@jr2/orchestrator 0.4.1 → 0.6.0

package/src/actor.ts

@@ -50,14 +50,16 @@ import {
   type ThinkingLevel,
   type WorkspaceAccess,
 } from "./agent.ts";
+import type { AnyFramePath } from "./worktree.ts";
 import { ambientHandlesFor, type AmbientHandles } from "./ambient.ts";
 import type { HarnessRestarts, MemoryKill } from "./workspace.ts";
 import { INSTANCE_HARNESS_SERVICE } from "./names.ts";
 import { SENDER_KEY } from "@jr2/agent-protocol";
-import { agentAddress, continuedIid, allowedPicks, resolveAccepts, runBindingOf } from "./registration.ts";
+import { agentAddress, agentSlot, continuedIid, allowedPicks, resolveAccepts, runBindingOf } from "./registration.ts";
 import type { NoticeScope } from "./notices.ts";
 import { restOf } from "./rest.ts";
-import { SUBMISSION_HARNESS_RESTARTED, SUBMISSION_RUNAWAY, type Notice } from "./wire.ts";
+import { SUBMISSION_HARNESS_RESTARTED, SUBMISSION_RUNAWAY, type Notice, type PodMemoryKill } from "./wire.ts";
+import type { AbortCause } from "./wire.ts";
 
 /**
  * One admitted Submission — the durable re-attach handle (ADR-0016). The wire fields are
@@ -80,6 +82,13 @@ export type AgentAdmission = {
    * aborts the LIVE conversation, never the dead original the ledger is keyed by.
    */
   instanceId?: string;
+  /**
+   * The Turn that ledgered this admission — the input's `turnId`, stamped by the ACTOR at ledger
+   * time. The ledger is keyed by `instanceId`, which a continued Turn shares with the Turn before
+   * it, so a restore compares this with the restored input's own: a mismatch is an admission of an
+   * EARLIER Turn, and the restored Turn was not admitted yet (ADR-0016).
+   */
+  turnId?: string;
   /**
    * The Harness container's restart count when this admission was answered (ADR-0021) — stamped by
    * the ACTOR, for a Turn in a Sandbox Workspace whose watch had spoken. A count above it means
@@ -87,6 +96,25 @@ export type AgentAdmission = {
    * mark.
    */
   harnessRestarts?: number;
+  /**
+   * When this admission's Turn started — stamped by the ACTOR on every admission of a Turn in a
+   * Workspace, so a restore reads back the real start, not the restore's: a kernel kill is held against it
+   * (ADR-0061), and a guard kill too when the Turn's first read of the pod's kills failed.
+   */
+  turnStarted?: string;
+  /**
+   * The newest guard kill in the pod's list when the Turn's first read of it was answered
+   * (ADR-0062), or {@link NO_KILLS} for an empty list — stamped by the ACTOR on every admission of
+   * a Turn in a Workspace. A nudge or a wake carries only kills after it, so it never tells the Agent of a kill
+   * from before its Turn. Absent when that first read failed.
+   */
+  killMark?: string;
+  /**
+   * The Turn's task, its Frame's prompt — stamped by the ACTOR on every admission of the Turn,
+   * because a restore drops `prompt` from the input: a re-admission onto a conversation the
+   * Harness lost must send the task again, and has no other copy of it (ADR-0062).
+   */
+  task?: string;
   /**
    * The Agent and the Harness base URL this admission was answered by — stamped by the ACTOR at
    * ledger time, like `instanceId`. Together with `instanceId` they name the conversation on its
@@ -116,15 +144,15 @@ export type AgentTurnInput = {
   /**
    * The other half of the FRAME (ADR-0057) — WHERE this Turn works: the absolute directory the
    * Harness roots the Working tools at. Per Turn by nature, which is why no definition names one:
-   * a Worktree path (`/work/<slot>/<branch>`) exists only once a run has a branch.
+   * a Worktree path (`/work/<slot>/<name>`) exists only once a Machine has cut it (ADR-0075).
    *
-   * Absent, the actor resolves it before admission: a `workspace: "none"` Agent frames no
-   * directory (it has no Working tools to root — ADR-0028), a Workspace with ONE Repo Slot frames
-   * that slot's Worktree, a Workspace with more REFUSES the Turn (the kit gives no slot a meaning
-   * — ADR-0051 — so the state must say which), and a run with no Workspace at all frames nothing
-   * and the Harness keeps `/work`. A relative path is refused at admission, by the Harness.
+   * Required under Repo Slots: a Turn with no `cwd` there is REFUSED before admission, and a Turn
+   * that wants `/work` states it. A `workspace: "none"` Agent frames no directory (it has no Working
+   * tools to root — ADR-0028), and a Workspace with no Repo Slot, or a run with no Workspace at all,
+   * frames nothing and the Harness keeps `/work`. A relative path is refused at admission, by the
+   * Harness.
    */
-  cwd?: string;
+  cwd?: AnyFramePath;
   /**
    * This turn's DIALS (ADR-0018) — how hard to run, layered over the definition's own
    * values. One definition value may be carried by several Machines, so the same persona
@@ -137,6 +165,8 @@ export type AgentTurnInput = {
    * ADR-0028's containment claim, which per-invocation escalation would void.
    */
   model?: string;
+  /** Omitted → the definition's, else `off`. A model with no `off` runs at the level its provider
+   * chooses; the printed conversation names it. */
   thinkingLevel?: ThinkingLevel;
   /**
    * Continue this Agent's ONE conversation in this Machine instance (ADR-0016, ADR-0057) — the
@@ -182,6 +212,14 @@ export type AgentRunInput = {
    * is what the Harness route, the minted iid, the markers and the telemetry all name. */
   agentName: string;
   instanceId: string;
+  /**
+   * This Turn's Turn ID — minted by the input mapper, one per invocation, and persisted with the
+   * input (ADR-0016). Two Turns that continue one conversation share `instanceId`, the ledger's
+   * key, and not this: the actor stamps it on every admission it ledgers, and a restore
+   * re-attaches only an admission that this Turn ledgered. Absent (a plain `setup()` machine that
+   * passes finalized input), the key alone decides, as before.
+   */
+  turnId?: string;
   /**
    * The Harness base URL, EXPLICIT (ADR-0016): only for a workspace-less run (the mechanics
    * tier's stub Harness, a dev endpoint — just a URL, ADR-0011). Inside a `workspace()` leave it
@@ -235,13 +273,26 @@ export type AgentRunInput = {
   menu?: readonly string[];
 };
 
-/** Telemetry sent up when the run is out of options: the Submission settled failed/aborted
- * (infra fault after the turn's own provider retries — ADR-0027), the no-signal nudge budget ran
- * dry, or the runaway reroll budget did (ADR-0035). The ONE terminal event (ADR-0016) — where it
- * routes is workflow policy. */
+// Sent when the run is out of options: the Submission settled failed/aborted (infra fault after
+// the turn's own provider retries — ADR-0027), the no-signal nudge budget ran dry, or the runaway
+// reroll budget did (ADR-0035). The ONE terminal event (ADR-0016) — where it routes is workflow
+// policy.
+/** jr2 sends `agent.fault` to the Machine when an Agent's Turn cannot go on: the Harness failed
+ * the Turn, or the Agent ended its Turns with no pick after every nudge. The Machine decides what
+ * to do next. Route it in the state that invokes the Agent, or in a state above it, with
+ * `on: { "agent.fault": … }`; one route on the root is a route for each state. `jr2 check` and
+ * `jr2 up` refuse a state that invokes an Agent, or an Open body that can run one, with no route for
+ * it. When the event comes and no transition takes it (the route's guard is false), the run ends
+ * `error`, with the event, the state and the reason in its fault. In a Chart the route is optional:
+ * when no transition of the Chart takes the event, the Open body sends it, unchanged, to the Machine
+ * that invoked the body, whose route takes it. */
 export type FaultTelemetry = {
   type: "agent.fault";
+  /** The Instance ID of the Agent's conversation that failed: the same id on each Turn that
+   * continues it. */
   instanceId: string;
+  /** Why the Turn failed, as text for a person or a log: the Harness's error, or that the Agent
+   * ended its Turns without a pick after every nudge. Route on the event, not on this text. */
   reason: string;
 };
 
