diff --git a/apps/server/test/__artifacts__/recovery.machines.crash.json b/apps/server/test/__artifacts__/recovery.machines.crash.json
new file mode 100644
index 00000000..2cc9e300
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.crash.json
@@ -0,0 +1,83 @@
+{
+	"log": [
+		"session.prompt.admitted steer \"gate\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"gate\"",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "in flight",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "killed",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "resumed",
+			"head": null,
+			"restarts": 1,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "finished",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.crashloop.json b/apps/server/test/__artifacts__/recovery.machines.crashloop.json
new file mode 100644
index 00000000..af000175
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.crashloop.json
@@ -0,0 +1,125 @@
+{
+	"log": [
+		"session.prompt.admitted steer \"hold\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"hold\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"parked by the loop\"",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.run.failed crashloop",
+		"session.prompt.admitted steer \"next\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"next\"",
+		"session.llm.started",
+		"session.prompt.promoted followUp \"parked by the loop\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "crash loop",
+			"head": "session.run.failed crashloop",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "failed",
+			"error": {
+				"_tag": "runFailed",
+				"reason": "crashloop",
+				"message": "The run was interrupted 5 times in a row; it is not resumed again"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "parked by the loop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"parked by the loop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "restarted",
+			"head": "session.run.failed crashloop",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "failed",
+			"error": {
+				"_tag": "runFailed",
+				"reason": "crashloop",
+				"message": "The run was interrupted 5 times in a row; it is not resumed again"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "parked by the loop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"parked by the loop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": "session.run.failed crashloop",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "parked by the loop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"parked by the loop\"",
+					"promoted": "session.prompt.promoted followUp \"parked by the loop\"",
+					"runnable": false
+				},
+				{
+					"text": "next",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"next\"",
+					"promoted": "session.prompt.promoted steer \"next\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.network.json b/apps/server/test/__artifacts__/recovery.machines.network.json
new file mode 100644
index 00000000..34a12680
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.network.json
@@ -0,0 +1,99 @@
+{
+	"unreachable": true,
+	"log": [
+		"session.prompt.admitted steer \"gate\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"gate\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"sent while cut\"",
+		"session.prompt.promoted followUp \"sent while cut\"",
+		"session.llm.started",
+		"session.execution.succeeded",
+		"session.prompt.admitted steer \"on a slow link\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"on a slow link\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "cut",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "sent while cut",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"sent while cut\"",
+					"promoted": "session.prompt.promoted followUp \"sent while cut\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "retried",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "sent while cut",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"sent while cut\"",
+					"promoted": "session.prompt.promoted followUp \"sent while cut\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "slow link",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "sent while cut",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"sent while cut\"",
+					"promoted": "session.prompt.promoted followUp \"sent while cut\"",
+					"runnable": false
+				},
+				{
+					"text": "on a slow link",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"on a slow link\"",
+					"promoted": "session.prompt.promoted steer \"on a slow link\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.shutdown.json b/apps/server/test/__artifacts__/recovery.machines.shutdown.json
new file mode 100644
index 00000000..72ed6094
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.shutdown.json
@@ -0,0 +1,118 @@
+{
+	"reason": "shutdown",
+	"log": [
+		"session.prompt.admitted steer \"gate\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"gate\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"after the boot\"",
+		"session.llm.failed",
+		"session.execution.interrupted shutdown",
+		"session.execution.started resumed=true",
+		"session.llm.started",
+		"session.prompt.promoted followUp \"after the boot\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "in flight",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": null,
+					"runnable": true
+				}
+			]
+		},
+		{
+			"step": "booted",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "interrupted",
+			"error": {
+				"_tag": "interrupted",
+				"reason": "shutdown"
+			},
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": null,
+					"runnable": true
+				}
+			]
+		},
+		{
+			"step": "resumed",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": null,
+					"runnable": true
+				}
+			]
+		},
+		{
+			"step": "finished",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": "session.prompt.promoted followUp \"after the boot\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.stop.json b/apps/server/test/__artifacts__/recovery.machines.stop.json
new file mode 100644
index 00000000..afcb7ff8
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.stop.json
@@ -0,0 +1,105 @@
+{
+	"log": [
+		"session.prompt.admitted steer \"hold\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"hold\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"after the stop\"",
+		"session.llm.failed",
+		"session.execution.interrupted user",
+		"session.prompt.admitted steer \"next\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"next\"",
+		"session.llm.started",
+		"session.prompt.promoted followUp \"after the stop\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "stopped",
+			"head": "session.execution.interrupted user",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "interrupted",
+			"error": {
+				"_tag": "interrupted",
+				"reason": "user"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "after the stop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the stop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "restarted",
+			"head": "session.execution.interrupted user",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "interrupted",
+			"error": {
+				"_tag": "interrupted",
+				"reason": "user"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "after the stop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the stop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": "session.execution.interrupted user",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "after the stop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the stop\"",
+					"promoted": "session.prompt.promoted followUp \"after the stop\"",
+					"runnable": false
+				},
+				{
+					"text": "next",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"next\"",
+					"promoted": "session.prompt.promoted steer \"next\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/sync.machines.crash.json b/apps/server/test/__artifacts__/sync.machines.crash.json
index ac144cad..a4a5a89e 100644
--- a/apps/server/test/__artifacts__/sync.machines.crash.json
+++ b/apps/server/test/__artifacts__/sync.machines.crash.json
@@ -4,13 +4,13 @@
 			"run_state": "running",
 			"run_outcome": null,
 			"run_error": null,
-			"execution": "running"
+			"head": 0
 		},
 		"swept": {
 			"run_state": "idle",
 			"run_outcome": "interrupted",
 			"run_error": "{\"_tag\":\"interrupted\",\"reason\":\"crash\"}",
-			"execution": "running"
+			"head": 0
 		},
 		"events": [
 			{
diff --git a/apps/server/test/recovery.machines.live.test.ts b/apps/server/test/recovery.machines.live.test.ts
new file mode 100644
index 00000000..04308e6f
--- /dev/null
+++ b/apps/server/test/recovery.machines.live.test.ts
@@ -0,0 +1,419 @@
+/* @effect-diagnostics nodeBuiltinImport:off -- the suite runs a CodeWork server on an OrbStack Linux machine. */
+import { Effect, Stream } from "effect";
+import { afterAll, beforeAll, describe, expect, it } from "vite-plus/test";
+import { Control, Session } from "../../../packages/harness/src/effect.ts";
+import { snapshot as match, waitFor } from "./fixtures/apps.ts";
+import { available, ensure, machine, orb } from "./machines/orb.ts";
+
+/*
+ * Durable runs across real failures of a real computer: the fixture CodeWork server (scripted model)
+ * runs on the OrbStack machine cw-a while the suite SIGKILLs it, shuts the whole machine down,
+ * crash-loops it, and cuts and throttles its network. What the store holds is read inside the
+ * machine with sqlite3; `recovery.machines.<name>.json` records the log and the rows across each
+ * failure, with log positions named by the event at them.
+ */
+
+const cw = machine("cw-a");
+const work = `${cw.cwHome}/work`;
+type Ids = { readonly sessionId: string; readonly threadId: string };
+type Row = Record<string, unknown>;
+
+/**
+ * Waits until the Mac reaches the server: after the machine boots, OrbStack takes up to a minute to
+ * route `<name>.orb.local` to it again.
+ */
+const reachable = () =>
+	waitFor(
+		() =>
+			fetch(cw.url.replace(/^ws/, "http"), { signal: AbortSignal.timeout(3_000) }).then(
+				() => true,
+				() => undefined,
+			),
+		"the server from the Mac",
+		180_000,
+	);
+
+/** A fresh store, with retries fast and many so a crash loop is the host's, not the request's. */
+const fresh = async () => {
+	await cw.net("restore");
+	await cw.net("fast");
+	await cw.stop("KILL");
+	await cw.wipe();
+	await cw.sh(
+		`mkdir -p ${work} && printf '%s' '{"retry":{"maxRetries":10,"baseDelayMs":10,"maxDelayMs":1000}}' > ${cw.cwHome}/settings.jsonc`,
+	);
+	await cw.start();
+	await reachable();
+};
+
+const create = () =>
+	cw.run((rpc) =>
+		rpc["session.create"]({ directory: work }).pipe(
+			Effect.map((created): Ids => ({ sessionId: created.session.id, threadId: created.id })),
+		),
+	);
+
+const prompt = (ids: Ids, text: string, options: { delivery?: "steer" | "followUp"; id?: string } = {}) =>
+	cw.run((rpc) =>
+		rpc["thread.prompt"]({
+			sessionId: Session.SessionSchema.ID.make(ids.sessionId),
+			threadId: Session.ThreadSchema.ID.make(ids.threadId),
+			text,
+			...(options.delivery === undefined ? {} : { delivery: options.delivery }),
+			...(options.id === undefined ? {} : { id: Session.SessionMessageSchema.ID.make(options.id) }),
+		}),
+	);
+
+const ref = (ids: Ids) => ({
+	sessionId: Session.SessionSchema.ID.make(ids.sessionId),
+	threadId: Session.ThreadSchema.ID.make(ids.threadId),
+});
+const idle = (ids: Ids) => cw.run((rpc) => rpc["thread.wait"](ref(ids)));
+const queue = (ids: Ids) =>
+	cw.run((rpc) => rpc["thread.queue"](ref(ids)).pipe(Effect.map(({ entries }) => entries.map((one) => one.text))));
+
+type Event = { readonly seq: number; readonly type: string; readonly data: Row };
+
+/** The session's durable log, read in the machine; the type without its version. */
+const events = async (ids: Ids): Promise<Array<Event>> =>
+	(await cw.sql(`SELECT seq, type, data FROM event WHERE aggregate_id = '${ids.sessionId}' ORDER BY seq`)).map(
+		(row) => ({
+			seq: Number(row["seq"]),
+			type: (row["type"] as string).replace(/\.\d+$/, ""),
+			data: JSON.parse(row["data"] as string) as Row,
+		}),
+	);
+
+const textOf = (data: Row) =>
+	((data["prompt"] as { parts?: ReadonlyArray<{ text?: string }> } | undefined)?.parts ?? [])
+		.map((part) => part.text ?? "")
+		.join("");
+
+const shown = new Set([
+	"session.prompt.admitted",
+	"session.prompt.promoted",
+	"session.prompt.updated",
+	"session.execution.started",
+	"session.execution.succeeded",
+	"session.execution.failed",
+	"session.execution.interrupted",
+	"session.run.failed",
+	"session.llm.started",
+	"session.llm.failed",
+]);
+
+/** What an event says, without ids, times or messages that carry them. */
+const describeEvent = (event: Event) => {
+	const { type, data } = event;
+	if (type === "session.prompt.admitted" || type === "session.prompt.promoted")
+		return `${type} ${data["delivery"] as string} "${textOf(data)}"`;
+	if (type === "session.prompt.updated") return `${type} ${(data["delivery"] as string | undefined) ?? ""}`.trim();
+	if (type === "session.execution.started") return `${type} resumed=${String(data["resumed"] as boolean)}`;
+	if (type === "session.execution.interrupted" || type === "session.run.failed")
+		return `${type} ${data["reason"] as string}`;
+	return type;
+};
+
+const count = (log: ReadonlyArray<Event>, type: string) => log.filter((event) => event.type === type).length;
+
+/** The thread's row and its prompts, log positions named by the event at them. */
+const rows = async (ids: Ids) => {
+	const log = await events(ids);
+	const at = (seq: unknown) => {
+		if (seq === null || seq === undefined || seq === 0) return null;
+		const event = log.find((one) => one.seq === Number(seq));
+		return event === undefined ? `unmatched ${seq as number}` : describeEvent(event);
+	};
+	const [thread] = await cw.sql(
+		`SELECT head, restarts, run_state, run_outcome, run_error FROM thread WHERE id = '${ids.threadId}'`,
+	);
+	const prompts = await cw.sql(
+		`SELECT data, delivery, admitted_seq, tail, promoted_seq FROM inbox WHERE thread_id = '${ids.threadId}' ORDER BY admitted_seq`,
+	);
+	const head = Number(thread!["head"]);
+	return {
+		head: at(head),
+		restarts: thread!["restarts"],
+		runState: thread!["run_state"],
+		outcome: thread!["run_outcome"],
+		error: thread!["run_error"] === null ? null : (JSON.parse(thread!["run_error"] as string) as Row),
+		prompts: prompts.map((row) => ({
+			text: textOf({ prompt: JSON.parse(row["data"] as string) }),
+			delivery: row["delivery"],
+			tail: at(row["tail"]),
+			promoted: at(row["promoted_seq"]),
+			runnable: row["promoted_seq"] === null && Number(row["tail"]) > head,
+		})),
+	};
+};
+
+/** The lifecycle part of the log, in order. */
+const lifecycle = async (ids: Ids) =>
+	(await events(ids)).filter((event) => shown.has(event.type)).map((event) => describeEvent(event));
+
+/** Waits until the log holds `n` events of `type`, and returns it. */
+const logged = (ids: Ids, type: string, n = 1, timeout = 120_000) =>
+	waitFor(
+		async () => {
+			const log = await events(ids);
+			return count(log, type) >= n ? log : undefined;
+		},
+		`${n} × ${type}`,
+		timeout,
+	);
+
+/** Waits until the thread's request is out, as the store records it. */
+const inFlight = (ids: Ids, timeout = 120_000) =>
+	waitFor(
+		async () => {
+			const [row] = await cw.sql(`SELECT run_state, attempt FROM thread WHERE id = '${ids.threadId}'`);
+			return row?.["run_state"] === "running" && row["attempt"] !== null ? row : undefined;
+		},
+		"the request in flight",
+		timeout,
+	);
+
+/** Gives a server that just started time to resume what it owes, then says what ran since `from`. */
+const settledSince = async (ids: Ids, from: number) => {
+	await new Promise((resolve) => setTimeout(resolve, 3_000));
+	await idle(ids);
+	return (await events(ids)).filter((event) => event.seq > from && shown.has(event.type)).map(describeEvent);
+};
+
+const lastSeq = async (ids: Ids) => (await events(ids)).at(-1)?.seq ?? 0;
+
+const releases = async (n: number) => {
+	for (let step = 0; step < n; step++) await cw.release();
+};
+
+const snapshot = (name: string, artifact: unknown) => match(`recovery.machines.${name}`, artifact);
+
+const describeMachines = available ? describe : describe.skip;
+
+describeMachines("durable runs across real machine failures", () => {
+	beforeAll(async () => {
+		await ensure(cw.name);
+		await cw.setup();
+	}, 1_800_000);
+
+	afterAll(async () => {
+		await cw.net("fast").catch(() => undefined);
+		await cw.net("restore").catch(() => undefined);
+		await cw.stop("KILL").catch(() => undefined);
+	}, 120_000);
+
+	it("1. a host SIGKILLed mid-request is swept as a crash, resumed with one restart, and finishes", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "gate");
+		await inFlight(ids);
+		await record("in flight");
+		await cw.stop("KILL");
+		await record("killed");
+
+		await cw.start();
+		await logged(ids, "session.execution.started", 2);
+		await inFlight(ids);
+		await record("resumed");
+		expect(steps.at(-1)).toMatchObject({ restarts: 1, runState: "running" });
+		// The resumed request is the scripted `gate` again: one step at once, four held.
+		await releases(4);
+		await logged(ids, "session.execution.succeeded");
+		await idle(ids);
+		await record("finished");
+
+		expect(steps.at(-1)).toMatchObject({ restarts: 0, outcome: "succeeded" });
+		const log = await lifecycle(ids);
+		expect(log).toContain("session.execution.interrupted crash");
+		expect(log).toContain("session.execution.started resumed=true");
+		await snapshot("crash", { log, steps });
+	}, 300_000);
+
+	it("2. a machine shut down mid-request and booted again resumes the run, its queue intact", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "gate");
+		await inFlight(ids);
+		await prompt(ids, "after the boot", { delivery: "followUp" });
+		await record("in flight");
+
+		const init = () => cw.sh("ps -o lstart= -p 1");
+		const bootedAt = await init();
+		await orb(["stop", cw.name], { timeout: 300_000 });
+		const machines = JSON.parse(await orb(["list", "--format", "json"])) as Array<{ name: string; state: string }>;
+		expect(machines.find((one) => one.name === cw.name)?.state).toBe("stopped");
+		await orb(["start", cw.name], { timeout: 300_000 });
+		expect(await init()).not.toBe(bootedAt);
+		// A boot starts nothing: the server runs only once start.sh starts it.
+		expect((await cw.sh(`pgrep -f '[f]ixtures/codework.ts' || true`)).trim()).toBe("");
+		await cw.sh(`rm -f $HOME/cw.pid`);
+		await record("booted");
+		const ended = steps.at(-1)!.error as { reason?: string } | null;
+
+		await cw.start();
+		await reachable();
+		await logged(ids, "session.execution.started", 2);
+		await inFlight(ids);
+		await record("resumed");
+		await releases(4);
+		await logged(ids, "session.execution.succeeded", 1, 120_000);
+		await waitFor(async () => ((await queue(ids)).length === 0 ? true : undefined), "the follow-up to run", 120_000);
+		await logged(ids, "session.execution.succeeded");
+		await idle(ids);
+		await record("finished");
+
+		// A shutdown that published its own end resumes uncounted; one the OS cut off first is a crash.
+		const reason = ended === null ? "crash" : ended.reason;
+		expect(["shutdown", "crash"]).toContain(reason);
+		expect(steps.find((step) => step.step === "resumed")).toMatchObject({
+			restarts: reason === "shutdown" ? 0 : 1,
+		});
+		const finished = steps.at(-1)!;
+		expect(finished).toMatchObject({ restarts: 0, outcome: "succeeded" });
+		expect(finished.prompts.map((one) => [one.text, one.promoted !== null])).toEqual([
+			["gate", true],
+			["after the boot", true],
+		]);
+		await snapshot("shutdown", { reason, log: await lifecycle(ids), steps });
+	}, 900_000);
+
+	it("3. a user stop parks the queue: a SIGKILL and restart run nothing, the next prompt runs it all", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "hold");
+		await inFlight(ids);
+		await prompt(ids, "after the stop", { delivery: "followUp" });
+		await cw.run((rpc) => rpc["thread.interrupt"](ref(ids)));
+		await logged(ids, "session.execution.interrupted");
+		await idle(ids);
+		await record("stopped");
+		const stopped = steps.at(-1)!;
+		expect(stopped.head).toBe("session.execution.interrupted user");
+		expect(stopped.prompts.find((one) => one.text === "after the stop")).toMatchObject({ runnable: false });
+
+		const before = await lastSeq(ids);
+		await cw.stop("KILL");
+		await cw.start();
+		expect(await settledSince(ids, before)).toEqual([]);
+		expect(await queue(ids)).toEqual(["after the stop"]);
+		await record("restarted");
+
+		await prompt(ids, "next");
+		await waitFor(async () => ((await queue(ids)).length === 0 ? true : undefined), "the queue to run", 120_000);
+		await idle(ids);
+		await record("next prompt");
+		const ran = (await lifecycle(ids)).filter((line) => line.startsWith("session.prompt.promoted"));
+		expect(ran).toEqual([
+			'session.prompt.promoted steer "hold"',
+			'session.prompt.promoted steer "next"',
+			'session.prompt.promoted followUp "after the stop"',
+		]);
+		await snapshot("stop", { log: await lifecycle(ids), steps });
+	}, 300_000);
+
+	it("4. a host that keeps dying ends the run as a crash loop: its follow-up stays parked across another restart", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "hold");
+		await inFlight(ids);
+		await prompt(ids, "parked by the loop", { delivery: "followUp" });
+		// The first run, then a resume each until the limit: each dies with its request in flight.
+		for (let started = 1; started <= Control.RESTART_LIMIT; started++) {
+			await logged(ids, "session.llm.started", started);
+			await inFlight(ids);
+			await cw.stop("KILL");
+			await cw.start();
+		}
+		await logged(ids, "session.run.failed");
+		await idle(ids);
+		await record("crash loop");
+		const looped = steps.at(-1)!;
+		expect(looped.error).toMatchObject({ _tag: "runFailed", reason: "crashloop" });
+		expect(looped.head).toBe("session.run.failed crashloop");
+		expect(looped.prompts.find((one) => one.text === "parked by the loop")).toMatchObject({ runnable: false });
+
+		const before = await lastSeq(ids);
+		await cw.stop("KILL");
+		await cw.start();
+		expect(await settledSince(ids, before)).toEqual([]);
+		await record("restarted");
+
+		await prompt(ids, "next");
+		await waitFor(async () => ((await queue(ids)).length === 0 ? true : undefined), "the queue to run", 120_000);
+		await idle(ids);
+		await record("next prompt");
+		expect(steps.at(-1)).toMatchObject({ restarts: 0, outcome: "succeeded" });
+		const log = await lifecycle(ids);
+		expect(count(await events(ids), "session.llm.started")).toBe(Control.RESTART_LIMIT + 2);
+		await snapshot("crashloop", { log, steps });
+	}, 900_000);
+
+	it("5. a cut network leaves the run going; a retried prompt id lands once; the client catches up, also on a slow link", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+		const sent = Session.SessionMessageSchema.ID.create();
+
+		await prompt(ids, "gate", { id: sent });
+		await inFlight(ids);
+		await cw.net("cut");
+		const unreachable = await cw
+			.run((rpc) => rpc["thread.info"](ref(ids)))
+			.then(
+				() => false,
+				() => true,
+			);
+		expect(unreachable).toBe(true);
+
+		// Inside the machine, over loopback: a follow-up, and the held reply let through.
+		await cw.drive([["thread.prompt", { ...ref(ids), text: "sent while cut", delivery: "followUp" }]]);
+		await releases(4);
+		await logged(ids, "session.execution.succeeded");
+		await waitFor(
+			async () => ((await rows(ids)).prompts.every((one) => one.promoted !== null) ? true : undefined),
+			"the follow-up to run",
+			120_000,
+		);
+		await record("cut");
+		await cw.net("restore");
+
+		// The client never heard back about its prompt before the cut; retrying it is the same prompt.
+		await prompt(ids, "gate", { id: sent });
+		await idle(ids);
+		await record("retried");
+		const log = await events(ids);
+		expect(
+			log.filter((event) => event.type === "session.prompt.admitted" && event.data["messageId"] === sent),
+		).toHaveLength(1);
+		expect(steps.at(-1)!.prompts).toEqual(steps.at(-2)!.prompts);
+
+		const succeeded = count(await events(ids), "session.execution.succeeded");
+		await cw.net("slow");
+		await prompt(ids, "on a slow link");
+		await logged(ids, "session.execution.succeeded", succeeded + 1);
+		await idle(ids);
+		const caught = await cw.run((rpc) =>
+			rpc["session.log"]({ sessionId: Session.SessionSchema.ID.make(ids.sessionId) }).pipe(
+				Stream.runCollect,
+				Effect.map((items) => Array.from(items).filter((item) => item.type !== "log.synced").length),
+			),
+		);
+		await cw.net("fast");
+		await record("slow link");
+		expect(caught).toBe((await events(ids)).length);
+		await snapshot("network", { unreachable, log: await lifecycle(ids), steps });
+	}, 600_000);
+});
diff --git a/apps/server/test/sync.machines.live.test.ts b/apps/server/test/sync.machines.live.test.ts
index ccbf0967..db292855 100644
--- a/apps/server/test/sync.machines.live.test.ts
+++ b/apps/server/test/sync.machines.live.test.ts
@@ -471,7 +471,7 @@ describeMachines("sync across OrbStack machines", () => {
 		const crashedAt = lastSeq(appHome);
 
