh, conversation);
+      else extra.push(fresh);
+      return await admitTurn(
+        { ...framed, attach: undefined, instanceId: currentIid, prompt },
+        { notices: "turn", extra: [...extra, ...after], include, task: true },
+      );
+    };
+
+    // A Harness restart cut this Turn (ADR-0031). It is NOT an `agent.fault` when the Agent's state is
+    // busy — something it started runs below it — or its pick's answer has not reached the model:
+    // faulting would route the Machine out of the state and stop the work the Turn did not want
+    // stopped. jr2 waits for Rest, then re-admits the Agent on the same conversation, which the
+    // rebuilt Harness holds, with the answer as a notice. Undefined: not this case, the caller faults.
+    let cuts = 0;
+    const readmitAfterCut = async (err: unknown): Promise<AgentAdmission | "stopped" | undefined> => {
+      if (stopped) return "stopped";
+      if (restarted === undefined && settledByRestart(err) === undefined) return undefined;
+      const unread = (): boolean => {
+        const held = binding.outstandingOf?.(currentIid);
+        return held !== undefined && !held.fetched;
+      };
+      if (restOf(agentState) !== "busy" && !unread()) return undefined;
+      await untilRest();
+      if (stopped) return "stopped";
+      const held = binding.outstandingOf?.(currentIid);
+      const notice: Notice[] =
+        held !== undefined && !held.fetched && held.answered && !held.turnComplete
+          ? [
+              {
+                kind: "pick-answer",
+                scope: "conversation",
+                pick: held.pick,
+                cut: true,
+                ...(held.answer !== undefined ? { answer: held.answer } : {}),
+              },
+            ]
+          : [];
+      // Kept until the re-admission is sure: a Turn that faults below still names the restart.
+      const cutBy = restarted;
+      // The restart that cut the Turn is the new mark at once: the watch may tell it again before
+      // the re-admission is answered, and it must not cut the re-admission too.
+      if (restarted !== undefined) restartMark = restarted.restartCount;
+      restarted = undefined;
+      controller = new AbortController();
+      // The rebuilt Harness may not read the conversation back: then this Turn lands on a new one,
+      // and is told (ADR-0062). Asked again while the new container may not listen yet, and taken
+      // as "held" only when the time is over. That "held" can be wrong — a Harness in
+      // CrashLoopBackOff answers nothing for longer — so the admission says it is for a kept
+      // conversation, and a Harness that keeps none refuses it: then the Turn takes the path of a
+      // lost conversation below.
+      const kept = await client.holds(input.agentName, currentIid, {
+        signal: AbortSignal.any([controller.signal, AbortSignal.timeout(holdsReadMs)]),
+      });
+      if (stopped) return "stopped";
+      // The task: a restore dropped `prompt`, and the ledgered admission kept it. A new
+      // conversation with no task to send cannot be asked to "continue your task": the Turn faults.
+      const task = input.prompt ?? input.attach?.task;
+      // Whether the cut admission, never read, carried the task: then the model never read it.
+      const taskUnheard = !served.has(currentIid) && carriedBy.get(currentIid)?.task === true;
+      // A fresh Turn's "this conversation is new" that an unread re-admission carried rides this
+      // one again: it is kept nowhere else. Read before the first admission below, which can fail.
+      const unreadFresh: Notice[] = served.has(currentIid) ? [] : [...(carriedBy.get(currentIid)?.fresh ?? [])];
+      // On a new conversation nothing of the Turn is left: the cut pick's answer rides after the task,
+      // and after the unread "this conversation is new" that the cut admission carried.
+      const readmitLost = (withTask: string, include: readonly string[]): Promise<AgentAdmission> =>
+        admitOntoLost(`${READMIT_PROMPT}\n\n${withTask}`, unreadFresh, notice, include);
+      // On a conversation the Harness still holds, it continues the same Turn. The task follows the
+      // re-admit text when a cut admission carried it and was never read.
+      const readmitKept = (include: readonly string[]): Promise<AgentAdmission> => {
+        const withTask = taskUnheard && task !== undefined;
+        return admitTurn(
+          {
+            ...framed,
+            attach: undefined,
+            instanceId: currentIid,
+            prompt: withTask ? `${READMIT_PROMPT}\n\n${task}` : READMIT_PROMPT,
+          },
+          { notices: "same-turn", extra: [...unreadFresh, ...notice], include, task: withTask, kept: true },
+        );
+      };
+      // What the cut admissions carried is pending again before this one takes, if the Harness never
+      // read their surface — or all of it, if the conversation that heard it is gone. Those sources
+      // ride this re-admission whatever its scope leaves out.