@@ -267,24 +318,39 @@ export interface AgentRunPort {
   admit(input: AgentRunInput, opts: AgentAdmitOptions): Promise<AgentAdmission>;
   /**
    * Follow an admitted submission until it settles. Resolving means the submission completed;
-   * rejecting means it settled failed/aborted (or the conversation is gone).
+   * rejecting means it settled failed/ended/aborted (or the conversation is gone).
    */
   settle(admission: AgentAdmission, opts?: AgentSettleOptions): Promise<void>;
   /**
    * Does the Harness still hold this conversation (ADR-0062)? Asked before a continued Turn whose
    * conversation was admitted before: a Harness that restarted between the Turns lost it with no
    * fault to say so, and the Turn is told its conversation is new. Answers `true` whenever it
-   * cannot tell — unknown is never loss.
+   * cannot tell — unknown is never loss. A wrong `true` is caught at the admission that follows:
+   * it says `kept`, and a Harness that keeps no such conversation refuses it.
    */
   holds(agentName: string, instanceId: string, opts?: { signal?: AbortSignal }): Promise<boolean>;
+  /**
+   * The pod's guard kills (ADR-0061, ADR-0062), every one with `told`: the conversations whose
+   * running `bash` call answered its verdict. A stream is read only while a Submission's wait
+   * runs, and a kill while none runs, or after the wait stopped, reaches no reader there. Asked before a Turn's admission into a
+   * Workspace. A read changes nothing on the Harness; the notice ledger keeps each kill's id.
+   * Answers `undefined` whenever it cannot tell — not `[]`, which says the list is empty — and the
+   * kill stays on the Harness for the next read.
+   */
+  memoryKills(opts?: { signal?: AbortSignal }): Promise<ListedKill[] | undefined>;
   /**
    * End the instance's in-flight (and queued) work — the turn is over (ADR-0024). Resolving means
    * the intent is RECORDED, not that the submission has settled; jr2 never observes that outcome,
    * because the actor is already stopped by the time this is called. The actor passes no `signal`
    * for exactly that reason — its own controller is already aborted — but the option is here for
-   * parity with the other two.
+   * parity with the other two. `cause: "pick"` says the Turn's own pick ended it, so the Harness
+   * settles the Submission `ended`; with no cause it settles `aborted`.
    */
-  abort(agentName: string, instanceId: string, opts?: { signal?: AbortSignal }): Promise<void>;
+  abort(
+    agentName: string,
+    instanceId: string,
+    opts?: { signal?: AbortSignal; cause?: AbortCause; submissionId?: string },
+  ): Promise<void>;
 }
 
 /** What every admission carries beside the input: the Agent definition this Turn runs (ADR-0049),
@@ -293,22 +359,66 @@ export interface AgentRunPort {
  * Machine edit that changed it. */
 export type AgentAdmitOptions = {
   definition: AgentDefinition;
+  /** This Agent's slot (ADR-0076): the actor path of its Machine and its agent name — the
+   * registration's. The Harness keeps it with the conversation and states it on each control
+   * request; it never derives it from an Instance ID, whose actor ids may hold a `/`. */
+  slot: string;
   signal?: AbortSignal;
   /** The pending notices in this admission's scope (ADR-0062), for the Briefing's Turn part. Not
    * on the persisted input either: they are the Orchestrator's, and delivered once. */
   notices?: Notice[];
+  /** The admission is for a conversation that `holds` said the Harness keeps (ADR-0062): the
+   * re-admission after a cut, and a continued Turn. That "kept" can be a timeout's, so a Harness
+   * that keeps none refuses it and seats none; `admit` then rejects with an error whose `notKept`
+   * is true (the wire client's `ConversationNotKept`). */
+  kept?: boolean;
 };
 
-/** A memory kill by the Harness's own guard (ADR-0061, layer 4), as the updates stream reports it:
- * the guard's `peak` and `limit`, and `source` — where on which conversation's stream the event
- * sits, so a replayed read of it is the same kill. */
-export type GuardKill = { peak: string; limit: string; source: string };
+/** A memory kill by the Harness's own guard (ADR-0061, layer 4), as the Orchestrator reads it on
+ * an updates stream — the twin of {@link ListedKill}, which it reads in the pod's list:
+ * the guard's `peak` and `limit` — absent when what the stream said was not a size — and the
+ * kill's `id`, the same on every stream that carries it and in the pod's list
+ * (`AgentRunPort.memoryKills`), so every witness of one kill is one notice. `legacy`: an older
+ * Harness's event, which has no id; `id` is then the source the Orchestrator raised such an event
+ * with before, its place on the stream, so a replayed read is still the same kill. */
+export type StreamedKill = { id: string; legacy?: true; peak?: string; limit?: string };
+
+/** A kill read from the pod's list, as the port answers it: the wire's, but `peak` and `limit` are
+ * absent when the list's were not sizes — the kill is kept, and worded with no sizes (ADR-0062). */
+export type ListedKill = Omit<PodMemoryKill, "peak" | "limit"> & { peak?: string; limit?: string };
+
+/** The source a guard kill's notice is raised with: the Workspace and the kill's id. Both paths use
+ * it — the stream and the pod's list — so the ledger's `seen` makes them one notice. */
+const guardSource = (sandbox: string, id: string): string => `${sandbox}@guard:${id}`;
+
+/** The source a kernel kill's notice is raised with (ADR-0061, layer 5): the Workspace and when the
+ * Harness container ended, which names that one end. Both paths use it — the fault of a Turn the
+ * kill ended, and the read before an admission — so the ledger's `seen` makes them one notice. */
+const kernelSource = (sandbox: string, at: string): string => `${sandbox}@${at}`;
+
+/** How long the read of the pod's kills may take before it counts as none. */
+const MEMORY_KILLS_READ_MS = 5_000;
+
+/** How long "does the Harness still hold this conversation?" is asked again before the answer is
+ * taken as "held" — unknown is never loss, but a container that is starting is not unknown yet. */
+const HOLDS_READ_MS = 30_000;
+
+/** A `killMark` for a list that was empty: every kill read after it is the Turn's. Kill ids start
+ * `k-`, so it is never one. */
+export const NO_KILLS = "none";
+
+/** How far the pod's clock may run behind this one when a kill's `at` is held against a Turn's
+ * start — only when the Turn has no `killMark`: a kill stamped up to this much before the start
+ * still counts as in the Turn, so a slow pod clock does not hide a kill of this Turn. The two
+ * clocks are a node's and the Orchestrator's, both kept by the cluster's time service; one second
+ * is far more than they drift, and far less than a Turn. */
+const KILL_CLOCK_SKEW_MS = 1_000;
 
 /** What following a settlement may be told beside the settlement itself. */
 export type AgentSettleOptions = {
   signal?: AbortSignal;
   /** The Harness's guard killed the Agent's processes during this Submission (ADR-0061). */
-  onMemoryLimit?: (kill: GuardKill) => void;
+  onMemoryLimit?: (kill: StreamedKill) => void;
 };
 