 		await cwA.stop("KILL");
-		const harnessRow = `SELECT run_state, run_outcome, run_error, execution FROM thread WHERE id = '${ref.threadId}'`;
+		const harnessRow = `SELECT run_state, run_outcome, run_error, head FROM thread WHERE id = '${ref.threadId}'`;
 		const open = await cwA.sql(harnessRow);
 		await cwA.sweep();
 		const swept = await cwA.sql(harnessRow);
diff --git a/packages/codework/src/server/client.ts b/packages/codework/src/server/client.ts
index 43948386..ed90907d 100644
--- a/packages/codework/src/server/client.ts
+++ b/packages/codework/src/server/client.ts
@@ -41,9 +41,20 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 	let admitted = false;
 	let promoted = false;
 	let settled = false;
-	let unattributed: ExecutionError | undefined;
-	// Raised once a busy period ends without our prompt in it: the session may be
-	// about to go idle, and only idleness proves our prompt is never running.
+	// By log position, since notifications may arrive out of order: a run that started after our
+	// admission is one our prompt woke, so its failure before promoting us is ours. A run already going
+	// fails on its own, and parks our prompt behind it.
+	let admittedAt: number | undefined;
+	const starts: Array<number> = [];
+	// Runs that ended before promoting us, failed ones with their error.
+	const ends: Array<{ readonly at: number; readonly error: ExecutionError | undefined }> = [];
+	const ours = () =>
+		ends.findLast(({ at, error }) => {
+			const start = Math.max(...starts.filter((seq) => seq < at));
+			return error !== undefined && admittedAt !== undefined && start > admittedAt;
+		})?.error;
+	// Raised once a run ends after our admission without our prompt in it: the session may be about to
+	// go idle, and only idleness proves our prompt is never running.
 	const stalled = yield* Deferred.make<void>();
 
 	const terminal = (event: EventSchema.Payload): ExecutionError | undefined => {
@@ -52,6 +63,8 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 				type: "aborted",
 				message: event.data.reason === "shutdown" ? "Server stopped the session" : "Session interrupted",
 			});
+		if (Schema.is(EventList.RunFailed)(event))
+			return new ExecutionError({ type: `run.${event.data.reason}`, message: event.data.message });
 		if (Schema.is(EventList.ExecutionFailed)(event))
 			return new ExecutionError({
 				type: event.data.error.type,
@@ -72,21 +85,22 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 					Effect.catchTag("UnknownEventTypeError", () => Effect.void),
 				);
 				if (event === undefined) return;
-				if (Schema.is(EventList.PromptAdmitted)(event) && event.data.messageId === id) admitted = true;
-				if (Schema.is(EventList.Prompted)(event) && event.data.messageId === id) {
-					promoted = true;
-					// Our prompt is running after all; whatever ended before it was not ours.
-					unattributed = undefined;
+				const seq = event.durable?.seq;
+				if (Schema.is(EventList.ExecutionStarted)(event) && seq !== undefined) starts.push(seq);
+				if (Schema.is(EventList.PromptAdmitted)(event) && event.data.messageId === id) {
+					admitted = true;
+					admittedAt = seq;
 				}
-				if (!admitted) return;
+				if (Schema.is(EventList.Prompted)(event) && event.data.messageId === id) promoted = true;
 
 				const ended = terminal(event);
 				const succeeded = Schema.is(EventList.ExecutionSucceeded)(event);
 				if (!promoted) {
-					if (ended !== undefined) unattributed = ended;
-					// A busy period that ended without us: wait for idle to find out
-					// whether a successor still picks our prompt up.
-					if (ended !== undefined || succeeded) yield* Deferred.succeed(stalled, undefined);
+					// Kept whatever arrives first: our admission comes from another fiber than the runs, so a
+					// run's end may be notified before it.
+					if ((ended !== undefined || succeeded) && seq !== undefined) ends.push({ at: seq, error: ended });
+					if (admitted && ends.some(({ at }) => admittedAt === undefined || at > admittedAt))
+						yield* Deferred.succeed(stalled, undefined);
 					return;
 				}
 				if (ended !== undefined) return yield* ended;
@@ -121,8 +135,7 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 
 	yield* Effect.raceFirst(consume, reconcile);
 	if (settled) return;
-	if (abandoned)
-		return yield* unattributed ?? new ExecutionError({ type: "unknown", message: "Prompt was not promoted" });
+	if (abandoned) return yield* ours() ?? new ExecutionError({ type: "unknown", message: "Prompt was not promoted" });
 	return yield* new ExecutionError({
 		type: "transport.disconnected",
 		message: "Event stream ended before the prompt finished; its output was not rendered",
diff --git a/packages/codework/src/server/server.ts b/packages/codework/src/server/server.ts
index 282baeb4..f65e4033 100644
--- a/packages/codework/src/server/server.ts
+++ b/packages/codework/src/server/server.ts
@@ -57,8 +57,9 @@ const managedShutdown = Layer.unwrap(
 const sweep = Layer.effectDiscard(Effect.flatMap(Control.Service, (control) => control.sweep));
 