+      let admission: AgentAdmission;
+      if (!kept) {
+        // The fault names the restart that cut the Turn, and asks whether it was a memory kill.
+        if (task === undefined) {
+          restarted = cutBy;
+          return undefined;
+        }
+        admission = await readmitLost(task, reraiseUnheard(true));
+      } else {
+        const restored = reraiseUnheard(false);
+        try {
+          admission = await readmitKept(restored);
+        } catch (err) {
+          if (!isNotKept(err)) throw err;
+          // "Held" was the timeout's: the Harness keeps no such conversation, and it seated none. The
+          // failed admission put back what it took. Now the path of a lost conversation: what the
+          // conversation heard is unheard, and the Turn is admitted with its task — or faults when
+          // there is no task to send.
+          if (stopped) return "stopped";
+          if (task === undefined) {
+            restarted = cutBy;
+            return undefined;
+          }
+          admission = await readmitLost(task, [...restored, ...reraiseUnheard(true)]);
+        }
+      }
+      // Said once an admission worked: a refused one that then faults re-admitted nothing.
+      cuts++;
+      binding.telemetry?.({
+        kind: "retry",
+        child: self._parent?.id ?? self.id,
+        attempt: cuts,
+        reason: "re-admitted after a Harness restart",
+      });
+      binding.heldAnswerDelivered?.(currentIid);
+      return admission;
+    };
+
     // Down-channel: interrupts only (ADR-0002 split-channel model).
     receive((event) => {
       if (event.type === "CANCEL") abandon();
@@ -555,8 +1356,9 @@ export function agentActorWith(
     //   - INFRA faults: provider retries run inside the turn, Harness-side, and the wire
     //     client reconnects transparently — so a `settle` rejection means the Submission settled
     //     failed/aborted, or the conversation is lost (ADR-0027). Terminal, no jr2 re-run.
-    //   - NO-SIGNAL: the Submission settles COMPLETED but no menu tool was called. The Harness
-    //     calls that a normal turn, so jr2 owns a budgeted re-prompt on the SAME iid (the conversation
+    //   - NO-SIGNAL: the Submission settles COMPLETED with the Turn still open and Allowed picks
+    //     left (the ask-again rule, below). The Harness calls that a normal Submission, so jr2 owns
+    //     a budgeted re-prompt on the SAME iid (the conversation
     //     continues; each nudge is a fresh admission, ledgered like any other).
     //   - RUNAWAY: the Harness ended a turn that would not conclude and settled it failed with
     //     the typed "runaway" error (ADR-0035). The degenerate context is poisoned, so the
@@ -564,13 +1366,16 @@ export function agentActorWith(
     //     admitting the identical prompt — closed to continuations, which opted out of exactly that.
     // Any budget exhausting emits the ONE terminal `agent.fault { reason }`.
     void (async () => {
-      const fault = (reason: string) => {
+      const fault = (reason: string, opts: { conversationKept?: boolean } = {}) => {
         if (stopped) return;
         // Burn the conversation before the fault lands (ADR-0057): the state the fault routes to
         // may invoke this Agent again in the same macrostep, and its mapper must already read the
         // bumped epoch. Continuations only — a fresh invocation mints its own conversation, so
-        // there is nothing to burn.
-        if (input.continuation) binding.bumpEpoch?.(continuedIid(self._parent, binding.runId, input.agentName));
+        // there is nothing to burn. Not when a Harness restart cut the Turn: the rebuilt Harness
+        // holds the conversation (ADR-0031), so only the Turn was lost and the next `continue`
+        // lands on it; that Turn's `holds` check tells it if the rebuild could not read it (ADR-0062).
+        // The fault's reason is the next Turn's news: it is why that conversation starts empty.
+        if (input.continuation && !opts.conversationKept) binding.bumpEpoch?.(conversation, reason);
         sendBack({ type: "agent.fault", instanceId, reason } satisfies FaultTelemetry);
       };
       try {
@@ -581,8 +1386,33 @@ export function agentActorWith(
         await pendingAborts.get(instanceId);
         let admission = input.attach;
         if (!admission) {
-          admission = await client.admit(framed, { definition, signal: controller.signal });
-          ledger(admission);
+          // A continued conversation admitted before may be gone with no fault to say so: its
+          // Harness restarted between the Turns. Then this Turn lands on a new one, and is told
+          // (ADR-0062). A conversation never admitted has nothing to lose, so nothing is asked.