 /** Build a port for one invocation from its serializable input (ADR-0011 static-import doctrine),
@@ -335,6 +445,17 @@ export type AgentRunOptions = {
    * pathological, which belongs with the workflow's fault routing.
    */
   runawayBudget?: number;
+  /**
+   * How long the read of the pod's guard kills (ADR-0062) may take before it counts as none and
+   * the Turn is admitted without it. Default 5000 ms; a seam for tests, never an author dial.
+   */
+  memoryKillsReadMs?: number;
+  /**
+   * How long the actor asks whether a restarted Harness still holds a conversation before it
+   * takes "held" for an answer: the new container may not listen yet (ADR-0062). Default 30 s; a
+   * seam for tests, never an author dial.
+   */
+  holdsReadMs?: number;
 };
 
 /**
@@ -403,6 +524,12 @@ function isLostConversation(err: unknown): boolean {
   return typeof err === "object" && err !== null && (err as { lost?: unknown }).lost === true;
 }
 
+/** An admission for a kept conversation that the Harness refused: it keeps none (ADR-0062). Read
+ * structurally, as {@link isLostConversation} is: the wire client's `ConversationNotKept`. */
+function isNotKept(err: unknown): boolean {
+  return typeof err === "object" && err !== null && (err as { notKept?: unknown }).notKept === true;
+}
+
 /**
  * The nudge (ADR-0006, absorbed here by ADR-0016). It names no picks: the Harness writes the Turn
  * part after it, stating the Allowed picks in the model's own tool names and narrowed by the guards
@@ -433,20 +560,15 @@ const READMIT_PROMPT =
  * an ABSENT one, and a directory a state named is never second-guessed — a Menu-only Agent handed
  * one simply has no Working tools to root there (ADR-0028/0031).
  *
- * Absent, a Menu-only Agent frames no directory; a Workspace with ONE Repo Slot frames that
- * slot's Worktree, which privileges nothing because there is nothing to choose between (ADR-0051);
- * a Workspace with more REFUSES the Turn, naming the slots in declaration order and the line that
- * ends it, because the kit gives no slot a meaning and a wrong guess is the silent failure
- * ADR-0057 was written for; and a run outside any Workspace frames nothing, so the Harness keeps
- * `/work`.
+ * Absent, a Menu-only Agent frames no directory, and a Workspace with no Repo Slot, or a run outside
+ * any Workspace, frames nothing, so the Harness keeps `/work`, the folder a slotless Workspace's
+ * steps share. Under Repo Slots the Workspace only clones, so no Worktree exists for a default to
+ * name, and the kit gives no slot a meaning: an absent `cwd` is REFUSED, because a wrong guess is
+ * the silent failure ADR-0057 was written for (ADR-0075).
  *
- * Resolution counts SLOTS, and a slot's Worktree is the writable branch checkout. The detached
- * review Worktree (`AmbientHandles.review`, ADR-0028's reviewer seat) is never resolved to: it is
- * per review round, so only the reviewing state knows which one, and it frames it (ADR-0028 hands
- * the reviewer its path as "cwd and prompt"). A `workspace: "read"` Agent that frames nothing
- * under a one-slot Workspace therefore works in the branch checkout with `write`/`edit` withheld
- * and `bash` kept — the tool layer's hint, not containment (ADR-0028): containment is the
- * detached review Worktree, and only a reviewing state that requested one can frame it.
+ * `workspace: "read"` withholds `write`/`edit` and keeps `bash`: the tool layer's hint, not
+ * containment (ADR-0028). The containment is a detached Worktree that the state cuts and names as
+ * its `cwd`.
  *
  * The refusal throws at invoke, like the Open-model fence: loudly, at the first Turn, before a
  * surface is registered or a pod is spent.
@@ -461,12 +583,11 @@ function frameCwd(
   if (workspace === "none") return undefined;
   const slots = Object.keys(ambient?.repos ?? {});
   if (slots.length === 0) return undefined;
-  if (slots.length === 1) return ambient!.repos[slots[0]!];
+  // A default here is ADR-0057's incident: an Agent's search hits `default/`, and a relative write
+  // lands outside each Worktree. An author who wants `/work` states it.
   throw new Error(
-    `turn ${instanceId}: agent "${input.agentName}" works under a Workspace carrying more than one ` +
-      `Repo Slot (${slots.join(", ")}) and its Turn framed no \`cwd\` — say which Worktree it works ` +
-      `in (\`cwd: context.workspace.repos.<slot>\`, one of those), because the kit gives no slot a ` +
-      `meaning (ADR-0051) and a Turn's Frame is where it works (ADR-0057)`,
+    `turn ${instanceId}: agent "${input.agentName}" works under a Workspace with Repo Slots (${slots.join(", ")}) ` +
+      'and its Turn framed no `cwd`: say where it works, a Worktree, or `cwd: "/work"` above them (ADR-0057)',
   );
 }
 
@@ -477,7 +598,10 @@ function frameCwd(
  *
  * The brand is a RUNTIME property, read back through `isAgent`, and deliberately NOT part of this
  * type: the unit-test seam is `provide({ actors: { coder: fake } })` (ADR-0049), and a required
- * `definition` here would make every fake carry a definition it never uses. */
+ * `definition` here would make every fake carry a definition it never uses.
+ *
+ * @internal
+ */
 export type AgentLogic = CallbackActorLogic<
   AgentRunReceiveEvent,
   AgentTurnInput | (AgentTurnInput & AgentTurnPlacement) | AgentRunInput
@@ -506,6 +630,8 @@ export function agentActorWith(
 ): AgentLogic {
   const nudgeBudget = options.nudgeBudget ?? 2;
   const runawayBudget = options.runawayBudget ?? 1;
+  const memoryKillsReadMs = options.memoryKillsReadMs ?? MEMORY_KILLS_READ_MS;
+  const holdsReadMs = options.holdsReadMs ?? HOLDS_READ_MS;
   // Typed as the union so BOTH shapes typecheck on an invoke: jr2Setup machines write
   // AgentTurnInput (and the config wrapper finalizes it before the actor ever runs); plain
   // setup() machines must pass the finalized shape themselves — checked loudly below.
@@ -574,7 +700,7 @@ export function agentActorWith(
 
     // The Frame's other half (ADR-0057): WHERE this Turn works. Resolved HERE, before any surface
     // is registered and before a pod is spent, because the answer is a fact about the run — a
-    // Worktree path exists only once a run has a branch, so no definition could have named it.
+    // Worktree exists only once a run has cut it, so no definition could have named it.
     const cwd = frameCwd(instanceId, input, workspace, ambient);
     const framed: AgentRunInput = cwd === undefined ? input : { ...input, cwd };
 