 /**
- * Resumes the runs the last server left unfinished, whether it crashed or shut down: the session
- * table records them as they start, so this needs nothing from the previous process.
+ * Resumes the runs the last server left unfinished, whether it crashed or shut down, and the prompts
+ * woken past a thread's head: the log and its projections record both, so this needs nothing from the
+ * previous process.
  */
 const resumeUnfinished = Layer.effectDiscard(
 	Effect.gen(function* () {
diff --git a/packages/codework/test/__artifacts__/cli.run-failed.json b/packages/codework/test/__artifacts__/cli.run-failed.json
new file mode 100644
index 00000000..a168a07a
--- /dev/null
+++ b/packages/codework/test/__artifacts__/cli.run-failed.json
@@ -0,0 +1,4 @@
+{
+	"status": 1,
+	"stderr": "error[run.truncated]: The response hit the output token limit with tool calls 2 times in a row; the run is ended\n"
+}
diff --git a/packages/codework/test/__artifacts__/recovery.after-failure.json b/packages/codework/test/__artifacts__/recovery.after-failure.json
new file mode 100644
index 00000000..e86f7f3d
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.after-failure.json
@@ -0,0 +1,308 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 9,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 11,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 12,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 13,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 14,
+			"type": "session.run.failed",
+			"reason": "truncated",
+			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
+		},
+		{
+			"seq": 15,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Now this."
+		},
+		{
+			"seq": 16,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 17,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Now this."
+		},
+		{
+			"seq": 18,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 19,
+			"type": "session.execution.interrupted",
+			"reason": "crash"
+		},
+		{
+			"seq": 20,
+			"type": "session.execution.started",
+			"resumed": true
+		},
+		{
+			"seq": 21,
+			"type": "session.llm.failed",
+			"reason": "error",
+			"errorMessage": "The host stopped while the model was answering, on attempt 1",
+			"parts": []
+		},
+		{
+			"seq": 22,
+			"type": "session.retry.scheduled",
+			"attempt": 1,
+			"maxRetries": 3,
+			"delayMs": 10,
+			"message": "The host stopped while the model was answering, on attempt 1"
+		},
+		{
+			"seq": 23,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 24,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answered after the kill."
+				}
+			]
+		},
+		{
+			"seq": 25,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 26,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"steps": [
+		{
+			"step": "in flight",
+			"head": 14,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Now this.",
+					"delivery": "steer",
+					"admittedSeq": 15,
+					"tail": 15,
+					"promotedSeq": 17
+				}
+			]
+		},
+		{
+			"step": "resumed",
+			"head": 14,
+			"restarts": 1,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Now this.",
+					"delivery": "steer",
+					"admittedSeq": 15,
+					"tail": 15,
+					"promotedSeq": 17
+				}
+			]
+		},
+		{
+			"step": "finished",
+			"head": 14,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Now this.",
+					"delivery": "steer",
+					"admittedSeq": 15,
+					"tail": 15,
+					"promotedSeq": 17
+				}
+			]
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Now this."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Now this."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.crashloop.json b/packages/codework/test/__artifacts__/recovery.crashloop.json
index a6202630..d3e6d136 100644
--- a/packages/codework/test/__artifacts__/recovery.crashloop.json
+++ b/packages/codework/test/__artifacts__/recovery.crashloop.json
@@ -236,7 +236,7 @@
 			"reason": "crashloop",
 			"message": "The run was interrupted 5 times in a row; it is not resumed again"
 		},
-		"execution": null
+		"head": 30
 	},
 	"requests": [
 		[
diff --git a/packages/codework/test/__artifacts__/recovery.interrupted.json b/packages/codework/test/__artifacts__/recovery.interrupted.json
index 88ba0a37..27a6215e 100644
--- a/packages/codework/test/__artifacts__/recovery.interrupted.json
+++ b/packages/codework/test/__artifacts__/recovery.interrupted.json
@@ -110,7 +110,7 @@
 			"reason": "interrupted",
 			"message": "The host stopped while the model was answering, on attempt 2"
 		},
-		"execution": null
+		"head": 16
 	},
 	"requests": [
 		[
diff --git a/packages/codework/test/__artifacts__/recovery.lifecycle.json b/packages/codework/test/__artifacts__/recovery.lifecycle.json
index 1f1c8114..a9838497 100644
--- a/packages/codework/test/__artifacts__/recovery.lifecycle.json
+++ b/packages/codework/test/__artifacts__/recovery.lifecycle.json
@@ -50,7 +50,7 @@
 			"endedAt": "9 session.execution.succeeded",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
+			"head": 0
 		},
 		{
 			"step": "in flight",
@@ -60,7 +60,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "killed",
@@ -70,7 +70,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "resumed",
@@ -80,7 +80,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "finished",
@@ -90,7 +90,7 @@
 			"endedAt": "21 session.execution.succeeded",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
+			"head": 0
 		}
 	],
 	"requests": [
diff --git a/packages/codework/test/__artifacts__/recovery.moved.json b/packages/codework/test/__artifacts__/recovery.moved.json
new file mode 100644
index 00000000..ca4cb7b0
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.moved.json
@@ -0,0 +1,312 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 9,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 11,
+			"type": "session.prompt.admitted",
+			"delivery": "followUp",
+			"text": "Then this."
+		},
+		{
+			"seq": 12,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 13,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 14,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 15,
+			"type": "session.run.failed",
+			"reason": "truncated",
+			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
+		},
+		{
+			"seq": 16,
+			"type": "session.prompt.updated"
+		},
+		{
+			"seq": 17,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 18,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Then this."
+		},
+		{
+			"seq": 19,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 20,
+			"type": "session.execution.interrupted",
+			"reason": "crash"
+		},
+		{
+			"seq": 21,
+			"type": "session.execution.started",
+			"resumed": true
+		},
+		{
+			"seq": 22,
+			"type": "session.llm.failed",
+			"reason": "error",
+			"errorMessage": "The host stopped while the model was answering, on attempt 1",
+			"parts": []
+		},
+		{
+			"seq": 23,
+			"type": "session.retry.scheduled",
+			"attempt": 1,
+			"maxRetries": 3,
+			"delayMs": 10,
+			"message": "The host stopped while the model was answering, on attempt 1"
+		},
+		{
+			"seq": 24,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 25,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answered after the kill."
+				}
+			]
+		},
+		{
+			"seq": 26,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 27,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"steps": [
+		{
+			"step": "resent",
+			"head": 15,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then this.",
+					"delivery": "followUp",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "moved",
+			"head": 15,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 16,
+					"promotedSeq": 18
+				}
+			]
+		},
+		{
+			"step": "finished",
+			"head": 15,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 16,
+					"promotedSeq": 18
+				}
+			]
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then this."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then this."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.parked.json b/packages/codework/test/__artifacts__/recovery.parked.json
new file mode 100644
index 00000000..09615d41
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.parked.json
@@ -0,0 +1,313 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 9,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 11,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Then answer this."
+		},
+		{
+			"seq": 12,
+			"type": "session.prompt.admitted",
+			"delivery": "followUp",
+			"text": "And this."
+		},
+		{
+			"seq": 13,
+			"type": "session.prompt.updated"
+		},
+		{
+			"seq": 14,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 15,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 16,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 17,
+			"type": "session.run.failed",
+			"reason": "truncated",
+			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
+		},
+		{
+			"seq": 18,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 19,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 20,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Then answer this."
+		},
+		{
+			"seq": 21,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "And this."
+		},
+		{
+			"seq": 22,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 23,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 24,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answered with the queue."
+				}
+			]
+		},
+		{
+			"seq": 25,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 26,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"steps": [
+		{
+			"step": "parked",
+			"head": 17,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then answer this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": null
+				},
+				{
+					"text": "And this.",
+					"delivery": "steer",
+					"admittedSeq": 12,
+					"tail": 13,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "reopened",
+			"head": 17,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then answer this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": null
+				},
+				{
+					"text": "And this.",
+					"delivery": "steer",
+					"admittedSeq": 12,
+					"tail": 13,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": 17,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then answer this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": 20
+				},
+				{
+					"text": "And this.",
+					"delivery": "steer",
+					"admittedSeq": 12,
+					"tail": 13,
+					"promotedSeq": 21
+				},
+				{
+					"text": "Next.",
+					"delivery": "steer",
+					"admittedSeq": 18,
+					"tail": 18,
+					"promotedSeq": 22
+				}
+			]
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then answer this."
+			},
+			{
+				"role": "user",
+				"text": "And this."
+			},
+			{
+				"role": "user",
+				"text": "Next."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.shutdown.json b/packages/codework/test/__artifacts__/recovery.shutdown.json
new file mode 100644
index 00000000..33cd96c0
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.shutdown.json
@@ -0,0 +1,84 @@
+{
+	"log": [
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 8,
+			"type": "session.execution.interrupted",
+			"reason": "shutdown"
+		},
+		{
+			"seq": 9,
+			"type": "session.execution.started",
+			"resumed": true
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 13,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"stopped": {
+		"head": 0,
+		"restarts": 0,
+		"prompts": [
+			{
+				"text": "First.",
+				"delivery": "steer",
+				"admittedSeq": 2,
+				"tail": 2,
+				"promotedSeq": 4
+			}
+		]
+	},
+	"resumed": {
+		"head": 0,
+		"restarts": 0,
+		"prompts": [
+			{
+				"text": "First.",
+				"delivery": "steer",
+				"admittedSeq": 2,
+				"tail": 2,
+				"promotedSeq": 4
+			}
+		]
+	},
+	"finished": {
+		"head": 0,
+		"restarts": 0,
+		"prompts": [
+			{
+				"text": "First.",
+				"delivery": "steer",
+				"admittedSeq": 2,
+				"tail": 2,
+				"promotedSeq": 4
+			}
+		]
+	},
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "First."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "First."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.stop.json b/packages/codework/test/__artifacts__/recovery.stop.json
new file mode 100644
index 00000000..72298146
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.stop.json
@@ -0,0 +1,300 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run the stubborn command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run the stubborn command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "toolUse",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.prompt.admitted",
+			"delivery": "followUp",
+			"text": "Queued before the stop."
+		},
+		{
+			"seq": 9,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Sent while stopping."
+		},
+		{
+			"seq": 10,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "aborted",
+				"result": "Tool Execution Interrupted"
+			}
+		},
+		{
+			"seq": 11,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 12,
+			"type": "session.execution.interrupted",
+			"reason": "user"
+		},
+		{
+			"seq": 13,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 14,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 15,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Sent while stopping."
+		},
+		{
+			"seq": 16,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 17,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 18,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answer 1."
+				}
+			]
+		},
+		{
+			"seq": 19,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 20,
+			"type": "session.prompt.promoted",
+			"delivery": "followUp",
+			"text": "Queued before the stop."
+		},
+		{
+			"seq": 21,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 22,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answer 2."
+				}
+			]
+		},
+		{
+			"seq": 23,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 24,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"steps": [
+		{
+			"step": "stopped",
+			"head": 12,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run the stubborn command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Queued before the stop.",
+					"delivery": "followUp",
+					"admittedSeq": 8,
+					"tail": 8,
+					"promotedSeq": null
+				},
+				{
+					"text": "Sent while stopping.",
+					"delivery": "steer",
+					"admittedSeq": 9,
+					"tail": 9,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "reopened",
+			"head": 12,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run the stubborn command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Queued before the stop.",
+					"delivery": "followUp",
+					"admittedSeq": 8,
+					"tail": 8,
+					"promotedSeq": null
+				},
+				{
+					"text": "Sent while stopping.",
+					"delivery": "steer",
+					"admittedSeq": 9,
+					"tail": 9,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": 12,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run the stubborn command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Queued before the stop.",
+					"delivery": "followUp",
+					"admittedSeq": 8,
+					"tail": 8,
+					"promotedSeq": 20
+				},
+				{
+					"text": "Sent while stopping.",
+					"delivery": "steer",
+					"admittedSeq": 9,
+					"tail": 9,
+					"promotedSeq": 15
+				},
+				{
+					"text": "Next.",
+					"delivery": "steer",
+					"admittedSeq": 13,
+					"tail": 13,
+					"promotedSeq": 16
+				}
+			]
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run the stubborn command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run the stubborn command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool Execution Interrupted"
+			},
+			{
+				"role": "user",
+				"text": "Sent while stopping."
+			},
+			{
+				"role": "user",
+				"text": "Next."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run the stubborn command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool Execution Interrupted"
+			},
+			{
+				"role": "user",
+				"text": "Sent while stopping."
+			},
+			{
+				"role": "user",
+				"text": "Next."
+			},
+			{
+				"role": "assistant",
+				"text": "Answer 1."
+			},
+			{
+				"role": "user",
+				"text": "Queued before the stop."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.truncated.json b/packages/codework/test/__artifacts__/recovery.truncated.json
index 6da9d032..45823938 100644
--- a/packages/codework/test/__artifacts__/recovery.truncated.json
+++ b/packages/codework/test/__artifacts__/recovery.truncated.json
@@ -118,7 +118,7 @@
 			"reason": "truncated",
 			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
 		},
-		"execution": null
+		"head": 14
 	},
 	"requests": [
 		[
diff --git a/packages/codework/test/__artifacts__/server.cli-threads.json b/packages/codework/test/__artifacts__/server.cli-threads.json
index ec493d82..38a6af0d 100644
--- a/packages/codework/test/__artifacts__/server.cli-threads.json
+++ b/packages/codework/test/__artifacts__/server.cli-threads.json
@@ -13,7 +13,7 @@
 	},
 	"list": {
 		"status": 0,
-		"stdout": "<before>  fork of <main>  openai/gpt-6-luna  0 tok $0.0000  (untitled)\n<at>  fork of <main>  openai/gpt-6-luna  2 tok $0.0000  branch\n<main>  main                                              openai/gpt-6-luna  2 tok $0.0000  hello\n"
+		"stdout": "<at>  fork of <main>  openai/gpt-6-luna  2 tok $0.0000  branch\n<before>  fork of <main>  openai/gpt-6-luna  0 tok $0.0000  (untitled)\n<main>  main                                              openai/gpt-6-luna  2 tok $0.0000  hello\n"
 	},
 	"listJson": [
 		{
diff --git a/packages/codework/test/__artifacts__/sync.index.json b/packages/codework/test/__artifacts__/sync.index.json
index b4ad102f..addaed73 100644
--- a/packages/codework/test/__artifacts__/sync.index.json
+++ b/packages/codework/test/__artifacts__/sync.index.json
@@ -34,23 +34,6 @@
 		"rev": "<rev>"
 	},
 	"snapshot": [
-		{
-			"_tag": "Session",
-			"session": {
-				"id": "<session>",
-				"spaceId": "<space>",
-				"slug": "<slug>",
-				"directory": "<home>",
-				"project": {
-					"id": "<project>",
-					"name": "Beta"
-				},
-				"createdAt": "<time>",
-				"updatedAt": "<time>",
-				"mainThreadId": "<main>"
-			},
-			"rev": "<rev 0>"
-		},
 		{
 			"_tag": "Thread",
 			"thread": {
@@ -80,6 +63,23 @@
 				"createdAt": "<time>",
 				"sessionId": "<session>"
 			},
+			"rev": "<rev 0>"
+		},
+		{
+			"_tag": "Session",
+			"session": {
+				"id": "<session>",
+				"spaceId": "<space>",
+				"slug": "<slug>",
+				"directory": "<home>",
+				"project": {
+					"id": "<project>",
+					"name": "Beta"
+				},
+				"createdAt": "<time>",
+				"updatedAt": "<time>",
+				"mainThreadId": "<main>"
+			},
 			"rev": "<rev 1>"
 		},
 		{
@@ -107,7 +107,7 @@
 				"createdAt": "<time>",
 				"sessionId": "<session>"
 			},
-			"rev": "<rev 2>"
+			"rev": "<rev 1>"
 		},
 		{
 			"_tag": "Project",
@@ -118,7 +118,7 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Space",
@@ -131,18 +131,18 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Removed",
 			"kind": "session",
 			"id": "<doomed>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		},
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		}
 	],
 	"resumed": [
@@ -155,7 +155,7 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Space",
@@ -168,18 +168,18 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Removed",
 			"kind": "session",
 			"id": "<doomed>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		},
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		}
 	]
 }
diff --git a/packages/codework/test/__artifacts__/sync.thread.json b/packages/codework/test/__artifacts__/sync.thread.json
index c5724a60..50148d8c 100644
--- a/packages/codework/test/__artifacts__/sync.thread.json
+++ b/packages/codework/test/__artifacts__/sync.thread.json
@@ -195,7 +195,7 @@
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 8>"
+			"rev": "<rev 7>"
 		}
 	],
 	"settled": [
@@ -221,7 +221,7 @@
 				],
 				"size": 89
 			},
-			"rev": "<rev 9>"
+			"rev": "<rev 8>"
 		},
 		{
 			"_tag": "Entry",
@@ -241,7 +241,7 @@
 				],
 				"size": 38
 			},
-			"rev": "<rev 10>"
+			"rev": "<rev 9>"
 		},
 		{
 			"_tag": "Inbox",
@@ -253,7 +253,7 @@
 				"createdAt": "<time>"
 			},
 			"state": "promoted",
-			"rev": "<rev 10>"
+			"rev": "<rev 9>"
 		},
 		{
 			"_tag": "Entry",
@@ -273,12 +273,12 @@
 				],
 				"size": 35
 			},
-			"rev": "<rev 11>"
+			"rev": "<rev 10>"
 		},
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 12>"
+			"rev": "<rev 11>"
 		}
 	],
 	"streamed": [
@@ -354,7 +354,7 @@
 				],
 				"size": 89
 			},
-			"rev": "<rev 9>"
+			"rev": "<rev 8>"
 		}
 	],
 	"otherThread": {
diff --git a/packages/codework/test/__artifacts__/sync.updated.json b/packages/codework/test/__artifacts__/sync.updated.json
new file mode 100644
index 00000000..218b670e
--- /dev/null
+++ b/packages/codework/test/__artifacts__/sync.updated.json
@@ -0,0 +1,29 @@
+[
+	{
+		"step": "link the session",
+		"session": true,
+		"main": false
+	},
+	{
+		"step": "configure the main thread",
+		"session": false,
+		"main": true
+	},
+	{
+		"step": "prompt the main thread",
+		"session": false,
+		"main": true
+	},
+	{
+		"step": "fork the main thread",
+		"session": true,
+		"main": false,
+		"fork": "new"
+	},
+	{
+		"step": "prompt the fork",
+		"session": false,
+		"main": false,
+		"fork": true
+	}
+]
diff --git a/packages/codework/test/cli.test.ts b/packages/codework/test/cli.test.ts
index e9778904..ac59fb4d 100644
--- a/packages/codework/test/cli.test.ts
+++ b/packages/codework/test/cli.test.ts
@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it, onTestFinished } from "vite-plus/test";
-import { runCli, truncating, writeSettings } from "./fixtures/cli.ts";
+import { runCli, serveCli, streaming, toolCalls, truncating, writeSettings } from "./fixtures/cli.ts";
 
 const cli = fileURLToPath(new URL("../src/index.ts", import.meta.url));
 const models = fileURLToPath(new URL("../../../models.gen.json", import.meta.url));
@@ -480,6 +480,29 @@ describe("codework CLI", () => {
 		).toMatchFileSnapshot("./__artifacts__/cli.truncated.json");
 	}, 60_000);
 