+          // "Held" can be a timeout's, so the admission says it is for a kept conversation, and a
+          // Harness that keeps none refuses it: then the Turn is told, and admitted again.
+          const told = () =>
+            binding.raiseNotice?.(
+              { kind: "conversation-new", scope: "conversation", reason: "the Harness no longer holds it" },
+              conversation,
+            );
+          const asked = input.continuation && binding.admissionOf?.(instanceId) !== undefined;
+          const kept =
+            asked &&
+            (await client.holds(input.agentName, instanceId, {
+              signal: AbortSignal.any([controller.signal, AbortSignal.timeout(holdsReadMs)]),
+            }));
+          if (asked && !kept) told();
+          if (kept) {
+            try {
+              admission = await admitTurn(framed, { notices: "turn", task: true, kept: true });
+            } catch (err) {
+              if (!isNotKept(err)) throw err;
+              if (stopped) return;
+              told();
+              admission = await admitTurn(framed);
+            }
+          } else admission = await admitTurn(framed);
           // The admission marker (ADR-0023): the Turn and its framing, once — a re-attach
           // continues a Turn already announced, and a nudge (below) is mechanism, not narrative
           // (its telemetry already rides the feed).
@@ -592,7 +1422,7 @@ export function agentActorWith(
         let rerolls = 0;
         for (;;) {
           try {
-            await client.settle(admission, { signal: controller.signal });
+            await client.settle(admission, { signal: controller.signal, onMemoryLimit });
           } catch (err) {
             // The reroll gate closes on `signaled` like the nudge gate below: a delivered pick
             // means the workflow already holds this turn's signal, so replaying the identical
@@ -600,6 +1430,14 @@ export function agentActorWith(
             // settlement). It also closes when restore dropped `prompt` (`attach` rides instead):
             // there is nothing identical to replay, and the thrown settlement still carries the
             // legible runaway reason.
+            // A Harness restart that cut the Turn while its state was busy (ADR-0031): no fault. The
+            // workflow did not stop, so neither does the Turn — it waits for Rest, then re-admits.
+            const readmitted = await readmitAfterCut(err);
+            if (readmitted === "stopped") return;
+            if (readmitted !== undefined) {
+              admission = readmitted;
+              continue;
+            }
             const reason = stopped || signaled ? undefined : runawayReason(err);
             if (reason === undefined || input.continuation || input.prompt === undefined || rerolls >= runawayBudget)
               throw err;
@@ -615,16 +1453,30 @@ export function agentActorWith(
             // `/mcp/<currentIid>`, so its address must be live before the Harness can run it.
             currentIid = `${instanceId}-r${rerolls}`;
             registerSurface(currentIid);
-            admission = await client.admit(
-              { ...framed, attach: undefined, instanceId: currentIid },
-              { definition, signal: controller.signal },
-            );
-            ledger(admission);
+            admission = await admitTurn({ ...framed, attach: undefined, instanceId: currentIid });
             continue;
           }
-          if (stopped || signaled || input.tools.length === 0) return; // the turn ended as intended
+          // THE ASK-AGAIN RULE (ADR-0016): while the Turn is open, a model that stopped is asked again
+          // once its Allowed picks are not empty — and never with an empty list. One rule, three
+          // moments:
+          //   - inside the Submission, the Harness's step boundary (`between-steps.ts`) restates the
+          //     Turn part when the list changed since the model last read it; that message keeps the
+          //     engine's loop going, and costs no Submission;
+          //   - after it settles with picks LEFT, the NUDGE, here;
+          //   - after it settles with NONE left (the Turn waits on a Gate, a child's invoke, a timer),
+          //     the WAKE: this actor watches the invoking Machine and asks the first time a pick
+          //     opens. A Turn that was never meant to pick waits until its state exits.
+          // The nudge and the wake are one Submission kind — the same text, the same conversation,
+          // the same budget — so a Machine that opens and closes picks under a stopped model cannot
+          // ask it without bound. A Turn whose pick left the Agent's state is over: the invoke was
+          // stopped, and nothing is asked.