@@ -605,8 +731,15 @@ export function agentActorWith(
     // This Agent's continued conversation in this Machine (ADR-0057) — the base id the epoch ledger
     // burns. This Turn is PART of it only when it continues it: a fresh Turn is new by definition.
     const conversation = continuedIid(self._parent, binding.runId, input.agentName);
+    // This Agent's slot (ADR-0076): the same identity without the run id. The Harness states it on
+    // every control request, and the Orchestrator speaks here only for it.
+    const slot = agentSlot(self._parent, input.agentName);
     // The iids whose surface the Harness has read (see `carried` below).
     const served = new Set<string>();
+    // Per iid, the notices a step boundary's surface read reserved and the Harness has not yet
+    // acknowledged (ADR-0062): by the id the read named, every id it stands for — equal notices
+    // are said once — and what each was raised as, for `reraiseUnheard`.
+    const boundary = new Map<string, Map<string, Array<{ id: string; raised: { notice: Notice; source?: string } }>>>();
     const registerSurface = (iid: string) =>
       disposers.push(
         binding.table.register({
@@ -617,6 +750,9 @@ export function agentActorWith(
           defs,
           menu,
           sandbox,
+          slot,
+          boundaryNotices: () => readBoundary(iid),
+          noticesHeard: (ids) => boundaryHeard(iid, ids),
           deliver: (event) => {
             signaled = true;
             // The settlement-pick marker (ADR-0023), BEFORE the delivery moves the Machine: the pick
@@ -654,7 +790,8 @@ export function agentActorWith(
     // When this Turn started: a memory kill that ended the Harness before it is not this Turn's
     // (ADR-0061). Undefined from a backend that cannot see the container — and never throws:
     // naming the fault is a courtesy, the fault itself lands either way.
-    const turnStarted = new Date();
+    // Read back on a restore: the start is the Turn's, not this process's.
+    const turnStarted = input.attach?.turnStarted ? new Date(input.attach.turnStarted) : new Date();
     const memoryFault = (name: string): Promise<MemoryKill | undefined> =>
       binding.sandbox?.memoryFault(name, turnStarted).catch(() => undefined) ?? Promise.resolve(undefined);
     // Replaced after a Harness restart that cut the Turn while its state was busy: the cut aborted it.
@@ -696,11 +833,22 @@ export function agentActorWith(
     // LIVE conversation stamped on the record, so a restore settle-follows the live submission
     // AND re-addresses it (see `currentIid` above). The notices the admission carried are
     // delivered by this same write (ADR-0062).
-    const ledger = (admission: AgentAdmission, delivered: readonly string[]) =>
+    // The conversation is a member of its Workspace's audiences from this save on (ADR-0062).
+    const ledger = (admission: AgentAdmission, delivered: readonly string[], taker: string) =>
       binding.recordAdmission?.(
         instanceId,
-        { ...admission, instanceId: currentIid, agent: input.agentName, endpoint },
+        {
+          ...admission,
+          instanceId: currentIid,
+          agent: input.agentName,
+          endpoint,
+          ...(input.turnId === undefined ? {} : { turnId: input.turnId }),
+        },
         delivered,
+        taker,
+        noticeWorkspace === undefined
+          ? undefined
+          : { workspace: noticeWorkspace, slot, continued: Boolean(input.continuation) && taker === conversationIid() },
       );
 