+	// A run ends with `session.run.failed`, never a success: a remote run must take that as its end.
+	it("reports a remote run ended by replies cut off with tool calls, and exits 1", async () => {
+		const home = mkdtempSync(join(tmpdir(), "codework-cli-run-failed-"));
+		onTestFinished(() => rmSync(home, { recursive: true, force: true }));
+		const fake = await streaming((_body, response) => {
+			response.send(toolCalls([{ name: "bash", arguments: { command: "echo cut" } }]));
+			response.finish("length");
+		});
+		writeSettings(home, fake.url);
+		const env = { ...process.env, HOME: home, CODEWORK_MODELS_FILE: models };
+		const server = await serveCli(["--home", home, "--user-config-dir", home], { cwd: home, env });
+
+		const result = await runCli(["run", "--server", server.url, "Run a long command."], { cwd: home, env });
+
+		expect(result.status, result.stderr).toBe(1);
+		expect(fake.requests).toHaveLength(2);
+		const message = "The response hit the output token limit with tool calls 2 times in a row; the run is ended";
+		expect(result.stderr, result.stderr).toContain(message);
+		await expect(
+			`${JSON.stringify({ status: result.status, stderr: result.stderr.slice(result.stderr.indexOf("error")) }, null, "\t")}\n`,
+		).toMatchFileSnapshot("./__artifacts__/cli.run-failed.json");
+	}, 60_000);
+
 	it("reports a failed refresh", () => {
 		const result = runIsolated(
 			{ CODEWORK_MODELS_FILE: undefined, CODEWORK_CATALOG_URL: "http://127.0.0.1:1/v1/models.json" },
diff --git a/packages/codework/test/client.test.ts b/packages/codework/test/client.test.ts
new file mode 100644
index 00000000..b149eb6e
--- /dev/null
+++ b/packages/codework/test/client.test.ts
@@ -0,0 +1,83 @@
+import { EventList, EventSchema, PromptSchema, Session } from "@codeworksh/harness/effect";
+import { DateTime, Effect, Exit, Queue, Stream } from "effect";
+import { describe, expect, it } from "vite-plus/test";
+import { Client } from "../src/server/client.ts";
+import { Envelope, type EventEnvelope } from "../src/server/envelope.ts";
+
+/*
+ * Notifications of one thread may arrive out of log order: a prompt's admission is published by the
+ * RPC that sent it, a run's events by the run. A real server cannot be made to reorder them on
+ * demand, so a stub delivers them in the order under test.
+ */
+
+const sessionId = Session.SessionSchema.ID.create();
+const threadId = Session.ThreadSchema.ID.create();
+const durable = (seq: number) => ({ aggregateId: sessionId, seq, version: 1 });
+
+const envelope = (type: string, seq: number, data: Record<string, unknown>) =>
+	Envelope.encode({
+		id: EventSchema.ID.create(),
+		type,
+		durable: durable(seq),
+		data: { sessionId, threadId, timestamp: DateTime.makeUnsafe(seq), ...data },
+	} as EventSchema.Payload);
+
+/** A client whose server answers its prompt with `events`, delivered in the order given. */
+const stub = (
+	events: (messageId: Session.SessionMessageSchema.ID) => ReadonlyArray<ReturnType<typeof Envelope.encode>>,
+) =>
+	Effect.gen(function* () {
+		const queue = yield* Queue.unbounded<EventEnvelope>();
+		yield* Queue.offer(
+			queue,
+			yield* Envelope.encode({ id: EventSchema.ID.create(), type: Envelope.Connected.type, data: {} }),
+		);
+		const rpc = {
+			"event.subscribe": () => Stream.fromQueue(queue),
+			"thread.prompt": ({ id }: { readonly id: Session.SessionMessageSchema.ID }) =>
+				Effect.forEach(events(id), (next) => Effect.flatMap(next, (one) => Queue.offer(queue, one))).pipe(
+					Effect.orDie,
+					Effect.as({ threadId }),
+				),
+			"thread.wait": () => Effect.void,
+			"thread.message": () => Effect.succeed({ found: false }),
+		};
+		return rpc as unknown as Client.Client;
+	});
+
+const admitted = (messageId: Session.SessionMessageSchema.ID, seq: number) =>
+	envelope(EventList.PromptAdmitted.type, seq, {
+		messageId,
+		prompt: PromptSchema.Prompt.fromText("ours"),
+		delivery: "followUp",
+	});
+const started = (seq: number) => envelope(EventList.ExecutionStarted.type, seq, { resumed: false });
+const failed = (seq: number) =>
+	envelope(EventList.ExecutionFailed.type, seq, { error: { type: "provider", message: "their run failed" } });
+
+const run = (events: Parameters<typeof stub>[0]) =>
+	Effect.gen(function* () {
+		const rpc = yield* stub(events);
+		return yield* Client.run(rpc, { sessionId, threadId, text: "ours" }, () => Effect.void).pipe(Effect.exit);
+	}).pipe(Effect.timeout("5 seconds"), Effect.runPromise);
+
+const failure = (exit: Exit.Exit<void, unknown>) =>
+	Exit.isFailure(exit) ? (exit.cause.reasons[0] as { readonly error?: unknown } | undefined)?.error : undefined;
+
+describe("Client.run attribution", () => {
+	// Another client's run started at 10 and failed at 12; our prompt was admitted at 11, between them.
+	it("does not hang or adopt another run's failure notified before its own admission", async () => {
+		const exit = await run((id) => [started(10), failed(12), admitted(id, 11)]);
+		expect(failure(exit)).toMatchObject({ type: "unknown", message: "Prompt was not promoted" });
+	});
+
+	it("does not adopt another run's failure when its start is notified after the admission", async () => {
+		const exit = await run((id) => [admitted(id, 11), started(10), failed(12)]);
+		expect(failure(exit)).toMatchObject({ type: "unknown", message: "Prompt was not promoted" });
+	});
+
+	it("adopts the failure of the run its prompt woke, before promoting it", async () => {
+		const exit = await run((id) => [admitted(id, 11), started(12), failed(13)]);
+		expect(failure(exit)).toMatchObject({ type: "provider", message: "their run failed" });
+	});
+});
diff --git a/packages/codework/test/fixtures/cli.ts b/packages/codework/test/fixtures/cli.ts
index a4e922d7..e9b47dfc 100644
--- a/packages/codework/test/fixtures/cli.ts
+++ b/packages/codework/test/fixtures/cli.ts
@@ -179,6 +179,8 @@ export interface Served {
 	readonly url: string;
 	/** SIGKILLs the server, as a host dying would, and resolves once it is gone. */
 	readonly kill: () => Promise<void>;
+	/** SIGTERMs the server, a clean shutdown, and resolves once it is gone. */
+	readonly stop: () => Promise<void>;
 }
 
 /** Starts `codework serve` from source on an ephemeral port; resolves once it listens. */
@@ -192,10 +194,11 @@ export const serveCli = (
 			env: options.env,
 		});
 		const exited = new Promise<void>((done) => child.on("exit", () => done()));
-		const kill = () => {
-			if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+		const signal = (name: NodeJS.Signals) => () => {
+			if (child.exitCode === null && child.signalCode === null) child.kill(name);
 			return exited;
 		};
+		const kill = signal("SIGKILL");
 		onTestFinished(kill);
 		let output = "";
 		const deadline = setTimeout(() => {
@@ -207,7 +210,7 @@ export const serveCli = (
 			const url = /listening on (ws:\/\/\S+)/.exec(output)?.[1];
 			if (url === undefined) return;
 			clearTimeout(deadline);
-			resolve({ url, kill });
+			resolve({ url, kill, stop: signal("SIGTERM") });
 		};
 		child.stdout.on("data", listen);
 		child.stderr.on("data", (data: Buffer) => (output += data.toString("utf8")));
diff --git a/packages/codework/test/recovery.test.ts b/packages/codework/test/recovery.test.ts
index 6a3e0d30..8bfc8bdc 100644
--- a/packages/codework/test/recovery.test.ts
+++ b/packages/codework/test/recovery.test.ts
@@ -1,8 +1,8 @@
 /* @effect-diagnostics nodeBuiltinImport:off -- this suite writes its home and settings with node:fs. */
 /* @effect-diagnostics globalTimers:off -- polling for a dying server runs outside any Effect. */
 /* @effect-diagnostics globalDate:off -- so does its deadline. */
-import { Control } from "@codeworksh/harness/effect";
-import { Effect, Fiber, Layer, Stream } from "effect";
+import { Control, Session } from "@codeworksh/harness/effect";
+import { Effect, Fiber, Layer, Predicate, Stream } from "effect";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { DatabaseSync } from "node:sqlite";
@@ -35,6 +35,12 @@ const setup = (url: string, settings: object = {}) => {
 	return { home, project, start };
 };
 
+/** A connection that never opened sent nothing, so opening another is safe; a loaded host can be slow to accept. */
+const unopened = (error: unknown) =>
+	Predicate.isTagged(error, "RpcClientError") &&
+	Predicate.hasProperty(error, "reason") &&
+	Predicate.isTagged(error.reason, "SocketOpenError");
+
 /** One RPC exchange over its own connection. */
 const call = <A, E>(url: string, use: (rpc: Client.Client) => Effect.Effect<A, E>) =>
 	Effect.runPromise(
@@ -42,7 +48,7 @@ const call = <A, E>(url: string, use: (rpc: Client.Client) => Effect.Effect<A, E
 			const context = yield* Layer.build(Client.layer(url));
 			const rpc = yield* Client.make.pipe(Effect.provideContext(context));
 			return yield* use(rpc);
-		}).pipe(Effect.scoped),
+		}).pipe(Effect.scoped, Effect.retry({ times: 2, while: unopened })),
 	);
 
 type Ids = { readonly sessionId: Parameters<Client.Client["thread.wait"]>[0]["sessionId"] };
@@ -208,7 +214,7 @@ const runRow = (home: string, threadId: string, events: ReadonlyArray<EventEnvel
 	const db = new DatabaseSync(join(home, "data", "codework.db"));
 	const row = db
 		.prepare(
-			"SELECT run_state, run_state_at, run_started_at, run_ended_at, run_outcome, run_error, execution FROM thread WHERE id = ?",
+			"SELECT run_state, run_state_at, run_started_at, run_ended_at, run_outcome, run_error, head FROM thread WHERE id = ?",
 		)
 		.get(threadId)!;
 	db.close();
@@ -235,7 +241,7 @@ const runRow = (home: string, threadId: string, events: ReadonlyArray<EventEnvel
 		endedAt: at("run_ended_at", ends),
 		outcome: row["run_outcome"],
 		error: row["run_error"] === null ? null : JSON.parse(String(row["run_error"])),
-		execution: row["execution"],
+		head: row["head"],
 	};
 };
 
@@ -246,6 +252,34 @@ const endedRow = async (url: string, home: string, ids: Ids & { readonly threadI
 	return row;
 };
 
+/** Cuts the reply off at the output limit with a tool call, as a run that gets truncated sees it. */
+const truncate = (response: Reply) => {
+	response.send(toolCalls([{ name: "bash", arguments: { command: "echo cut" } }]));
+	response.finish("length");
+};
+
+/** The thread's head and restart count, and each prompt's tail, read from the database file. */
+const positions = (home: string, threadId: string) => {
+	const db = new DatabaseSync(join(home, "data", "codework.db"));
+	const thread = db.prepare("SELECT head, restarts FROM thread WHERE id = ?").get(threadId)!;
+	const prompts = db
+		.prepare(
+			"SELECT data, delivery, admitted_seq, tail, promoted_seq FROM inbox WHERE thread_id = ? ORDER BY admitted_seq",
+		)
+		.all(threadId)
+		.map((row) => ({
+			text: (JSON.parse(String(row["data"])) as { parts: ReadonlyArray<{ text?: string }> }).parts
+				.map((one) => one.text)
+				.join(""),
+			delivery: row["delivery"],
+			admittedSeq: row["admitted_seq"],
+			tail: row["tail"],
+			promotedSeq: row["promoted_seq"],
+		}));
+	db.close();
+	return { head: Number(thread["head"]), restarts: Number(thread["restarts"]), prompts };
+};
+
 describe("recovery after the host is killed", () => {
 	it("the stored run of a killed host is swept as a crash before clients connect, then resumed", async () => {
 		const resend = gate();
@@ -268,6 +302,8 @@ describe("recovery after the host is killed", () => {
 		record("succeeded", await log(first.url, ids));
 		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Second." }));
 		const inFlight = await logged(first.url, ids, "session.llm.started", 2);
+		// `llm.started` goes out before the request: killed sooner, the resend would take the hanging slot.
+		await until("the second request", () => fake.requests.length === 2);
 		record("in flight", inFlight);
 		await first.kill();
 		// What the dead host left: the run still open.
@@ -292,7 +328,7 @@ describe("recovery after the host is killed", () => {
 		);
 		// Swept first, resumed after, with nothing of the run in between.
 		expect(resumed).toBe(swept + 1);
-		expect(rows.find((row) => row.step === "resumed")).toMatchObject({ state: "running", execution: "running" });
+		expect(rows.find((row) => row.step === "resumed")).toMatchObject({ state: "running" });
 
 		const lifecycle = new Set([
 			"session.execution.started",
@@ -416,11 +452,14 @@ describe("recovery after the host is killed", () => {
 		await logged(first.url, ids, "session.llm.started");
 		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then this.", delivery: "followUp" }));
 		await logged(first.url, ids, "session.prompt.admitted", 2);
+		await until("the request", () => fake.requests.length === 1);
 		await first.kill();
 
 		// The one retry: the request is resent, and the host dies with it in flight again.
 		const second = await start();
 		await logged(second.url, ids, "session.llm.started", 2);
+		// `llm.started` goes out before the request: wait for it, or the kill can beat the resend.
+		await until("the resend", () => fake.requests.length === 2);
 		await second.kill();
 
 		const third = await start();
@@ -462,6 +501,7 @@ describe("recovery after the host is killed", () => {
 		// The first run, then a resume each until the limit: each dies with its request in flight.
 		for (let started = 1; started <= Control.RESTART_LIMIT; started++) {
 			await logged(server.url, ids, "session.llm.started", started);
+			await until(`request ${started}`, () => fake.requests.length === started);
 			await server.kill();
 			server = await start();
 		}
@@ -565,6 +605,287 @@ describe("recovery after the host is killed", () => {
 		).toMatchFileSnapshot("./__artifacts__/recovery.truncated.json");
 	}, 90_000);
 