+          if (stopped) return;
+          let allowed = allowedNow();
+          const woken = allowed.length === 0;
+          if (woken) allowed = await picksOpen();
+          if (stopped || allowed.length === 0) return;
           if (nudges >= nudgeBudget) {
-            fault(`agent completed its turn without calling any of: ${input.tools.join(", ")}`);
+            fault(`agent completed its turn without a pick that ends it; still allowed: ${allowed.join(", ")}`);
             return;
           }
           nudges++;
@@ -632,17 +1484,80 @@ export function agentActorWith(
             kind: "retry",
             child: self._parent?.id ?? self.id,
             attempt: nudges,
-            reason: "no-signal nudge",
+            reason: woken ? "picks allowed again" : "no-signal nudge",
           });
-          admission = await client.admit(
-            { ...framed, attach: undefined, instanceId: currentIid, prompt: nudgePrompt(input.tools) },
-            { definition, signal: controller.signal },
-          );
-          ledger(admission);
+          // The nudge and the wake ask the same conversation, so they say `kept`: the Harness can
+          // lose it while the Turn waits (the Instance Harness's restart is on no watch), and a
+          // Harness that keeps none then refuses, never seating an empty conversation whose model
+          // reads the nudge with no task. On the refusal the Turn takes the lost-conversation path,
+          // as the re-admission after a cut does: admitted as a Turn with its task, or a fault when
+          // there is no task to send. Its prompt is the task alone, as a continued Turn's is after
+          // the same refusal: nothing was cut, so the re-admit text would not be true. The ask was
+          // spent and said; the re-admission is said too.
+          try {
+            admission = await admitTurn(
+              {
+                ...framed,
+                attach: undefined,
+                instanceId: currentIid,
+                prompt: NUDGE_PROMPT,
+              },
+              { notices: "nudge", task: false, kept: true },
+            );
+          } catch (err) {
+            const task = input.prompt ?? input.attach?.task;
+            if (!isNotKept(err) || task === undefined) throw err;
+            if (stopped) return;
+            admission = await admitOntoLost(task, [], [], reraiseUnheard(true));
+            binding.telemetry?.({
+              kind: "retry",
+              child: self._parent?.id ?? self.id,
+              attempt: nudges,
+              reason: "re-admitted on a new conversation",
+            });
+          }
         }
       } catch (err) {
         if (stopped) return;
-        fault(err instanceof Error ? err.message : String(err));
+        // The Harness restarted under this Turn (ADR-0021): whatever the stream said as it was cut,
+        // the restart is why.
+        // A Settlement that names the restart is the same fault in the Harness's words (ADR-0021
+        // wording, ADR-0031's rebuilt stream), so it carries the same `Turn lost` prefix.
+        const restartSettled = restarted === undefined ? settledByRestart(err) : undefined;
+        const message =
+          restarted !== undefined
+            ? harnessRestartReason(restarted)
+            : restartSettled !== undefined
+              ? `Turn lost (${restartSettled})`
+              : (providerLimitReason(err) ?? errorMessage(err));
+        // A lost conversation may be a memory kill (ADR-0061): the kernel's group kill took the
+        // Harness with the Agent's processes. The operator publishes the container's last end on
+        // the Sandbox, so the fault is NAMED — the fixed prefix `memory limit` — instead of
+        // "Turn lost", and the Machine's policy can tell the two apart.
+        //
+        // The fault reaches the Machine (ADR-0016); the next Agent in this Workspace is told
+        // through the Briefing, never through the Frame (ADR-0057, ADR-0062) — a notice raised
+        // BEFORE the fault, because the state it routes to may admit in the same macrostep. Keyed
+        // by the kill itself, so every Turn the one kill ended raises one notice between them.
+        // A restart the Settlement reported before the watch did may still be a memory kill: the
+        // Sandbox is asked, as for a 404.
+        const lostHarness =
+          restarted !== undefined
+            ? restarted.lastTerminated?.reason === OOM_KILLED
+            : isLostConversation(err) || restartSettled !== undefined;
+        const kill = lostHarness && sandbox !== undefined ? await memoryFault(sandbox) : undefined;
+        if (stopped) return;
+        if (kill !== undefined && noticeWorkspace !== undefined) {
+          binding.raiseNotice?.(
+            memoryLimit({ limit: kill.limit, agent: input.agentName }),
+            noticeWorkspace,
+            kill.at === undefined ? undefined : kernelSource(noticeWorkspace, kill.at),
+          );
+        }
+        // A restart the Harness came back from keeps the conversation (ADR-0031); a 404 does not.
+        fault(kill !== undefined ? `${kill.reason}\n  ${message}` : message, {
+          conversationKept: restarted !== undefined || restartSettled !== undefined,
+        });
       }
     })();