     // Where this Turn hears notices (ADR-0062). Its continued conversation's — the base id the
@@ -711,46 +859,313 @@ export function agentActorWith(
     const noticeScope: NoticeScope = {
       ...(input.continuation ? { conversation } : {}),
       ...(noticeWorkspace !== undefined ? { workspace: noticeWorkspace } : {}),
+      slot,
     };
-    const memoryLimit = (limit: string, peak?: string): Notice => ({
+    // The Instance ID of the continued conversation this Turn rides — its epoch's spelling, which
+    // the minted `instanceId` is. A fresh Turn has none.
+    const conversationIid = (): string | undefined => (input.continuation ? instanceId : undefined);
+    // No `agent`: the notice names no Turn — what the pod's list says (below).
+    // No `limit`: the sizes read were not sizes, and the notice says none.
+    const memoryLimit = ({ limit, peak, agent }: { limit?: string; peak?: string; agent?: string }): Notice => ({
       kind: "memory-limit",
       scope: "workspace",
-      agent: input.agentName,
-      ...(peak === undefined ? {} : { peak }),
-      limit,
+      ...(agent === undefined ? {} : { agent }),
+      ...(limit === undefined ? {} : { limit, ...(peak === undefined ? {} : { peak }) }),
     });
-    // The Harness's guard killed this Workspace's processes during the Turn (ADR-0061, layer 4):
-    // the Agent heard it in its `bash` answer; the next Turn in the Workspace hears it here.
-    const onMemoryLimit = (kill: GuardKill): void => {
+    // The Harness's guard killed this Workspace's processes while this Turn's Submission ran
+    // (ADR-0061, layer 4), read on its stream while the wait is live — so the notice can name this
+    // Turn's Agent. A stopped actor's last poll names nothing: the state that asked for the Turn has
+    // exited, and the pod's list carries the kill. Keyed by the kill's id, so a second running
+    // conversation's stream, or the pod's list, adds nothing.
+    // The kill cut this Turn (D4 rule 2): its Agent's next Turn retries the broken work, and hears it.
+    const onMemoryLimit = (kill: StreamedKill): void => {
+      if (stopped || noticeWorkspace === undefined) return;
+      binding.raiseNotice?.(
+        memoryLimit({ limit: kill.limit, peak: kill.peak, agent: input.agentName }),
+        noticeWorkspace,
+        kill.legacy ? kill.id : guardSource(noticeWorkspace, kill.id),
+        [],
+        { retry: { slot, cut: currentIid }, at: new Date().toISOString() },
+      );
+    };
+    // …but a stream is not every kill's path. A kill while no Submission ran — a process an earlier
+    // Turn left running, killed while the workflow waited at a Gate — is on no stream, and a kill
+    // after a wait stopped (the Agent's state exited, its abort not yet landed) is on a stream that
+    // no one reads. The Harness keeps every kill, so the pod's list is read before notices are
+    // taken, and this admission carries what it finds. Keyed as on the stream: the ledger's `seen`,
+    // persisted with the run, makes a kill read on both paths, or read again after a restart of
+    // either side, one notice. The notice names no Turn: the list cannot say whose Turn a kill
+    // ended. One read raises at most one notice, the newest kill's; the older kills in it are only
+    // marked seen, so they never give a notice. A read that fails or times out is none: the list
+    // keeps the kill, and the next admission reads again.
+    //
+    // The Turn's first read sets its `killMark`, the newest kill it saw, ledgered with every
+    // admission of the Turn. Answers the sources a nudge or a wake of THIS conversation may carry:
+    // the kills after that mark — none from before the Turn, which would tell the Agent that
+    // processes it started in this Turn died — and after the newest kill its own `bash` call
+    // answered, whose answer said all its processes died. Those stay pending for the next Turn.
+    // Only when the first read failed is the Turn's start time the mark, held against `at`.
+    // A kernel kill (ADR-0061, layer 5) ends the Harness container, so no list keeps it and no
+    // stream carries it. A Turn it ended faults on it, and the fault raises its notice (below). A
+    // kill while no Turn ran faults nothing: the restarted Harness rebuilds its conversations. But
+    // the operator publishes the container's last end on the Sandbox, and the watch keeps it until
+    // the next end. So before each admission into the Workspace, a last end `OOMKilled` raises the
+    // notice, keyed by that end as the fault keys it: one notice for one kill, whichever path saw
+    // it first, and none again after a restart of either side. It names no Turn: the end cannot say
+    // whose Turn it was. A watch that has not listed yet says nothing; the next admission asks again.
+    // Not after a restart this Turn's watch saw: the Turn faults on it, or is re-admitted, and the
+    // fault's notice names this Turn's Agent — a raise here would take its source first.
+    const hearKernelKill = async (): Promise<void> => {
+      if (restarted !== undefined) return;
+      const last = heardRestarts?.lastTerminated;
+      if (noticeWorkspace === undefined || last?.reason !== OOM_KILLED || last.finishedAt === undefined) return;
+      const kill = await binding.sandbox
+        ?.memoryFault(noticeWorkspace, new Date(last.finishedAt))
+        .catch(() => undefined);
+      if (kill?.at === undefined) return;
+      binding.raiseNotice?.(
+        memoryLimit({ limit: kill.limit }),
+        noticeWorkspace,
+        kernelSource(noticeWorkspace, kill.at),
+        [],
+        { at: kill.at },
+      );
+    };
+    let killMark = input.attach?.killMark;
+    let firstRead = input.attach === undefined;
+    // `known: false`: the read could not tell, so which kills this conversation was told is not
+    // known either — an admission of the same Turn then takes no guard kill at all.
+    const hearPodKills = async (): Promise<{ known: boolean; unsaid: string[]; said: string[] }> => {
+      const none = { known: true, unsaid: [], said: [] };
+      if (noticeWorkspace === undefined) return none;
+      const first = firstRead;
+      firstRead = false;
+      let kills: ListedKill[] | undefined;
+      try {
+        kills = await client.memoryKills({
+          signal: AbortSignal.any([controller.signal, AbortSignal.timeout(memoryKillsReadMs)]),
+        });
+      } catch (err) {
+        // Stopped while it read: nothing more is admitted, and nothing is taken.
+        if (controller.signal.aborted) throw err;
+        return { ...none, known: false };
+      }
+      // Could not tell: no mark — an empty list is not what was seen — so the clock is the mark.
+      if (kills === undefined) return { ...none, known: false };
+      if (first) killMark = kills.at(-1)?.id ?? NO_KILLS;
+      const newest = kills.at(-1);
+      if (newest === undefined) return none;
+      binding.raiseNotice?.(
+        memoryLimit({ limit: newest.limit, peak: newest.peak }),
+        noticeWorkspace,
+        guardSource(noticeWorkspace, newest.id),
+        kills.slice(0, -1).map((kill) => guardSource(noticeWorkspace, kill.id)),
+        { at: newest.at, told: newest.told.map((t) => t.instanceId) },
+      );
+      applyTold(kills);
+      const toldHere = (kill: ListedKill): boolean =>
+        kill.told.some((t) => t.agent === input.agentName && t.instanceId === currentIid);
+      // The first kill after the Turn's mark. A mark no longer in the bounded list is older than
+      // every kill in it.
+      let from = 0;
+      kills.forEach((kill, i) => {
+        if (kill.id === killMark || toldHere(kill)) from = i + 1;
+      });
+      const inThisTurn = (kill: ListedKill): boolean =>
+        killMark !== undefined || Date.parse(kill.at) >= turnStarted.getTime() - KILL_CLOCK_SKEW_MS;
+      const unsaid = kills.slice(from).filter(inThisTurn);
+      return {
+        known: true,
+        unsaid: unsaid.map((kill) => guardSource(noticeWorkspace, kill.id)),
+        said: kills.filter((kill) => !unsaid.includes(kill)).map((kill) => guardSource(noticeWorkspace, kill.id)),
+      };
+    };
+
+    // The conversations each listed kill's `bash` answer told leave its audience (D4 rule 3) — a
+    // kill raised off a stream before its answer returned is found here too.
+    const applyTold = (kills: readonly ListedKill[]): void => {
       if (noticeWorkspace === undefined) return;
-      binding.raiseNotice?.(memoryLimit(kill.limit, kill.peak), noticeWorkspace, kill.source);
+      const told = kills
+        .filter((kill) => kill.told.length > 0)
+        .map((kill) => ({ source: guardSource(noticeWorkspace, kill.id), takers: kill.told.map((t) => t.instanceId) }));
+      if (told.length > 0) binding.noticesTold?.(told);
+    };
+    // The step boundary's read (ADR-0062): this conversation's pending notices in their audience,
+    // reserved for this Turn until the Harness acknowledges the append. A guard kill's audience
+    // leaves out the conversations its `bash` answer told, which only the pod's list says — so when
+    // one is among them, the list is read first, and a read that could not tell takes no guard kill.
+    const readBoundary = async (iid: string): Promise<Array<{ id: string; notice: Notice }>> => {
+      if (stopped || iid !== currentIid || binding.takeNotices === undefined) return [];
+      const scope: NoticeScope = { ...noticeScope, taker: iid };
+      if (noticeWorkspace !== undefined) {
+        const guard = guardSource(noticeWorkspace, "");
+        if ((binding.peekNotices?.(scope) ?? []).some((p) => p.source?.startsWith(guard))) {
+          let kills: ListedKill[] | undefined;
+          try {
+            kills = await client.memoryKills({
+              signal: AbortSignal.any([controller.signal, AbortSignal.timeout(memoryKillsReadMs)]),
+            });
+          } catch {
+            kills = undefined;
+          }
+          if (kills === undefined) scope.exceptPrefix = guard;
+          else applyTold(kills);
+        }
+      }
+      if (stopped || iid !== currentIid) return [];
+      const taken = binding.takeNotices(scope);
+      const held = boundary.get(iid) ?? new Map();
+      const said = new Map<string, string>();
+      const out: Array<{ id: string; notice: Notice }> = [];
+      taken.ids.forEach((id, i) => {
+        const raised = taken.raised?.[i] ?? { notice: taken.notices[i]! };
+        const key = JSON.stringify(raised.notice);
+        const first = said.get(key);
+        if (first === undefined) {
+          said.set(key, id);
+          held.set(id, [{ id, raised }]);
+          out.push({ id, notice: raised.notice });
+        } else held.get(first)!.push({ id, raised });
+      });
+      if (held.size > 0) boundary.set(iid, held);
+      return out;
+    };
+    // A step boundary whose notices the Harness did not append — a stopped model with no Allowed
+    // picks, or a Turn ending as it read (`between-steps.ts`) — holds them until the next admission
+    // of the conversation, which takes them again: a wake or a nudge carries them (ADR-0062).
+    const releaseBoundary = (iid: string): void => {
+      const held = boundary.get(iid);
+      if (held === undefined) return;
+      boundary.delete(iid);
+      binding.releaseNotices?.(
+        [...held.values()].flatMap((hs) => hs.map((h) => h.id)),
+        iid,
+      );
+    };
+    // The Harness appended them: heard in this conversation, in one save. An id this read did not
+    // name changes nothing.
+    const boundaryHeard = (iid: string, ids: readonly string[]): number => {
+      const held = boundary.get(iid);
+      if (held === undefined) return 0;
+      const heard = ids.flatMap((id) => held.get(id) ?? []);
+      for (const id of ids) held.delete(id);
+      if (held.size === 0) boundary.delete(iid);
+      if (heard.length === 0) return 0;
+      binding.acknowledgeNotices?.(
+        heard.map((h) => h.id),
+        iid,
+      );
+      const bucket = carriedBy.get(iid) ?? { heard: [], unheard: [], task: false, fresh: [] };
+      bucket.heard.push(...heard.map((h) => h.raised));
+      carriedBy.set(iid, bucket);
+      return ids.filter((id) => heard.some((h) => h.id === id)).length;
     };
 