+	it("prompts sent while a run fails are parked: a kill runs none of them, the next prompt runs them all", async () => {
+		const cut = gate();
+		const fake = await streaming((_body, response, index) => {
+			if (index === 0) return truncate(response);
+			// The second cut-off ends the run: held until the prompts are in.
+			if (index === 1) return void cut.opened.then(() => truncate(response));
+			answer(response, "Answered with the queue.");
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run a long command." }));
+		await logged(first.url, ids, "session.llm.started", 2);
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then answer this." }));
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "And this.", delivery: "followUp" }));
+		const queued = await call(first.url, (rpc) => rpc["thread.queue"](ids));
+		const moved = queued.entries.find((entry) => entry.text === "And this.")!;
+		// Moved to steer while the run is still failing: that wake is before the end too.
+		await call(first.url, (rpc) =>
+			rpc["thread.update"]({ ...ids, messageId: Session.SessionMessageSchema.ID.make(moved.id), delivery: "steer" }),
+		);
+		cut.open();
+		await logged(first.url, ids, "session.run.failed");
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		record("parked");
+		expect(fake.requests).toHaveLength(2);
+		await first.kill();
+
+		const second = await start();
+		const reopened = await call(second.url, (rpc) => rpc["thread.queue"](ids));
+		record("reopened");
+		expect(reopened.entries.map((entry) => [entry.delivery, entry.text])).toEqual([
+			["steer", "Then answer this."],
+			["steer", "And this."],
+		]);
+		await call(second.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Next." }));
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		record("next prompt");
+
+		// Nothing ran between the failure and the next prompt, which took the parked queue with it.
+		expect(fake.requests).toHaveLength(3);
+		const events = await log(second.url, ids);
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				// Read from the database file: head, and each prompt's tail, across the kill.
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.parked.json");
+	}, 90_000);
+
+	it("a prompt sent after a run failed runs, and is resumed after a kill", async () => {
+		const resend = gate();
+		const fake = await streaming((_body, response, index) => {
+			if (index <= 1) return truncate(response);
+			// The prompt's run, killed with its request in flight; then its resend.
+			if (index === 2) return hang(response);
+			void resend.opened.then(() => answer(response, "Answered after the kill."));
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run a long command." }));
+		await logged(first.url, ids, "session.run.failed");
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Now this." }));
+		await logged(first.url, ids, "session.llm.started", 3);
+		// `llm.started` goes out before the request: killed sooner, the resend would take the hanging slot.
+		await until("the prompt's request", () => fake.requests.length === 3);
+		record("in flight");
+		await first.kill();
+
+		const second = await start();
+		await logged(second.url, ids, "session.llm.started", 4);
+		record("resumed");
+		resend.open();
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		record("finished");
+
+		expect(fake.requests).toHaveLength(4);
+		expect(sent(fake.requests[3]!)).toEqual(sent(fake.requests[2]!));
+		const events = await log(second.url, ids);
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.after-failure.json");
+	}, 90_000);
+
+	it("a stop parks what was queued and what was sent while it wound down: a kill runs none, the next prompt runs all", async () => {
+		const marker = join(realpathSync(mkdtempSync(join(tmpdir(), "codework-recovery-marker-"))), "ran");
+		onTestFinished(() => rmSync(join(marker, ".."), { recursive: true, force: true }));
+		const fake = await streaming((_body, response, index) => {
+			if (index > 0) return answer(response, `Answer ${index}.`);
+			// Ignores SIGTERM, so the stop winds down for the whole force-kill grace.
+			response.send(
+				toolCalls([{ name: "bash", arguments: { command: `trap '' TERM; echo ran > ${marker}; sleep 20` } }]),
+			);
+			response.finish("tool_calls");
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run the stubborn command." }));
+		await until("the tool to run", () => existsSync(marker));
+		await call(first.url, (rpc) =>
+			rpc["thread.prompt"]({ ...ids, text: "Queued before the stop.", delivery: "followUp" }),
+		);
+		// Sent together on one connection: the prompt waits for no reply, so it lands inside the kill grace.
+		await call(first.url, (rpc) =>
+			Effect.all([rpc["thread.interrupt"](ids), rpc["thread.prompt"]({ ...ids, text: "Sent while stopping." })], {
+				concurrency: "unbounded",
+			}),
+		);
+		await logged(first.url, ids, "session.execution.interrupted");
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		record("stopped");
+		const stopped = await log(first.url, ids);
+		const seqOf = (type: string, text?: string) =>
+			stopped.find(
+				(event) =>
+					event.type === type && (text === undefined || (summary(event) as { text?: string }).text === text),
+			)!.durable!.seq;
+		// The prompt really landed while the stop wound down: after the stop was asked, before it ended.
+		expect(seqOf("session.prompt.admitted", "Sent while stopping.")).toBeLessThan(
+			seqOf("session.execution.interrupted"),
+		);
+		expect(fake.requests).toHaveLength(1);
+		await first.kill();
+
+		const second = await start();
+		const reopened = await call(second.url, (rpc) => rpc["thread.queue"](ids));
+		record("reopened");
+		expect(reopened.entries.map((entry) => entry.text)).toEqual(["Queued before the stop.", "Sent while stopping."]);
+		await call(second.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Next." }));
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		record("next prompt");
+
+		// Steers with the next prompt, the follow-up once they are answered.
+		expect(fake.requests.map((request) => sent(request).at(-1)?.text)).toEqual([
+			"Run the stubborn command.",
+			"Next.",
+			"Queued before the stop.",
+		]);
+		const events = await log(second.url, ids);
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.stop.json");
+	}, 90_000);
+
+	it("a parked prompt moved to steer runs now and is resumed after a kill; resending it changes nothing", async () => {
+		const cut = gate();
+		const resend = gate();
+		const fake = await streaming((_body, response, index) => {
+			if (index === 0) return truncate(response);
+			if (index === 1) return void cut.opened.then(() => truncate(response));
+			// The run the move started, killed with its request in flight; then its resend.
+			if (index === 2) return hang(response);
+			void resend.opened.then(() => answer(response, "Answered after the kill."));
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run a long command." }));
+		await logged(first.url, ids, "session.llm.started", 2);
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then this.", delivery: "followUp" }));
+		cut.open();
+		await logged(first.url, ids, "session.run.failed");
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		const [parked] = (await call(first.url, (rpc) => rpc["thread.queue"](ids))).entries;
+		const messageId = Session.SessionMessageSchema.ID.make(parked!.id);
+
+		// A retry of the same request is the same prompt: it stays parked.
+		await call(first.url, (rpc) =>
+			rpc["thread.prompt"]({ ...ids, id: messageId, text: "Then this.", delivery: "followUp" }),
+		);
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		record("resent");
+		expect(fake.requests).toHaveLength(2);
+
+		await call(first.url, (rpc) => rpc["thread.update"]({ ...ids, messageId, delivery: "steer" }));
+		await logged(first.url, ids, "session.llm.started", 3);
+		await until("the moved prompt's request", () => fake.requests.length === 3);
+		record("moved");
+		await first.kill();
+
+		const second = await start();
+		await logged(second.url, ids, "session.llm.started", 4);
+		resend.open();
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		record("finished");
+
+		expect(fake.requests).toHaveLength(4);
+		expect(sent(fake.requests[3]!)).toEqual(sent(fake.requests[2]!));
+		const events = await log(second.url, ids);
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.moved.json");
+	}, 90_000);
+
+	it("a run a clean shutdown stopped resumes without counting a restart", async () => {
+		const resend = gate();
+		const fake = await streaming((_body, response, index) => {
+			if (index === 0) return hang(response);
+			void resend.opened.then(() => answer(response, "Answered after the restart."));
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "First." }));
+		await logged(first.url, ids, "session.llm.started");
+		await until("the request", () => fake.requests.length === 1);
+		await first.stop();
+		const stopped = positions(home, ids.threadId);
+
+		const second = await start();
+		await logged(second.url, ids, "session.llm.started", 2);
+		await until("the resend", () => fake.requests.length === 2);
+		// Read while the resumed run is in flight: a run that completes resets the count either way.
+		const resumed = positions(home, ids.threadId);
+		resend.open();
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		const events = await log(second.url, ids);
+
+		expect(stopped.restarts).toBe(0);
+		expect(resumed.restarts).toBe(0);
+		expect(summary(events.find((event) => event.type === "session.execution.interrupted")!)).toEqual({
+			type: "session.execution.interrupted",
+			reason: "shutdown",
+		});
+		await expect(
+			artifact({
+				log: events
+					.filter((event) => event.type.startsWith("session.execution.") || event.type === "session.llm.started")
+					.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				stopped,
+				resumed,
+				finished: positions(home, ids.threadId),
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.shutdown.json");
+	}, 90_000);
+
 	it("a deferred tool loaded before the host died is still offered to the resent request", async () => {
 		const tools = (request: ChatRequest) => (request.tools ?? []).map((tool) => tool.function.name).sort();
 		const fake = await streaming((_body, response, index) => {
@@ -589,6 +910,7 @@ describe("recovery after the host is killed", () => {
 		const ids = { sessionId: created.session.id, threadId: created.id };
 		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Find the echo tool." }));
 		await logged(first.url, ids, "session.llm.started", 2);
+		await until("the second request", () => fake.requests.length === 2);
 		await first.kill();
 
 		const second = await start();
diff --git a/packages/codework/test/server.test.ts b/packages/codework/test/server.test.ts
index c56f21c0..136581c1 100644
--- a/packages/codework/test/server.test.ts
+++ b/packages/codework/test/server.test.ts
@@ -1017,7 +1017,7 @@ describe("WebSocket client", () => {
 				expect(`${JSON.stringify(artifact, null, "\t")}\n`).toMatchFileSnapshot("./__artifacts__/server.fork.json"),
 			));
 
-	it("does not adopt a failure that belongs to another client's prompt", () =>
+	it("leaves its prompt queued behind another client's failed run, without adopting that failure", () =>
 		Effect.gen(function* () {
 			const firstEntered = yield* Deferred.make<void>();
 			const release = yield* Deferred.make<void>();
@@ -1054,8 +1054,14 @@ describe("WebSocket client", () => {
 				}
 				yield* Deferred.succeed(release, undefined);
 
-				// The successor drain promotes ours; the remembered failure is dropped.
-				yield* Fiber.join(ours);
+				// Their run failing does not start the next one: ours stays queued, and their failure is not ours.
+				const exit = yield* Fiber.await(ours);
+				expect(exit).toMatchObject({
+					_tag: "Failure",
+					cause: { reasons: [{ error: { type: "unknown", message: "Prompt was not promoted" } }] },
+				});
+				const queued = yield* rpc["thread.queue"]({ sessionId: session.session.id, threadId: session.id });
+				expect(queued.entries.map((entry) => entry.text)).toEqual(["ours"]);
 			}).pipe(
 				Effect.scoped,
 				Effect.provide(
diff --git a/packages/codework/test/sync.test.ts b/packages/codework/test/sync.test.ts
index 266a228b..b037b660 100644
--- a/packages/codework/test/sync.test.ts
+++ b/packages/codework/test/sync.test.ts
@@ -1,6 +1,7 @@
 /* @effect-diagnostics nodeBuiltinImport:off -- starts the real server in a temporary home. */
 import { createAssistantMessageEventStream, type Message } from "@codeworksh/aikit";
 import { Effect, Layer, Queue, Stream } from "effect";
+import { Session } from "@codeworksh/harness/effect";
 import { HttpServer } from "effect/http";
 import { mkdtempSync, realpathSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -138,6 +139,103 @@ it("index.sync sends the index, resumes from a revision, and follows configure,
 	}
 }, 40_000);
 
+it("updatedAt moves a thread with any change to it or below it, and its session with its own row or a new thread", async () => {
+	const home = realpathSync(mkdtempSync(join(tmpdir(), "codework-sync-updated-")));
+	try {
+		const artifact = await Effect.gen(function* () {
+			const listener = yield* HttpServer.HttpServer;
+			if (listener.address._tag === "UnixPathAddress") return yield* Effect.die("Expected TCP listener");
+			const context = yield* Layer.build(Client.layer(`ws://127.0.0.1:${listener.address.port}/rpc/v1`));
+			const rpc = yield* Client.make.pipe(Effect.provideContext(context));
+
+			/** Every session's and thread's `updatedAt`, by id, as the index sends them. */
+			const times = Effect.gen(function* () {
+				const items = yield* rpc["index.sync"]({ after: 0 }).pipe(
+					Stream.takeUntil((item) => item._tag === "Synced"),
+					Stream.runCollect,
+				);
+				const at = new Map<string, number>();
+				for (const item of items) {
+					if (item._tag === "Session") at.set(item.session.id, item.session.updatedAt);
+					if (item._tag === "Thread") at.set(item.thread.id, item.thread.updatedAt);
+				}
+				return at;
+			});
+
+			const created = yield* rpc["session.create"]({ directory: home });
+			const sessionId = created.session.id;
+			const rows: Record<string, string> = { session: sessionId, main: created.id };
+			const steps: Array<Record<string, unknown>> = [];
+			let before = yield* times;
+			/** Runs `change` a clock tick after the last one, then records which rows it moved. */
+			const step = <A, E>(name: string, change: Effect.Effect<A, E>) =>
+				Effect.gen(function* () {
+					yield* Effect.sleep("5 millis");
+					const result = yield* change;
+					const after = yield* times;
+					const moved = Object.fromEntries(
+						Object.entries(rows).map(([row, id]) => {
+							const was = before.get(id);
+							return [row, was === undefined ? "new" : after.get(id)! > was];
+						}),
+					);
+					steps.push({ step: name, ...moved });
+					before = after;
+					return result;
+				});
+
+			yield* step("link the session", rpc["session.link"]({ sessionId, hostDir: Session.AbsolutePath.make(home) }));
+			yield* step(
+				"configure the main thread",
+				rpc["thread.configure"]({ sessionId, runtime: { thinkingLevel: "high" } }),
+			);
+			yield* step(
+				"prompt the main thread",
+				rpc["thread.prompt"]({ sessionId, text: "Main prompt" }).pipe(
+					Effect.andThen(rpc["thread.wait"]({ sessionId })),
+				),
+			);
+			const reply = (yield* rpc["thread.history"]({ sessionId })).entries.at(-1);
+			if (reply === undefined) return yield* Effect.die("main thread has no reply");
+			const fork = yield* rpc["thread.fork"]({ sessionId, entryId: reply.id }).pipe(
+				Effect.tap((forked) => Effect.sync(() => (rows["fork"] = forked.thread.id))),
+				(forking) => step("fork the main thread", forking),
+			);
+			yield* step(
+				"prompt the fork",
+				rpc["thread.prompt"]({ sessionId, threadId: fork.thread.id, text: "Fork prompt" }).pipe(
+					Effect.andThen(rpc["thread.wait"]({ sessionId, threadId: fork.thread.id })),
+				),
+			);
+
+			expect(steps).toEqual([
+				{ step: "link the session", session: true, main: false },
+				{ step: "configure the main thread", session: false, main: true },
+				{ step: "prompt the main thread", session: false, main: true },
+				{ step: "fork the main thread", session: true, main: false, fork: "new" },
+				{ step: "prompt the fork", session: false, main: false, fork: true },
+			]);
+			return steps;
+		}).pipe(
+			Effect.scoped,
+			Effect.provide(
+				Server.layer({
+					host: "127.0.0.1",
+					port: 0,
+					harness: { home, hostCwd: home, plugins: [], llm: immediateOpen() },
+				}),
+			),
+			Effect.timeout("30 seconds"),
+			Effect.runPromise,
+		);
+		await expect(`${JSON.stringify(artifact, null, "\t")}\n`).toMatchFileSnapshot(
+			"./__artifacts__/sync.updated.json",
+		);
+	} finally {
+		rmSync(home, { recursive: true, force: true });
+	}
+}, 40_000);
+
 interface Reply {
 	readonly thinking?: ReadonlyArray<string>;
 	readonly text: ReadonlyArray<string>;
diff --git a/packages/harness/src/control.ts b/packages/harness/src/control.ts
index c10435aa..54820869 100644
--- a/packages/harness/src/control.ts
+++ b/packages/harness/src/control.ts
@@ -101,16 +101,16 @@ export interface Interface {
 	/** Threads this process is currently draining. */
 	readonly active: Effect.Effect<ReadonlySet<ThreadSchema.ID>>;
 	/**
-	 * Resumes the runs the last process left unfinished, as the server starts. One a crash cut off
-	 * counts a restart, one a shutdown closed does not; at {@link RESTART_LIMIT} the run ends visibly
-	 * instead, the thread idle with its queue kept for the next prompt. Resolves once every resumed
-	 * run has settled.
+	 * Resumes the runs the last process left unfinished, as the server starts: a run a crash or a
+	 * shutdown cut off, or a prompt woken past the thread's head. A crash counts a restart, a shutdown
+	 * does not; at {@link RESTART_LIMIT} the run ends visibly instead, its queue parked for the next
+	 * prompt. Resolves once every resumed run has settled.
 	 */
 	readonly resumeUnfinished: Effect.Effect<void>;
 	/**
-	 * Ends every stored run the last process left open with a durable `execution.interrupted`:
-	 * `shutdown` where it closed the run, `crash` where it died in it. Runs as the server starts,
-	 * before it accepts connections and before {@link resumeUnfinished}.
+	 * Ends every stored run the last process left open with a durable `execution.interrupted`
+	 * `crash`: a shutdown ends its runs itself. Runs as the server starts, before it accepts
+	 * connections and before {@link resumeUnfinished}.
 	 */
 	readonly sweep: Effect.Effect<void>;
 	/** Prompts admitted but not yet in the conversation, steers and follow-ups, in admission order. */
@@ -142,9 +142,9 @@ export const layer = Layer.effect(
 		const events = yield* Event.Service;
 		const isLifecycleConflict = Schema.is(Inbox.LifecycleConflict);
 
-		// Marked before the wake, so a prompt accepted here survives a crash before its run starts.
-		const wake = (threadId: ThreadSchema.ID) =>
-			threads.markRunning(threadId).pipe(Effect.andThen(execution.wake(threadId)));
+		// Only a hint: the admission or move to steer already recorded the prompt's tail, which is what makes
+		// it run, now or after a crash.
+		const wake = (threadId: ThreadSchema.ID) => execution.wake(threadId);
 
 		const resolve = Effect.fn("Control.resolve")(function* (ref: ThreadRef) {
 			if (ref.threadId === undefined) {
@@ -215,7 +215,6 @@ export const layer = Layer.effect(
 
 		const resume = Effect.fn("Control.resume")(function* (threadId: ThreadSchema.ID) {
 			yield* requireThread(threadId);
-			yield* threads.markRunning(threadId);
 			yield* execution.resume(threadId);
 		});
 
@@ -278,6 +277,11 @@ export const layer = Layer.effect(
 				Effect.fnUntraced(function* (row) {
 					const threadId = ThreadSchema.ID.make(row.id);
 					if ((yield* execution.active).has(threadId)) return;
+					// No run was cut off, only a prompt woken past the head: it runs as its wake would have.
+					if (!(yield* threads.cutOff(threadId))) {
+						yield* execution.wake(threadId);
+						return yield* execution.awaitIdle(threadId);
+					}
 					// Claimed again here, not from the list: a stop since then cleared it, and must stand.
 					// Counted before resuming, so a crash inside the resumed run is counted too.
 					const restarts = yield* threads.claimRestart(threadId);
@@ -303,13 +307,13 @@ export const layer = Layer.effect(
 		}).pipe(Effect.withSpan("Control.resumeUnfinished"));
 
 		const sweep = Effect.gen(function* () {
+			// A shutdown ends its runs itself, so a run still open is one the process died in.
 			for (const row of yield* threads.open) {
-				const execution = Option.getOrUndefined(row.execution);
 				yield* events.publish(EventList.ExecutionInterrupted, {
 					timestamp: yield* DateTime.now,
 					sessionId: SessionSchema.ID.make(row.sessionId),
 					threadId: ThreadSchema.ID.make(row.id),
-					reason: execution === "closed" ? "shutdown" : "crash",
+					reason: "crash",
 				});
 			}
 		}).pipe(Effect.withSpan("Control.sweep"));
diff --git a/packages/harness/src/db/migrations.ts b/packages/harness/src/db/migrations.ts
index b05f982b..176d11e8 100644
--- a/packages/harness/src/db/migrations.ts
+++ b/packages/harness/src/db/migrations.ts
@@ -147,7 +147,6 @@ export const migrations = {
 				origin_entry_id    TEXT,
 				origin_call_id     TEXT,
 				title              TEXT,
-				execution          TEXT,
 				-- the run lifecycle, projected from the execution.* events; times are the events'
 				run_state          TEXT NOT NULL DEFAULT 'idle',
 				run_state_at       INTEGER,
@@ -157,6 +156,8 @@ export const migrations = {
 				run_error          TEXT,
 				restarts           INTEGER NOT NULL DEFAULT 0,
 				attempt            INTEGER,
+				-- the seq of the last run end that parks the queue; a pending prompt past it is runnable
+				head               INTEGER NOT NULL DEFAULT 0,
 				cost               REAL NOT NULL DEFAULT 0,
 				tokens_input       INTEGER NOT NULL DEFAULT 0,
 				tokens_output      INTEGER NOT NULL DEFAULT 0,
@@ -181,12 +182,13 @@ export const migrations = {
 		`;
 		yield* sql`CREATE UNIQUE INDEX thread_main_idx ON thread (session_id) WHERE origin_kind = 'main'`;
 		yield* sql`CREATE INDEX thread_origin_idx ON thread (origin_thread_id) WHERE origin_thread_id IS NOT NULL`;
+		// A session's threads by activity, which also orders sessions (session/session.ts).
+		yield* sql`CREATE INDEX thread_session_idx ON thread (session_id, updated_at)`;
 		// Call ids are unique per entry, not globally: one subagent per call of a thread.
 		yield* sql`
 			CREATE UNIQUE INDEX thread_call_idx ON thread (origin_thread_id, origin_call_id)
 			WHERE origin_call_id IS NOT NULL
 		`;
-		yield* sql`CREATE INDEX thread_running_idx ON thread (session_id) WHERE execution = 'running'`;
 
 		yield* sql`
 			CREATE TABLE entry (
@@ -249,6 +251,8 @@ export const migrations = {
 				data          TEXT NOT NULL,
 				delivery      TEXT NOT NULL,
 				admitted_seq  INTEGER NOT NULL,
+				-- the seq of its admission or latest move to steer: what wakes it
+				tail          INTEGER NOT NULL,
 				promoted_seq  INTEGER,
 				cancelled_seq INTEGER,
 				created_at    INTEGER NOT NULL,
@@ -296,6 +300,9 @@ export const migrations = {
 		yield* sql`CREATE INDEX thread_rev_idx ON thread (rev)`;
 		yield* sql`CREATE INDEX entry_thread_rev_idx ON entry (thread_id, rev)`;
 		yield* sql`CREATE INDEX inbox_thread_rev_idx ON inbox (thread_id, rev)`;
+		// What a write touched, for the threads it moves (db/store.ts).
+		yield* sql`CREATE INDEX entry_rev_idx ON entry (rev)`;
+		yield* sql`CREATE INDEX inbox_rev_idx ON inbox (rev)`;
 		// Every insert and update carries the current transaction's revision, so a write path that
 		// forgets fails loudly. A row written twice in one transaction keeps its rev, which this allows.
 		for (const table of ["project", "space", "session", "thread", "entry", "inbox"]) {
diff --git a/packages/harness/src/db/schema.sql.ts b/packages/harness/src/db/schema.sql.ts
index 46feae2d..a041addb 100644
--- a/packages/harness/src/db/schema.sql.ts
+++ b/packages/harness/src/db/schema.sql.ts
@@ -147,7 +147,6 @@ export class ThreadRow extends Model.Class<ThreadRow>("ThreadRow")({
 	originCallId: Model.FieldOption(Schema.String),
 	// Absent until the thread's first own prompt names it.
 	title: Model.FieldOption(Schema.String),
-	execution: Model.FieldOption(ThreadSchema.Execution),
 	// The run lifecycle, written only by the session projector (`Thread.projectRun`). `runStateAt` is
 	// when `runState` last changed; the rest describe the last run, absent before the first.
 	runState: Model.GeneratedByDb(ThreadSchema.RunState),
@@ -157,6 +156,9 @@ export class ThreadRow extends Model.Class<ThreadRow>("ThreadRow")({
 	runOutcome: Model.GeneratedByDb(Schema.OptionFromNullOr(ThreadSchema.RunOutcome)),
 	runError: Model.GeneratedByDb(Schema.OptionFromNullOr(Schema.fromJsonString(ThreadSchema.RunError))),
 	restarts: Model.GeneratedByDb(Schema.Int),
+	// The seq of the last run end that parks the queue (`run.failed`, `execution.failed`, a user stop),
+	// written only by the session projector. A pending prompt whose `tail` is past it is runnable.
+	head: Model.GeneratedByDb(NonNegativeInt),
 	// The 1-based number of the provider request in flight, from its start until its response ends, the
 	// turn commits or the run ends: still set on recovery, the host died with that request out.
 	attempt: Model.FieldOption(Schema.Int),
@@ -181,6 +183,9 @@ export class InboxRow extends Model.Class<InboxRow>("InboxRow")({
 	data: Model.JsonFromString(Prompt),
 	delivery: Schema.Literals(inputDeliveries),
 	admittedSeq: Schema.Int,
+	// The seq of its admission, or of its latest move to the steer lane: what wakes it. Past the
+	// thread's `head` it is runnable; at or before it, parked until the next prompt.
+	tail: NonNegativeInt,
 	promotedSeq: Model.FieldOption(Schema.Int),
 	cancelledSeq: Model.FieldOption(Schema.Int),
 	createdAt: Model.DateTimeInsertFromNumber,
diff --git a/packages/harness/src/db/store.ts b/packages/harness/src/db/store.ts
index b950f13f..bda9462b 100644
--- a/packages/harness/src/db/store.ts
+++ b/packages/harness/src/db/store.ts
@@ -1,4 +1,4 @@
-import { Context, Effect, Layer, PubSub, type Scope } from "effect";
+import { Clock, Context, Effect, Layer, PubSub, type Scope } from "effect";
 import { SqlClient, type SqlError } from "effect/sql";
 
 /** The store's identity and its last revision taken. */
@@ -10,8 +10,9 @@ export interface Head {
 export interface Interface {
 	/**
 	 * Runs `effect` as one write transaction, or inside the enclosing one. Every write to project,
-	 * space, session, thread, entry or inbox goes through it. After a commit that took a revision,
-	 * the doorbell rings.
+	 * space, session, thread, entry or inbox goes through it. Before a commit that took a revision, it
+	 * moves `updated_at` of every thread written in it or below it, and of every session row written in
+	 * it; after the commit, the doorbell rings.
 	 */
 	readonly write: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError.SqlError, R>;
 	/** The enclosing write's revision, taken on first use; every row the write touches is stamped with it. */
@@ -39,12 +40,32 @@ export const layer = Layer.effect(
 
 		const ring = Effect.forEach(wakes, (wake) => PubSub.publish(wake, undefined), { discard: true });
 
+		// Rows a write touches carry its revision, so they say what changed: a thread moves with any change
+		// to itself or below it, and the move is stamped too, so sync sends it. A session moves only with its
+		// own row: its activity is its newest thread's, read at query time.
+		const touch = (rev: number) =>
+			Effect.gen(function* () {
+				const now = yield* Clock.currentTimeMillis;
+				yield* sql`
+					UPDATE thread SET updated_at = ${now}, rev = ${rev}
+					WHERE rev = ${rev}
+						OR id IN (SELECT thread_id FROM entry WHERE rev = ${rev} UNION SELECT thread_id FROM inbox WHERE rev = ${rev})
+				`;
+				yield* sql`
+					UPDATE session SET updated_at = ${now} WHERE rev = ${rev}
+				`;
+			});
+
 		const write = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E | SqlError.SqlError, R> =>
 			Effect.uninterruptibleMask((restore) =>
 				Effect.gen(function* () {
 					if ((yield* Taken) !== undefined) return yield* restore(effect);
 					const taken: { rev: number | undefined } = { rev: undefined };
-					const result = yield* sql.withTransaction(restore(Effect.provideService(effect, Taken, taken)));
+					const result = yield* sql.withTransaction(
+						restore(Effect.provideService(effect, Taken, taken)).pipe(
+							Effect.tap(() => (taken.rev === undefined ? Effect.void : touch(taken.rev))),
+						),
+					);
 					if (taken.rev !== undefined) yield* ring;
 					return result;
 				}),
diff --git a/packages/harness/src/event/list.ts b/packages/harness/src/event/list.ts
index b81deb50..00d07336 100644
--- a/packages/harness/src/event/list.ts
+++ b/packages/harness/src/event/list.ts
@@ -322,11 +322,11 @@ export const ToolSettled = EventSchema.define({
 export type ToolSettled = typeof ToolSettled.Type;
 
 /**
- * Lifecycle of a process-owned busy period. One `started` and exactly one
- * terminal per period, covering every drain the period coalesced. The terminals
- * are separate types rather than one event with a status, so each carries only
- * what its outcome actually has: a failure has an error, an interruption has a
- * reason, and a success has neither.
+ * Lifecycle of one run: a drain that ran, from `started`, published before it promotes anything, to
+ * exactly one terminal (or `session.run.failed`). The terminals are separate types rather than one
+ * event with a status, so each carries only what its outcome actually has: a failure has an error,
+ * an interruption has a reason, and a success has neither. A failure or a user stop parks the queue;
+ * see `thread.head`.
  */
 export const ExecutionStarted = EventSchema.define({
 	type: "session.execution.started",
@@ -360,7 +360,7 @@ export type ExecutionInterrupted = typeof ExecutionInterrupted.Type;
 /**
  * A run ended without its answer and is not resumed: the host died in it too often (`crashloop`),
  * with no retry left for the request it cut off (`interrupted`), or replies kept hitting the output
- * limit with tool calls (`truncated`). Queued prompts stay queued.
+ * limit with tool calls (`truncated`). Queued prompts stay parked until the next prompt.
  */
 export const RunFailed = EventSchema.define({
 	type: "session.run.failed",
diff --git a/packages/harness/src/inbox/inbox.ts b/packages/harness/src/inbox/inbox.ts
index e2749d4e..d8298180 100644
--- a/packages/harness/src/inbox/inbox.ts
+++ b/packages/harness/src/inbox/inbox.ts
@@ -90,6 +90,8 @@ export interface ProjectCancelledInput {
 export interface ProjectUpdatedInput {
 	readonly id: SessionMessageSchema.ID;
 	readonly threadId: ThreadSchema.ID;
+	/** The update event's seq: a move to the steer lane wakes the prompt there. */
+	readonly seq: number;
 	readonly prompt?: Prompt | undefined;
 	readonly delivery?: Delivery | undefined;
 }
@@ -184,12 +186,15 @@ export const make = Effect.gen(function* () {
 			threadId: Schema.String,
 			data: Schema.NullOr(Schema.fromJsonString(Prompt)),
 			delivery: Schema.NullOr(Delivery),
+			tail: Schema.NullOr(Schema.Int),
 			rev: Schema.Int,
 		}),
 		Result: Schema.Struct({ id: Schema.String }),
 		// A null field is one the update left alone.
-		execute: ({ id, threadId, data, delivery, rev }) => sql`
-      UPDATE inbox SET data = COALESCE(${data}, data), delivery = COALESCE(${delivery}, delivery), rev = ${rev}
+		execute: ({ id, threadId, data, delivery, tail, rev }) => sql`
+      UPDATE inbox
+      SET data = COALESCE(${data}, data), delivery = COALESCE(${delivery}, delivery), tail = COALESCE(${tail}, tail),
+        rev = ${rev}
       WHERE id = ${id} AND thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NULL
       RETURNING id
     `,
@@ -209,8 +214,8 @@ export const make = Effect.gen(function* () {
 		Result: Schema.Struct({ id: Schema.String }),
 		execute: ({ id, threadId, data, delivery, admittedSeq, createdAt, rev }) => sql`
       UPDATE inbox
-      SET data = ${data}, delivery = ${delivery}, admitted_seq = ${admittedSeq}, created_at = ${createdAt},
-        cancelled_seq = NULL, rev = ${rev}
+      SET data = ${data}, delivery = ${delivery}, admitted_seq = ${admittedSeq}, tail = ${admittedSeq},
+        created_at = ${createdAt}, cancelled_seq = NULL, rev = ${rev}
       WHERE id = ${id} AND thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NOT NULL
       RETURNING id
     `,
@@ -362,6 +367,7 @@ export const make = Effect.gen(function* () {
 				data: input.prompt,
 				delivery: input.delivery,
 				admittedSeq: input.admittedSeq,
+				tail: input.admittedSeq,
 				promotedSeq: Option.none(),
 				cancelledSeq: Option.none(),
 				createdAt: VariantSchema.Override(input.timeCreated),
@@ -421,6 +427,7 @@ export const make = Effect.gen(function* () {
 				data: input.prompt,
 				delivery: input.delivery,
 				admittedSeq: input.promotedSeq,
+				tail: input.promotedSeq,
 				promotedSeq: Option.some(input.promotedSeq),
 				cancelledSeq: Option.none(),
 				createdAt: VariantSchema.Override(input.timeCreated),
@@ -451,6 +458,7 @@ export const make = Effect.gen(function* () {
 				threadId: input.threadId,
 				data: input.prompt ?? null,
 				delivery: input.delivery ?? null,
+				tail: input.delivery === "steer" ? input.seq : null,
 				rev: yield* store.rev,
 			});
 			if (updated.length > 0) return;
@@ -481,8 +489,11 @@ export const make = Effect.gen(function* () {
 		if (Option.isNone(stored)) return Option.none<Admitted>();
 		const prompt =
 			patch.prompt === undefined || Prompt.equivalence(patch.prompt, stored.value.prompt) ? undefined : patch.prompt;
+		// Asking for the steer lane is recorded even for a steer: it wakes the prompt, so a parked one runs now.
 		const delivery =
-			patch.delivery === undefined || patch.delivery === stored.value.delivery ? undefined : patch.delivery;
+			patch.delivery === undefined || (patch.delivery === stored.value.delivery && patch.delivery !== "steer")
+				? undefined
+				: patch.delivery;
 		if (prompt === undefined && delivery === undefined) return stored;
 		const timestamp = yield* DateTime.now;
 		return yield* events
diff --git a/packages/harness/src/runner/coordinator.ts b/packages/harness/src/runner/coordinator.ts
index ade808fb..3cc994e7 100644
--- a/packages/harness/src/runner/coordinator.ts
+++ b/packages/harness/src/runner/coordinator.ts
@@ -41,8 +41,6 @@ type Execution<E, Reason> = {
 export const make = <Key, E, Reason = never>(options: {
 	/** Actual work serialized by the coordinator. */
 	readonly drain: (key: Key, force: boolean) => Effect.Effect<void, E>;
-	/** Runs once when a busy period begins, before its first drain. */
-	readonly started?: (key: Key) => Effect.Effect<void>;
 	/** Runs after the final drain exits and before joiners are released. */
 	readonly settled?: (key: Key, exit: Exit.Exit<void, E>, reason?: Reason) => Effect.Effect<void>;
 }): Effect.Effect<Coordinator<Key, E, Reason>, never, Scope.Scope> =>
@@ -73,7 +71,6 @@ export const make = <Key, E, Reason = never>(options: {
 			// trampolines successor executions after synchronous failures.
 			execution.owner = fork(
 				Effect.yieldNow.pipe(
-					Effect.andThen(Effect.uninterruptible(options.started?.(key) ?? Effect.void)),
 					Effect.andThen(loop(key, execution, force)),
 					Effect.onExit((exit) =>
 						Effect.sync(() => {
diff --git a/packages/harness/src/runner/execute.ts b/packages/harness/src/runner/execute.ts
index f768eb22..b3a593ec 100644
--- a/packages/harness/src/runner/execute.ts
+++ b/packages/harness/src/runner/execute.ts
@@ -71,82 +71,82 @@ export const layer = Layer.effect(
 				yield* publish({ sessionId: sessionId.value, threadId, timestamp: yield* DateTime.now });
 			});
 