     // The Turn's admission and a reroll's carry the pending notices in scope — a reroll's
-    // conversation is fresh, and has heard nothing. A nudge's does not: it re-prompts the Turn
-    // within itself (ADR-0016), whose Agent read a guard kill in its own `bash` answer, and a notice
-    // spent there never reaches the next Turn in the Workspace it is for (ADR-0062). Reserved
+    // conversation is fresh, and has heard nothing. A nudge's and a wake's carry only the guard
+    // kills of this Turn that came after its own `bash` call's last kill verdict (`hearPodKills`):
+    // they re-prompt the Turn within itself (ADR-0016), so a kill that verdict covers is already in
+    // its context, and is for the next Turn in the Workspace (ADR-0062). A later kill — while its
+    // model wrote text, while it waited for its wake, or answered in another conversation — this
+    // Agent was never told. Reserved
     // first, so no concurrent admission carries them too; delivered by the ledger write; released
     // when the admission fails, for the next one to carry.
     //
     // What the last carrying admission took, and under which iid: delivered is not HEARD. If this
     // actor ends the Turn before the Harness reads that iid's surface, the Harness finds the Turn
     // over and settles it with no model asked (ADR-0026) — so `abandon` raises them again.
-    let carried: { iid: string; notices: Notice[] } | undefined;
-    const admitTurn = async (turn: AgentRunInput, opts: { notices: boolean; extra?: Notice[] } = { notices: true }) => {
-      const taken = (opts.notices ? binding.takeNotices?.(noticeScope) : undefined) ?? { ids: [], notices: [] };
+    // Per conversation the Turn admitted on: the notices its admissions carried — `unheard` since
+    // the Harness last read its surface, `heard` before that — and whether an unheard one carried
+    // the Turn's task. Collected across the Turn, so a re-admission onto a lost conversation tells
+    // the Agent all of them again.
+    type Raised = { notice: Notice; source?: string };
+    // `fresh`: a fresh Turn's "this conversation is new", which rides an admission as `extra` and so
+    // is kept in no ledger — an unread one is carried again by the next re-admission.
+    const carriedBy = new Map<string, { heard: Raised[]; unheard: Raised[]; task: boolean; fresh: Notice[] }>();
+    // `notices`: "turn" takes every notice in scope; "same-turn" too, but the guard kills the Turn's own
+    // conversation was told (a re-admission after a cut continues the same Turn); "nudge" takes the
+    // guard kills this conversation was not told alone.
+    // `include`: sources restored for this admission, taken whatever the scope leaves out. `task`:
+    // this admission's prompt holds the Turn's task. `kept`: the admission is for a conversation
+    // that `holds` said the Harness keeps; a Harness that keeps none refuses it (`isNotKept`), and
+    // the refusal is thrown as any failed admission is.
+    const admitTurn = async (
+      turn: AgentRunInput,
+      opts: {
+        notices: "turn" | "same-turn" | "nudge";
+        extra?: Notice[];
+        include?: readonly string[];
+        task?: boolean;
+        kept?: boolean;
+      } = { notices: "turn", task: true },
+    ) => {
+      await hearKernelKill();
+      const { known, unsaid, said } = await hearPodKills();
+      releaseBoundary(turn.instanceId);
+      // The conversation that takes a Workspace notice (ADR-0062): the one this admission rides, its
+      // Instance ID. A continued Turn's is the continued conversation's; a fresh Turn's, a reroll's
+      // and a burned conversation's successor's are each a new conversation, which has heard none.
+      // A Workspace notice is delivered once in each, so every conversation in the Workspace hears
+      // it — each child of a Pool has its own — and no conversation hears it twice.
+      const taker = turn.instanceId;
+      // A read that could not tell leaves the same Turn no way to know which kills its own `bash`
+      // reported: it takes none, as a nudge takes none then, and they stay for the next Turn.
+      const sameTurn: NoticeScope = known
+        ? { ...noticeScope, taker, except: said }
+        : {
+            ...noticeScope,
+            taker,
+            ...(noticeWorkspace === undefined ? {} : { exceptPrefix: guardSource(noticeWorkspace, "") }),
+          };
+      const scope: NoticeScope | undefined =
+        opts.notices === "turn"
+          ? { ...noticeScope, taker, turn: true }
+          : opts.notices === "same-turn"
+            ? sameTurn
+            : unsaid.length > 0
+              ? { workspace: noticeWorkspace, taker, only: unsaid }
+              : undefined;
+      const none = { ids: [] as string[], notices: [] as Notice[], raised: [] as Raised[] };
+      const restored =
+        opts.include && opts.include.length > 0
+          ? (binding.takeNotices?.({ ...noticeScope, taker, only: opts.include }) ?? none)
+          : none;
+      const main = (scope ? binding.takeNotices?.(scope) : undefined) ?? none;
+      const taken = {
+        ids: [...restored.ids, ...main.ids],
+        notices: [...restored.notices, ...main.notices],
+        raised: [
+          ...(restored.raised ?? restored.notices.map((notice) => ({ notice }))),
+          ...(main.raised ?? main.notices.map((notice) => ({ notice }))),
+        ],
+      };
       // `extra`: a notice this admission carries straight from the actor, never kept — the answer a
-      // cut pick never got (ADR-0031), whose one road to the model is this admission.
-      const notices = [...taken.notices, ...(opts.extra ?? [])];
+      // cut pick never got (ADR-0031), whose one path to the model is this admission. One "this
+      // conversation is new" is enough, whichever path brought it.
+      let fresh = false;
+      const notices = [...taken.notices, ...(opts.extra ?? [])].filter((n) => {
+        if (n.kind !== "conversation-new") return true;
+        if (fresh) return false;
+        fresh = true;
+        return true;
+      });
+      // `served` is per Instance ID, and a nudge or a wake reuses the Turn's: it must be read again
+      // before this admission counts as heard (`reraiseUnheard`). An admission that fails puts the
+      // mark back — what an earlier one carried was heard.
+      const heard = served.has(turn.instanceId);
+      served.delete(turn.instanceId);
       let admission: AgentAdmission;
       try {
         admission = await client.admit(turn, {
           definition,
+          slot,
           signal: controller.signal,
           ...(notices.length ? { notices } : {}),
+          ...(opts.kept ? { kept: true } : {}),
         });
       } catch (err) {
-        binding.releaseNotices?.(taken.ids);
+        binding.releaseNotices?.(taken.ids, taker);
+        if (heard) served.add(turn.instanceId);
         throw err;
       }
       // The mark is taken once the Harness has ANSWERED: a restart before the answer took the
@@ -759,23 +1174,62 @@ export function agentActorWith(
       admitted = true;
       restartMark = heardRestarts?.restartCount;
       if (restartMark !== undefined) admission = { ...admission, harnessRestarts: restartMark };
-      ledger(admission, taken.ids);
-      if (taken.notices.length) carried = { iid: turn.instanceId, notices: taken.notices };
+      // The Turn's task rides every ledgered admission: a restore drops `prompt`.
+      const task = input.prompt ?? input.attach?.task;
+      if (task !== undefined) admission = { ...admission, task };
+      // A Turn in a Workspace keeps its start and its kill mark across a restore.
+      if (noticeWorkspace !== undefined) {
+        admission = {
+          ...admission,
+          turnStarted: turnStarted.toISOString(),
+          ...(killMark === undefined ? {} : { killMark }),
+        };
+      }
+      ledger(admission, taken.ids, taker);
+      const bucket = carriedBy.get(turn.instanceId) ?? { heard: [], unheard: [], task: false, fresh: [] };
+      if (heard) {
+        bucket.heard.push(...bucket.unheard);
+        bucket.unheard = [];
+        bucket.task = false;
+        bucket.fresh = [];
+      }
+      bucket.unheard.push(...taken.raised);
+      if (opts.task) bucket.task = true;
+      if (!input.continuation) bucket.fresh.push(...(opts.extra ?? []).filter((n) => n.kind === "conversation-new"));
+      carriedBy.set(turn.instanceId, bucket);
       return admission;
     };
-    // The notices an unheard admission carried, pending again for the next Turn in their scope.
-    const reraiseUnheard = (): void => {
-      if (carried === undefined || served.has(carried.iid)) return;
-      for (const notice of carried.notices) {
-        const to = notice.scope === "conversation" ? conversation : noticeWorkspace;
-        if (to !== undefined) binding.raiseNotice?.(notice, to);
+    // The notices unheard admissions carried, pending again for the next Turn in their scope —
+    // each WITH the source it was raised with, so a take by source finds it and no equal notice of
+    // another source swallows it. `lost`: the current conversation, which heard the rest, is gone,
+    // so they are unheard too. Answers the sources restored, which a re-admission of the same Turn
+    // takes whatever else it leaves out.
+    const reraiseUnheard = (lost = false): string[] => {
+      const restored: string[] = [];
+      for (const [iid, bucket] of carriedBy) {
+        const gone = lost && iid === currentIid;
+        const read = served.has(iid) && !gone;
+        const again = [...(gone ? bucket.heard : []), ...(read ? [] : bucket.unheard)];
+        if (gone) bucket.heard = [];
+        if (!read) bucket.unheard = [];
+        for (const { notice, source } of again) {
+          const to = notice.scope === "conversation" ? conversation : noticeWorkspace;
+          if (to === undefined) continue;
+          // A Workspace notice is pending again for the conversation that carried it, which did not
+          // hear it; the others it reached keep theirs.
+          if (binding.restoreNotice) binding.restoreNotice(notice, to, source, iid);
+          else binding.raiseNotice?.(notice, to);
+          if (source !== undefined) restored.push(source);
+        }
       }
-      carried = undefined;
+      return restored;
     };
 