-		// Threads being recovered: their run neither marks the thread nor runs once it is unmarked.
+		// Threads being recovered: their run is announced as resumed.
 		const recovering = new Set<ThreadId>();
 		// Recovered threads whose run is ended instead of resumed, with the message it ends with.
 		const abandoning = new Map<ThreadId, string>();
-		// The log position at each user stop: prompts admitted after it are new work, not parked by it.
-		const stoppedAt = new Map<ThreadId, number>();
-		// Threads whose last drain ended its run itself, by publishing `session.run.failed`.
-		const ended = new Set<ThreadId>();
+		// Threads whose current drain opened a run with `execution.started`.
+		const opened = new Set<ThreadId>();
 
 		const coordinator = yield* RunCoordinator.make<ThreadId, Runner.RunError, SessionSchema.InterruptReason>({
-			// The run is recorded unfinished before it starts, so a process dying anywhere in it
-			// leaves the thread for the next server start to resume. A recovered one already is.
-			started: (threadId) =>
-				Effect.suspend(() => {
-					const resumed = recovering.has(threadId);
-					return reportLifecycle(
-						threadId,
-						(resumed ? Effect.void : threads.markRunning(threadId)).pipe(
-							Effect.andThen(
-								publishLifecycle(threadId, (base) =>
-									events.publish(EventList.ExecutionStarted, { ...base, resumed }),
-								),
-							),
-						),
-					);
-				}),
-			// One terminal per busy period, covering every drain it coalesced.
+			// A drain that failed or was interrupted ends the busy period, and the run it opened ends here unless
+			// it already published its own terminal: the stored run state says which, so a run ends exactly once.
 			settled: (threadId, exit, reason) =>
 				reportLifecycle(
 					threadId,
 					Effect.gen(function* () {
-						// A shutdown leaves the run to resume on the next start; a user stop or any other end
-						// finishes it.
-						const interrupted = Exit.isFailure(exit) && Cause.hasInterruptsOnly(exit.cause);
-						const stop = stoppedAt.get(threadId);
-						stoppedAt.delete(threadId);
-						yield* threads.endExecution(
-							threadId,
-							!interrupted ? "finished" : reason === "user" ? "stopped" : "closed",
-							stop,
+						const ran = opened.delete(threadId);
+						if (Exit.isSuccess(exit)) return;
+						const interrupted = Cause.hasInterruptsOnly(exit.cause);
+						const thread = yield* threads.get(threadId);
+						if (Option.isNone(thread)) return;
+						// With no run open, before it opened or after it ended, a user stop is recorded only when
+						// something would otherwise still run, now or on the next start.
+						const open = ran && thread.value.runState !== "idle";
+						const stop = interrupted && reason === "user";
+						if (!open && !(stop && (yield* threads.resumable(threadId)))) return;
+						yield* publishLifecycle(threadId, (base) =>
+							interrupted
+								? // Nobody named a reason, so the process took the decision itself.
+									events.publish(EventList.ExecutionInterrupted, { ...base, reason: reason ?? "shutdown" })
+								: events.publish(EventList.ExecutionFailed, {
+										...base,
+										error: SessionFailure.fromCause(Cause.squash(exit.cause)),
+									}),
 						);
-						// One terminal per run: an abandoned run already ended with its failure and reason, which a
-						// success published after it would overwrite.
-						if (ended.delete(threadId) && Exit.isSuccess(exit)) return;
-						const sessionId = yield* sessionOf(threadId);
-						if (Option.isNone(sessionId)) return;
-						const base = { sessionId: sessionId.value, threadId, timestamp: yield* DateTime.now };
-						if (Exit.isSuccess(exit)) return yield* events.publish(EventList.ExecutionSucceeded, base);
-						if (Cause.hasInterruptsOnly(exit.cause))
-							// Nobody named a reason, so the process took the decision itself.
-							return yield* events.publish(EventList.ExecutionInterrupted, {
-								...base,
-								reason: reason ?? "shutdown",
-							});
-						return yield* events.publish(EventList.ExecutionFailed, {
-							...base,
-							error: SessionFailure.fromCause(Cause.squash(exit.cause)),
-						});
 					}),
 				),
+			// One run per drain that runs, opened before it promotes anything: a process dying anywhere in it
+			// leaves an open run, which the next server start sweeps as a crash and resumes.
 			drain: Effect.fnUntraced(function* (threadId: ThreadId, force) {
-				ended.delete(threadId);
-				const record = (outcome: Runner.Outcome) =>
-					Effect.sync(() => {
-						if (outcome === "ended") ended.add(threadId);
-					});
+				opened.delete(threadId);
 				const thread = yield* threads.get(threadId);
 				// Deleted with its session after something woke it: nothing is left to run.
 				if (Option.isNone(thread)) return;
 				const sessionId = thread.value.sessionId;
 				const recovered = recovering.delete(threadId);
-				if (recovered && Option.isNone(thread.value.execution)) return;
+				// A recovery claimed the thread before its drain: a stop since then must stand.
+				if (recovered && !(yield* threads.resumable(threadId))) return;
+				// The doorbell is only a hint: an unforced drain runs only for a prompt woken past the head.
+				if (!force && !(yield* threads.runnable(threadId))) return;
+				// Whole or not at all: a stop lands either before the run opened or on an open run.
+				yield* Effect.uninterruptible(
+					Effect.sync(() => opened.add(threadId)).pipe(
+						Effect.andThen(
+							reportLifecycle(
+								threadId,
+								publishLifecycle(threadId, (base) =>
+									events.publish(EventList.ExecutionStarted, { ...base, resumed: recovered }),
+								),
+							),
+						),
+					),
+				);
+				// `ended`: the run published its own terminal, `session.run.failed`. A stop arriving meanwhile
+				// waits for the success to land, so `settled` finds the run ended.
+				const close = (outcome: Runner.Outcome) =>
+					outcome === "ended"
+						? Effect.void
+						: Effect.uninterruptible(
+								reportLifecycle(
+									threadId,
+									publishLifecycle(threadId, (base) => events.publish(EventList.ExecutionSucceeded, base)),
+								),
+							);
 				// Only the drain the abandon itself started: one it joined is a live run, which must stand.
 				const abandoned = recovered && force ? abandoning.get(threadId) : undefined;
 				if (abandoned !== undefined)
-					return yield* runner.abandon({ threadId, message: abandoned }).pipe(Effect.flatMap(record));
+					return yield* runner.abandon({ threadId, message: abandoned }).pipe(Effect.flatMap(close));
 				// The thread's placement, else the session's space and directory. A placement names its
 				// space in a document no FK guards, so a space gone since is typed: `relink --thread`
 				// is the repair.
@@ -190,7 +190,7 @@ export const layer = Layer.effect(
 					yield* mcp.lease({ sessionId, threadId });
 					return yield* runner
 						.run({ threadId, force, recovered })
-						.pipe(Effect.provideContext(Context.merge(locationContext, mountContext)), Effect.flatMap(record));
+						.pipe(Effect.provideContext(Context.merge(locationContext, mountContext)), Effect.flatMap(close));
 				});
 
 				return yield* scopedRun.pipe(
@@ -205,16 +205,7 @@ export const layer = Layer.effect(
 		});
 
 		const interrupt: RunnerExecution.Interface["interrupt"] = (threadId, reason, options) =>
-			Effect.gen(function* () {
-				// The first stop of a run sets its position; a repeat while it settles keeps that one.
-				const sessionId = reason === "user" && !stoppedAt.has(threadId) ? yield* sessionOf(threadId) : undefined;
-				const recorded = sessionId !== undefined && Option.isSome(sessionId);
-				if (recorded) stoppedAt.set(threadId, yield* events.latestSequence(sessionId.value));
-				const accepted = yield* coordinator.interrupt(threadId, reason, options);
-				// Nothing was running, so no settlement will read the position this call set.
-				if (recorded && !accepted) stoppedAt.delete(threadId);
-				return accepted;
-			});
+			coordinator.interrupt(threadId, reason, options);
 
 		// Under the thread's execution like any run, so a prompt that wakes it meanwhile cannot heal
 		// the same draft.
diff --git a/packages/harness/src/runner/loop.ts b/packages/harness/src/runner/loop.ts
index d77256f1..6ba3d41a 100644
--- a/packages/harness/src/runner/loop.ts
+++ b/packages/harness/src/runner/loop.ts
@@ -258,7 +258,10 @@ export const layer = (options: Options = {}) =>
 				yield* Effect.sleep(Duration.millis(delayMs));
 			});
 
-			/** Ends a run that is not resumed, leaving the thread idle with its queue kept. */
+			/**
+			 * Ends a run that is not resumed. Its terminal parks the queue: a prompt woken before it waits for
+			 * the next one.
+			 */
 			const endRun = Effect.fn("Loop.endRun")(function* (
 				sessionId: SessionSchema.ID,
 				threadId: ThreadSchema.ID,
@@ -266,15 +269,12 @@ export const layer = (options: Options = {}) =>
 				message: string,
 			) {
 				yield* Effect.uninterruptible(
-					Effect.gen(function* () {
-						yield* events.publish(EventList.RunFailed, {
-							timestamp: yield* DateTime.now,
-							sessionId,
-							threadId,
-							reason,
-							message,
-						});
-						yield* threads.idle(threadId);
+					events.publish(EventList.RunFailed, {
+						timestamp: yield* DateTime.now,
+						sessionId,
+						threadId,
+						reason,
+						message,
 					}),
 				);
 				return "ended" as const;
diff --git a/packages/harness/src/session/projector.ts b/packages/harness/src/session/projector.ts
index e05cce11..adf99892 100644
--- a/packages/harness/src/session/projector.ts
+++ b/packages/harness/src/session/projector.ts
@@ -108,11 +108,14 @@ export const layer = Layer.effectDiscard(
 		);
 
 		yield* events.project(EventList.PromptUpdated, (event) =>
-			input.projectUpdated({
-				id: event.data.messageId,
-				threadId: event.data.threadId,
-				...(event.data.prompt === undefined ? {} : { prompt: event.data.prompt }),
-				...(event.data.delivery === undefined ? {} : { delivery: event.data.delivery }),
+			Effect.gen(function* () {
+				yield* input.projectUpdated({
+					id: event.data.messageId,
+					threadId: event.data.threadId,
+					seq: yield* seqOf(event),
+					...(event.data.prompt === undefined ? {} : { prompt: event.data.prompt }),
+					...(event.data.delivery === undefined ? {} : { delivery: event.data.delivery }),
+				});
 			}),
 		);
 
@@ -162,28 +165,41 @@ export const layer = Layer.effectDiscard(
 		yield* events.project(EventList.ExecutionStarted, ({ data }) =>
 			threads.projectRun(data.threadId, data.timestamp, { _tag: "started" }),
 		);
-		yield* events.project(EventList.ExecutionSucceeded, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, { _tag: "ended", outcome: "succeeded" }),
+		// A run's end settles the thread at the event's own seq: an unanswered end moves its head.
+		const ended = (
+			event: { readonly type: string; readonly durable?: { readonly seq: number } },
+			threadId: ThreadSchema.ID,
+			at: DateTime.Utc,
+			outcome: ThreadSchema.RunOutcome,
+			error?: ThreadSchema.RunError,
+		) =>
+			seqOf(event).pipe(
+				Effect.flatMap((seq) =>
+					threads.projectRun(threadId, at, {
+						_tag: "ended",
+						outcome,
+						seq,
+						...(error === undefined ? {} : { error }),
+					}),
+				),
+			);
+		yield* events.project(EventList.ExecutionSucceeded, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "succeeded"),
 		);
-		yield* events.project(EventList.ExecutionFailed, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, {
-				_tag: "ended",
-				outcome: "failed",
-				error: { _tag: "failed", error: data.error },
-			}),
+		yield* events.project(EventList.ExecutionFailed, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "failed", { _tag: "failed", error: event.data.error }),
 		);
-		yield* events.project(EventList.ExecutionInterrupted, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, {
-				_tag: "ended",
-				outcome: "interrupted",
-				error: { _tag: "interrupted", reason: data.reason },
+		yield* events.project(EventList.ExecutionInterrupted, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "interrupted", {
+				_tag: "interrupted",
+				reason: event.data.reason,
 			}),
 		);
-		yield* events.project(EventList.RunFailed, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, {
-				_tag: "ended",
-				outcome: "failed",
-				error: { _tag: "runFailed", reason: data.reason, message: data.message },
+		yield* events.project(EventList.RunFailed, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "failed", {
+				_tag: "runFailed",
+				reason: event.data.reason,
+				message: event.data.message,
 			}),
 		);
 
diff --git a/packages/harness/src/session/session.ts b/packages/harness/src/session/session.ts
index b0e3a51c..6ffc6ff2 100644
--- a/packages/harness/src/session/session.ts
+++ b/packages/harness/src/session/session.ts
@@ -240,6 +240,9 @@ export const layer = Layer.effect(
 			execute: (id) => sql`SELECT * FROM space WHERE id = ${id}`,
 		});
 
+		// A session's activity is its newest thread's: its own `updated_at` moves only with its row.
+		const activity = sql`(SELECT MAX(t.updated_at) FROM thread t WHERE t.session_id = s.id)`;
+
 		const selectByProject = SqlSchema.findAll({
 			Request: Schema.String,
 			Result: SessionRow,
@@ -247,20 +250,20 @@ export const layer = Layer.effect(
 				SELECT s.* FROM session s
 				JOIN space p ON p.id = s.space_id
 				WHERE p.project_id = ${projectId}
-				ORDER BY s.updated_at DESC
+				ORDER BY ${activity} DESC
 			`,
 		});
 
 		const selectBySpace = SqlSchema.findAll({
 			Request: Schema.String,
 			Result: SessionRow,
-			execute: (spaceId) => sql`SELECT * FROM session WHERE space_id = ${spaceId} ORDER BY updated_at DESC`,
+			execute: (spaceId) => sql`SELECT s.* FROM session s WHERE s.space_id = ${spaceId} ORDER BY ${activity} DESC`,
 		});
 
 		const selectAll = SqlSchema.findAll({
 			Request: Schema.Void,
 			Result: SessionRow,
-			execute: () => sql`SELECT * FROM session ORDER BY updated_at DESC`,
+			execute: () => sql`SELECT s.* FROM session s ORDER BY ${activity} DESC`,
 		});
 
 		const insertSession = SqlSchema.void({
@@ -268,8 +271,6 @@ export const layer = Layer.effect(
 			execute: (row) => sql`INSERT INTO session ${sql.insert(row)}`,
 		});
 
-		const epochNow = Effect.map(DateTime.now, DateTime.toEpochMillis);
-
 		const projectCreated = Effect.fn("Session.projectCreated")(
 			function* (data: EventList.SessionCreated["data"], seq: number) {
 				const row = yield* SessionRow.insert.makeEffect({
@@ -388,10 +389,9 @@ export const layer = Layer.effect(
 		}) {
 			const session = yield* findSession(input.sessionId).pipe(Effect.orDie);
 			if (Option.isNone(session)) return yield* new SessionNotFoundError({ sessionId: input.sessionId });
-			const now = yield* epochNow;
 			yield* Effect.gen(function* () {
 				yield* sql`
-					UPDATE session SET host_dir = ${input.hostDir}, updated_at = ${now}, rev = ${yield* store.rev}
+					UPDATE session SET host_dir = ${input.hostDir}, rev = ${yield* store.rev}
 					WHERE id = ${input.sessionId}
 				`;
 			}).pipe(store.write, Effect.orDie);
@@ -431,11 +431,9 @@ export const layer = Layer.effect(
 				);
 			if (!directoryWithin(target.value.location, directory)) return yield* reject("directory_outside_space");
 			if (input.threadId === undefined) {
-				const now = yield* epochNow;
 				yield* Effect.gen(function* () {
 					yield* sql`
-						UPDATE session SET space_id = ${input.spaceId}, directory = ${directory}, updated_at = ${now},
-							rev = ${yield* store.rev}
+						UPDATE session SET space_id = ${input.spaceId}, directory = ${directory}, rev = ${yield* store.rev}
 						WHERE id = ${input.sessionId}
 					`;
 				}).pipe(store.write, Effect.orDie);
diff --git a/packages/harness/src/thread/schema.ts b/packages/harness/src/thread/schema.ts
index 34d807ad..685958c0 100644
--- a/packages/harness/src/thread/schema.ts
+++ b/packages/harness/src/thread/schema.ts
@@ -24,14 +24,6 @@ export type Origin =
 	 */
 	| { readonly kind: "subagent"; readonly threadId: ThreadID; readonly callId: string; readonly entryId?: string };
 