     const abandon = () => {
       if (stopped) return;
       stopped = true;
+      // What ended the Turn, read while its registration is still there (ADR-0024).
+      const byPick = binding.turnEndedByPick?.(currentIid) === true;
       for (const dispose of disposers.splice(0)) dispose();
       // Stop consuming the stream. The remote end of the turn is the next paragraph.
       controller.abort();
@@ -784,12 +1238,24 @@ export function agentActorWith(
       // Pool cancelling a child. The one exception is the host stopping the run for its own
       // reasons, which ADR-0007's restore re-attaches to.
       if (binding.hostStopping) return;
+      // A step boundary's notices the Harness never acknowledged are pending again (ADR-0062).
+      for (const iid of [...boundary.keys()]) releaseBoundary(iid);
       reraiseUnheard();
+      // The Turn ended: a fresh conversation leaves every audience in its Workspace, a continued one
+      // waits for its next Turn (ADR-0062).
+      if (noticeWorkspace !== undefined) {
+        binding.noticeTurnEnded?.(noticeWorkspace, [...new Set([...carriedBy.keys(), currentIid])]);
+      }
       // Fire-and-forget, and unreportable BY CONSTRUCTION: this actor is stopped, so there is no
       // `agent.fault` left to raise. An orphan that survives a failed abort 404s on every tool
       // call and settles on its own.
       const iid = currentIid;
-      const aborting = client.abort(input.agentName, iid).catch(() => {});
+      // The cause names the Submission it is about: the last one ledgered for this Turn. The ledger
+      // is keyed by the invocation's iid, and stamps the live conversation (a reroll's).
+      const ledgered = binding.admissionOf?.(instanceId);
+      const submissionId = ledgered?.instanceId === iid ? ledgered.submissionId : undefined;
+      const cause = byPick ? { cause: "pick" as const, ...(submissionId ? { submissionId } : {}) } : {};
+      const aborting = client.abort(input.agentName, iid, cause).catch(() => {});
       pendingAborts.set(iid, aborting);
       void aborting.then(() => {
         if (pendingAborts.get(iid) === aborting) pendingAborts.delete(iid);
@@ -859,6 +1325,34 @@ export function agentActorWith(
         if (sub === undefined) finish();
       });
 
+    // The Harness keeps no such conversation (ADR-0062): it lost it while the Turn waited, and a
+    // `kept` admission found none. Nothing of the Turn is left there, so the Turn is admitted as a
+    // Turn on a new conversation: every notice in scope, `include` whatever the scope leaves out,
+    // and `prompt`, which holds the Turn's task. A continued Turn is told its conversation is new as the
+    // continue path tells it — the notice is kept for its conversation, which this admission takes.
+    // A fresh Turn's conversation is its own: the notice rides this admission alone, so no later
+    // continued Turn of another conversation is told its context is gone. `before` and `after`
+    // ride beside it, in that order.
+    const admitOntoLost = async (
+      prompt: string,
+      before: Notice[],
+      after: Notice[],
+      include: readonly string[],
+    ): Promise<AgentAdmission> => {
+      const extra = [...before];
+      const fresh: Notice = {
+        kind: "conversation-new",
+        scope: "conversation",
+        reason: "the Harness no longer holds it",
+      };
+      if (input.continuation) binding.raiseNotice?.(fresh, conversation);
+      else extra.push(fresh);
+      return await admitTurn(
+        { ...framed, attach: undefined, instanceId: currentIid, prompt },
+        { notices: "turn", extra: [...extra, ...after], include, task: true },
+      );
+    };
+
     // A Harness restart cut this Turn (ADR-0031). It is NOT an `agent.fault` when the Agent's state is
     // busy — something it started runs below it — or its pick's answer has not reached the model:
     // faulting would route the Machine out of the state and stop the work the Turn did not want
@@ -888,6 +1382,79 @@ export function agentActorWith(
               },
             ]
           : [];
+      // Kept until the re-admission is sure: a Turn that faults below still names the restart.
+      const cutBy = restarted;
+      // The restart that cut the Turn is the new mark at once: the watch may tell it again before
+      // the re-admission is answered, and it must not cut the re-admission too.
+      if (restarted !== undefined) restartMark = restarted.restartCount;
+      restarted = undefined;
+      controller = new AbortController();
+      // The rebuilt Harness may not read the conversation back: then this Turn lands on a new one,
+      // and is told (ADR-0062). Asked again while the new container may not listen yet, and taken
+      // as "held" only when the time is over. That "held" can be wrong — a Harness in
+      // CrashLoopBackOff answers nothing for longer — so the admission says it is for a kept
+      // conversation, and a Harness that keeps none refuses it: then the Turn takes the path of a
+      // lost conversation below.
+      const kept = await client.holds(input.agentName, currentIid, {
+        signal: AbortSignal.any([controller.signal, AbortSignal.timeout(holdsReadMs)]),
+      });
+      if (stopped) return "stopped";
+      // The task: a restore dropped `prompt`, and the ledgered admission kept it. A new
+      // conversation with no task to send cannot be asked to "continue your task": the Turn faults.
+      const task = input.prompt ?? input.attach?.task;
+      // Whether the cut admission, never read, carried the task: then the model never read it.
+      const taskUnheard = !served.has(currentIid) && carriedBy.get(currentIid)?.task === true;
+      // A fresh Turn's "this conversation is new" that an unread re-admission carried rides this
+      // one again: it is kept nowhere else. Read before the first admission below, which can fail.
+      const unreadFresh: Notice[] = served.has(currentIid) ? [] : [...(carriedBy.get(currentIid)?.fresh ?? [])];
+      // On a new conversation nothing of the Turn is left: the cut pick's answer rides after the task,
+      // and after the unread "this conversation is new" that the cut admission carried.
+      const readmitLost = (withTask: string, include: readonly string[]): Promise<AgentAdmission> =>
+        admitOntoLost(`${READMIT_PROMPT}\n\n${withTask}`, unreadFresh, notice, include);
+      // On a conversation the Harness still holds, it continues the same Turn. The task follows the
+      // re-admit text when a cut admission carried it and was never read.
+      const readmitKept = (include: readonly string[]): Promise<AgentAdmission> => {
+        const withTask = taskUnheard && task !== undefined;
+        return admitTurn(
+          {
+            ...framed,
+            attach: undefined,
+            instanceId: currentIid,
+            prompt: withTask ? `${READMIT_PROMPT}\n\n${task}` : READMIT_PROMPT,
+          },
+          { notices: "same-turn", extra: [...unreadFresh, ...notice], include, task: withTask, kept: true },
+        );
+      };
+      // What the cut admissions carried is pending again before this one takes, if the Harness never
+      // read their surface — or all of it, if the conversation that heard it is gone. Those sources
+      // ride this re-admission whatever its scope leaves out.
+      let admission: AgentAdmission;
+      if (!kept) {
+        // The fault names the restart that cut the Turn, and asks whether it was a memory kill.
+        if (task === undefined) {
+          restarted = cutBy;
+          return undefined;
+        }
+        admission = await readmitLost(task, reraiseUnheard(true));
+      } else {
+        const restored = reraiseUnheard(false);
+        try {
+          admission = await readmitKept(restored);
+        } catch (err) {
+          if (!isNotKept(err)) throw err;
+          // "Held" was the timeout's: the Harness keeps no such conversation, and it seated none. The
+          // failed admission put back what it took. Now the path of a lost conversation: what the
+          // conversation heard is unheard, and the Turn is admitted with its task — or faults when
+          // there is no task to send.
+          if (stopped) return "stopped";
+          if (task === undefined) {
+            restarted = cutBy;
+            return undefined;
+          }
+          admission = await readmitLost(task, [...restored, ...reraiseUnheard(true)]);
+        }
+      }
+      // Said once an admission worked: a refused one that then faults re-admitted nothing.
       cuts++;
       binding.telemetry?.({
         kind: "retry",
@@ -895,22 +1462,6 @@ export function agentActorWith(
         attempt: cuts,
         reason: "re-admitted after a Harness restart",
       });
-      restarted = undefined;
-      controller = new AbortController();
-      // The rebuilt Harness may not read the conversation back: then this Turn lands on a new one,
-      // and is told (ADR-0062), as the continue path tells it below.
-      if (!(await client.holds(input.agentName, currentIid, { signal: controller.signal }))) {
-        binding.raiseNotice?.(
-          { kind: "conversation-new", scope: "conversation", reason: "the Harness no longer holds it" },
-          conversation,
-        );
-      }
-      if (stopped) return "stopped";
-      // The notices pending for this Turn ride the re-admission, with the cut pick's answer after them.
-      const admission = await admitTurn(
-        { ...framed, attach: undefined, instanceId: currentIid, prompt: READMIT_PROMPT },
-        { notices: true, extra: notice },
-      );
       binding.heldAnswerDelivered?.(currentIid);
       return admission;
     };
@@ -961,17 +1512,30 @@ export function agentActorWith(
           // A continued conversation admitted before may be gone with no fault to say so: its
           // Harness restarted between the Turns. Then this Turn lands on a new one, and is told
           // (ADR-0062). A conversation never admitted has nothing to lose, so nothing is asked.
-          if (
-            input.continuation &&
-            binding.admissionOf?.(instanceId) !== undefined &&
-            !(await client.holds(input.agentName, instanceId, { signal: controller.signal }))
-          ) {
+          // "Held" can be a timeout's, so the admission says it is for a kept conversation, and a
+          // Harness that keeps none refuses it: then the Turn is told, and admitted again.
+          const told = () =>
             binding.raiseNotice?.(
               { kind: "conversation-new", scope: "conversation", reason: "the Harness no longer holds it" },
               conversation,
             );
-          }
-          admission = await admitTurn(framed);
+          const asked = input.continuation && binding.admissionOf?.(instanceId) !== undefined;
+          const kept =
+            asked &&
+            (await client.holds(input.agentName, instanceId, {
+              signal: AbortSignal.any([controller.signal, AbortSignal.timeout(holdsReadMs)]),
+            }));
+          if (asked && !kept) told();
+          if (kept) {
+            try {
+              admission = await admitTurn(framed, { notices: "turn", task: true, kept: true });
+            } catch (err) {
+              if (!isNotKept(err)) throw err;
+              if (stopped) return;
+              told();
+              admission = await admitTurn(framed);
+            }
+          } else admission = await admitTurn(framed);
           // The admission marker (ADR-0023): the Turn and its framing, once — a re-attach
           // continues a Turn already announced, and a nudge (below) is mechanism, not narrative
           // (its telemetry already rides the feed).
@@ -1045,15 +1609,36 @@ export function agentActorWith(
             attempt: nudges,
             reason: woken ? "picks allowed again" : "no-signal nudge",
           });
-          admission = await admitTurn(
-            {
-              ...framed,
-              attach: undefined,
-              instanceId: currentIid,
-              prompt: NUDGE_PROMPT,
-            },
-            { notices: false },
-          );
+          // The nudge and the wake ask the same conversation, so they say `kept`: the Harness can
+          // lose it while the Turn waits (the Instance Harness's restart is on no watch), and a
+          // Harness that keeps none then refuses, never seating an empty conversation whose model
+          // reads the nudge with no task. On the refusal the Turn takes the lost-conversation path,
+          // as the re-admission after a cut does: admitted as a Turn with its task, or a fault when
+          // there is no task to send. Its prompt is the task alone, as a continued Turn's is after
+          // the same refusal: nothing was cut, so the re-admit text would not be true. The ask was
+          // spent and said; the re-admission is said too.
+          try {
+            admission = await admitTurn(
+              {
+                ...framed,
+                attach: undefined,
+                instanceId: currentIid,
+                prompt: NUDGE_PROMPT,
+              },
+              { notices: "nudge", task: false, kept: true },
+            );
+          } catch (err) {
+            const task = input.prompt ?? input.attach?.task;
+            if (!isNotKept(err) || task === undefined) throw err;
+            if (stopped) return;
+            admission = await admitOntoLost(task, [], [], reraiseUnheard(true));
+            binding.telemetry?.({
+              kind: "retry",
+              child: self._parent?.id ?? self.id,
+              attempt: nudges,
+              reason: "re-admitted on a new conversation",
+            });
+          }
         }
       } catch (err) {
         if (stopped) return;
@@ -1086,10 +1671,13 @@ export function agentActorWith(
         const kill = lostHarness && sandbox !== undefined ? await memoryFault(sandbox) : undefined;
         if (stopped) return;
         if (kill !== undefined && noticeWorkspace !== undefined) {
+          // The kill cut this Turn (D4 rule 2): its Agent's next Turn retries the work, and hears it.
           binding.raiseNotice?.(
-            memoryLimit(kill.limit ?? "unknown"),
+            memoryLimit({ limit: kill.limit, agent: input.agentName }),
             noticeWorkspace,
-            kill.at === undefined ? undefined : `${noticeWorkspace}@${kill.at}`,
+            kill.at === undefined ? undefined : kernelSource(noticeWorkspace, kill.at),
+            [],
+            { retry: { slot, cut: currentIid }, ...(kill.at === undefined ? {} : { at: kill.at }) },
           );
         }
         // A restart the Harness came back from keeps the conversation (ADR-0031); a 404 does not.