-/**
- * A run left unfinished: `running` while one is in flight, and still after the process died during
- * it; `closed` once a shutdown stopped it. Either resumes when the server starts again; a run that
- * ended any other way leaves none.
- */
-export const Execution = Schema.Literals(["running", "closed"]);
-export type Execution = typeof Execution.Type;
-
 /**
  * Where the thread's run is, projected from its lifecycle events: `starting` from
  * `execution.started` until the first `llm.started`, `running` after it, `idle` once it ended.
diff --git a/packages/harness/src/thread/thread.ts b/packages/harness/src/thread/thread.ts
index 4f09192c..688d3281 100644
--- a/packages/harness/src/thread/thread.ts
+++ b/packages/harness/src/thread/thread.ts
@@ -133,7 +133,7 @@ export interface Forked {
 	readonly text?: string;
 }
 
-/** What a projector inserts for a new thread; usage and execution start empty. */
+/** What a projector inserts for a new thread; usage and run state start empty. */
 export interface InsertThread {
 	readonly id: ThreadSchema.ID;
 	readonly sessionId: SessionSchema.ID;
@@ -146,7 +146,13 @@ export interface InsertThread {
 export type RunChange =
 	| { readonly _tag: "started" }
 	| { readonly _tag: "running" }
-	| { readonly _tag: "ended"; readonly outcome: ThreadSchema.RunOutcome; readonly error?: ThreadSchema.RunError };
+	| {
+			readonly _tag: "ended";
+			readonly outcome: ThreadSchema.RunOutcome;
+			readonly error?: ThreadSchema.RunError;
+			/** The ending event's seq. */
+			readonly seq: number;
+	  };
 
 // Entry row + its part rows, zipped. Message decode happens above this layer.
 export interface HydratedEntry {
@@ -210,39 +216,31 @@ export interface Interface {
 	readonly projectForked: (input: EventList.ThreadForked["data"], seq: number) => Effect.Effect<void>;
 	/** Names an untitled thread. Returns whether the title changed. */
 	readonly retitle: (threadId: ThreadSchema.ID, title: string) => Effect.Effect<boolean>;
-	/** Records that the thread has a run to do: one starting, or one a prompt just woke. */
-	readonly markRunning: (threadId: ThreadSchema.ID) => Effect.Effect<void>;
 	/**
-	 * Records how a run ended. `closed` (a shutdown) leaves it to resume. `stopped` (the user) and
-	 * `finished` clear it and the restart count, except that a finished run with prompts still
-	 * pending stays marked: they are accepted work a successor, or the next server start, runs.
-	 */
-	readonly endExecution: (
-		threadId: ThreadSchema.ID,
-		end: "finished" | "stopped" | "closed",
-		/** For a stop: the log position it was asked at. A prompt admitted after it keeps the mark. */
-		stoppedAt?: number,
-	) => Effect.Effect<void>;
-	/**
-	 * Claims a thread's unfinished run for recovery: marks it running again, counting a restart when
-	 * a dying process left it running (a shutdown's closed run is not counted). The new count, or none
-	 * when nothing is unfinished any more, say because the user stopped it since.
+	 * Claims a thread's unfinished run for recovery, counting a restart when the sweep found its host
+	 * dead in it (a shutdown is not counted). The new count, or none when nothing is unfinished any
+	 * more, say because the user stopped it since.
 	 */
 	readonly claimRestart: (threadId: ThreadSchema.ID) => Effect.Effect<Option.Option<number>>;
 	/** A committed turn is progress: the restart count starts over. Runs inside `TurnEnded`'s commit. */
 	readonly resetRestarts: (threadId: ThreadSchema.ID) => Effect.Effect<void>;
 	/** Records the 1-based provider request now in flight, or none (null) once its response ended. */
 	readonly setAttempt: (threadId: ThreadSchema.ID, attempt: number | null) => Effect.Effect<void>;
+	/** Whether a pending prompt of the thread is past its head: woken since its last unanswered end. */
+	readonly runnable: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
+	/** Whether the thread is among {@link unfinished}: still owed a resume, say not stopped since. */
+	readonly resumable: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
+	/** Whether the thread's last run was cut off by the host, a crash or a shutdown: a run to resume. */
+	readonly cutOff: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
 	/**
-	 * Leaves a run that is not resumed idle: no mark, no restarts, no request in flight, whatever is
-	 * queued. Its queued prompts wait for the next prompt to wake the thread.
+	 * Root threads with a run left to resume, oldest first: their last run was interrupted by a crash or
+	 * a shutdown, or a pending prompt is runnable. Read after the startup sweep has closed open runs.
 	 */
-	readonly idle: (threadId: ThreadSchema.ID) => Effect.Effect<void>;
-	/** Root threads with a run left unfinished, oldest first. */
 	readonly unfinished: Effect.Effect<ReadonlyArray<ThreadRow>>;
 	/**
-	 * Projector-only: the `run_*` columns, at the time `at` of the event that changed them. The one
-	 * writer of those columns.
+	 * Projector-only: the `run_*` columns, at the time `at` of the event that changed them, and what a
+	 * run's end settles: `head` moves to an unanswered end (a failure or a user stop), which parks the
+	 * queue; the restart count and the request in flight clear, except where the run resumes.
 	 */
 	readonly projectRun: (threadId: ThreadSchema.ID, at: DateTime.Utc, change: RunChange) => Effect.Effect<void>;
 	/** Threads whose stored run is not idle: at startup, the runs a dead process left open. */
@@ -512,12 +510,13 @@ export const layer = Layer.effect(
 					originEntryId: origin.kind === "main" ? Option.none() : Option.fromUndefinedOr(origin.entryId),
 					originCallId: origin.kind === "subagent" ? Option.some(origin.callId) : Option.none(),
 					title: Option.fromUndefinedOr(input.title),
-					execution: Option.none(),
 					attempt: Option.none(),
 					createdSeq: input.seq,
 					rev: yield* store.rev,
 				});
 				yield* insertThread(row);
+				// A new thread changes its session.
+				yield* sql`UPDATE session SET rev = ${row.rev} WHERE id = ${input.sessionId}`;
 			},
 			store.write,
 			Effect.orDie,
@@ -551,26 +550,22 @@ export const layer = Layer.effect(
 			for (const [partIndex, part] of parts.entries()) yield* writePart(entryId, threadId, partIndex, part);
 		});
 
-		// Usage lives on the thread and moves with the envelope stored; the session's last activity
-		// moves with it.
-		const touch = Effect.fnUntraced(function* (
+		// Usage lives on the thread and moves with the envelope stored.
+		const addUsage = Effect.fnUntraced(function* (
 			thread: ThreadRow,
 			delta?: { cost: number; input: number; output: number; cacheRead: number; cacheWrite: number },
 		) {
-			const now = yield* epochNow;
-			const rev = yield* store.rev;
+			if (delta === undefined) return;
 			yield* sql`
 				UPDATE thread SET
-					rev = ${rev},
-					updated_at = ${now},
-					cost = cost + ${delta?.cost ?? 0},
-					tokens_input = tokens_input + ${delta?.input ?? 0},
-					tokens_output = tokens_output + ${delta?.output ?? 0},
-					tokens_cache_read = tokens_cache_read + ${delta?.cacheRead ?? 0},
-					tokens_cache_write = tokens_cache_write + ${delta?.cacheWrite ?? 0}
+					rev = ${yield* store.rev},
+					cost = cost + ${delta.cost},
+					tokens_input = tokens_input + ${delta.input},
+					tokens_output = tokens_output + ${delta.output},
+					tokens_cache_read = tokens_cache_read + ${delta.cacheRead},
+					tokens_cache_write = tokens_cache_write + ${delta.cacheWrite}
 				WHERE id = ${thread.id}
 			`;
-			yield* sql`UPDATE session SET updated_at = ${now}, rev = ${rev} WHERE id = ${thread.sessionId}`;
 		});
 
 		type AppendTxResult =
@@ -662,7 +657,7 @@ export const layer = Layer.effect(
 							} as const;
 						}
 						yield* writeParts(input.id, input.threadId, parts);
-						yield* touch(
+						yield* addUsage(
 							thread.value,
 							usage === undefined
 								? undefined
@@ -733,7 +728,7 @@ export const layer = Layer.effect(
 						UPDATE entry SET data = ${input.data}, updated_at = ${now}, rev = ${yield* store.rev}
 						WHERE id = ${input.id} AND state = 'draft'
 					`;
-					yield* touch(thread, delta);
+					yield* addUsage(thread, delta);
 				}),
 			);
 		}, Effect.orDie);
@@ -812,7 +807,6 @@ export const layer = Layer.effect(
 				RETURNING id
 			`;
 				if (rows.length !== 1) return yield* Effect.die(`commit requires a fully-settled draft ${input.id}`);
-				yield* sql`UPDATE thread SET updated_at = ${now}, rev = ${yield* store.rev} WHERE id = ${input.threadId}`;
 			},
 			store.write,
 			Effect.orDie,
@@ -832,7 +826,7 @@ export const layer = Layer.effect(
 							rev = ${yield* store.rev}
 						WHERE id = ${input.id} AND state = 'draft'
 					`;
-					yield* touch(thread, delta);
+					yield* addUsage(thread, delta);
 				}),
 			);
 		}, Effect.orDie);
@@ -955,46 +949,23 @@ export const layer = Layer.effect(
 			Effect.orDie,
 		);
 
-		const markRunning = Effect.fn("Thread.markRunning")(
-			function* (threadId: ThreadSchema.ID) {
-				yield* sql`UPDATE thread SET execution = 'running', rev = ${yield* store.rev} WHERE id = ${threadId}`;
-			},
-			store.write,
-			Effect.orDie,
-		);
-
-		const endExecution = Effect.fn("Thread.endExecution")(
-			function* (threadId: ThreadSchema.ID, end: "finished" | "stopped" | "closed", stoppedAt?: number) {
-				// A run that ended in this process has no request in flight: only a dead host leaves one.
-				const rev = yield* store.rev;
-				if (end === "closed") {
-					yield* sql`UPDATE thread SET execution = 'closed', attempt = NULL, rev = ${rev} WHERE id = ${threadId}`;
-					return;
-				}
-				yield* sql`UPDATE thread SET attempt = NULL, rev = ${rev} WHERE id = ${threadId}`;
-				// Pending prompts that keep the mark: any for a finished run; for a stop, only those sent
-				// after it, since what was queued before it stays parked by the user's choice.
-				const after = end === "stopped" ? (stoppedAt ?? Number.MAX_SAFE_INTEGER) : -1;
-				yield* sql`
-				UPDATE thread SET execution = NULL, restarts = 0, rev = ${rev}
-				WHERE id = ${threadId} AND NOT EXISTS (
-					SELECT 1 FROM inbox
-					WHERE thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NULL
-						AND admitted_seq > ${after}
-				)
-			`;
-			},
-			store.write,
-			Effect.orDie,
-		);
+		/** Over a `thread` row: a pending prompt past its head, woken since the last unanswered end. */
+		const runnableOf = sql`EXISTS (
+			SELECT 1 FROM inbox
+			WHERE inbox.thread_id = thread.id AND inbox.promoted_seq IS NULL AND inbox.cancelled_seq IS NULL
+				AND inbox.tail > thread.head
+		)`;
+		/** Over a `thread` row: its last run was cut off by the host, not ended. */
+		const interruptedOf = (reasons: ReadonlyArray<SessionSchema.InterruptReason>) =>
+			sql`(thread.run_outcome = 'interrupted' AND json_extract(thread.run_error, '$.reason') IN ${sql.in(reasons)})`;
+		const unfinishedOf = sql`(${interruptedOf(["crash", "shutdown"])} OR ${runnableOf})`;
 
 		const claimRestart = Effect.fn("Thread.claimRestart")(
 			function* (threadId: ThreadSchema.ID) {
 				const rows = yield* sql<{ restarts: number }>`
 				UPDATE thread
-				SET restarts = restarts + (CASE WHEN execution = 'running' THEN 1 ELSE 0 END), execution = 'running',
-					rev = ${yield* store.rev}
-				WHERE id = ${threadId} AND execution IS NOT NULL
+				SET restarts = restarts + (CASE WHEN ${interruptedOf(["crash"])} THEN 1 ELSE 0 END), rev = ${yield* store.rev}
+				WHERE id = ${threadId} AND ${unfinishedOf}
 				RETURNING restarts
 			`;
 				return Option.fromUndefinedOr(rows[0]?.restarts);
@@ -1019,21 +990,20 @@ export const layer = Layer.effect(
 			Effect.orDie,
 		);
 
-		const idle = Effect.fn("Thread.idle")(
-			function* (threadId: ThreadSchema.ID) {
-				yield* sql`
-				UPDATE thread SET execution = NULL, restarts = 0, attempt = NULL, rev = ${yield* store.rev} WHERE id = ${threadId}
-			`;
-			},
-			store.write,
-			Effect.orDie,
-		);
+		const holds = (name: string, predicate: Statement.Fragment) =>
+			Effect.fn(name)(function* (threadId: ThreadSchema.ID) {
+				const rows = yield* sql<{ holds: number }>`SELECT ${predicate} AS holds FROM thread WHERE id = ${threadId}`;
+				return rows[0]?.holds === 1;
+			}, Effect.orDie);
+		const runnable = holds("Thread.runnable", runnableOf);
+		const resumable = holds("Thread.resumable", unfinishedOf);
+		const cutOff = holds("Thread.cutOff", interruptedOf(["crash", "shutdown"]));
 
 		const findUnfinished = SqlSchema.findAll({
 			Request: Schema.Void,
 			Result: ThreadRow,
 			execute: () => sql`
-				SELECT * FROM thread WHERE execution IS NOT NULL AND origin_kind <> 'subagent' ORDER BY updated_at
+				SELECT * FROM thread WHERE origin_kind <> 'subagent' AND ${unfinishedOf} ORDER BY updated_at
 			`,
 		});
 		const unfinished = findUnfinished(undefined).pipe(Effect.orDie, Effect.withSpan("Thread.unfinished"));
@@ -1063,10 +1033,18 @@ export const layer = Layer.effect(
 				return;
 			}
 			const error = change.error === undefined ? null : yield* encodeRunError(change.error);
+			const interrupted = change.error?._tag === "interrupted" ? change.error.reason : undefined;
+			// An unanswered end parks what is queued: a prompt woken before it waits for the next one.
+			const head = change.outcome === "failed" || interrupted === "user" ? sql`MAX(head, ${change.seq})` : sql`head`;
+			// A run the host cut off resumes: a crash keeps its count for the resume to claim and its request
+			// in flight for the retry; a shutdown ended its request itself.
+			const restarts = interrupted === "crash" || interrupted === "shutdown" ? sql`restarts` : sql`0`;
+			const attempt = interrupted === "crash" ? sql`attempt` : sql`NULL`;
 			yield* sql`
 				UPDATE thread SET
 					run_state_at = ${stateAt}, run_state = ${state}, run_ended_at = ${time},
-					run_outcome = ${change.outcome}, run_error = ${error}, rev = ${rev}
+					run_outcome = ${change.outcome}, run_error = ${error}, head = ${head}, restarts = ${restarts},
+					attempt = ${attempt}, rev = ${rev}
 				WHERE id = ${threadId}
 			`;
 		}, Effect.orDie);
@@ -1116,12 +1094,12 @@ export const layer = Layer.effect(
 			fork,
 			projectForked,
 			retitle,
-			markRunning,
-			endExecution,
 			claimRestart,
 			resetRestarts,
 			setAttempt,
-			idle,
+			runnable,
+			resumable,
+			cutOff,
 			unfinished,
 			projectRun,
 			open,
diff --git a/packages/harness/test/__artifacts__/store.revision.json b/packages/harness/test/__artifacts__/store.revision.json
index e306d91f..e8c110d4 100644
--- a/packages/harness/test/__artifacts__/store.revision.json
+++ b/packages/harness/test/__artifacts__/store.revision.json
@@ -3,7 +3,7 @@
 		"idIsSet": true,
 		"startRev": 0,
 		"sameId": true,
-		"head": 24
+		"head": 21
 	},
 	"doorbellRang": true,
 	"steps": [
@@ -25,19 +25,19 @@
 		},
 		{
 			"step": "prompt (tool call, settle, reply)",
-			"head": 21
+			"head": 18
 		},
 		{
 			"step": "fork",
-			"head": 22
+			"head": 19
 		},
 		{
 			"step": "session-scoped document",
-			"head": 23
+			"head": 20
 		},
 		{
 			"step": "session.delete",
-			"head": 24
+			"head": 21
 		}
 	],
 	"commits": [
@@ -55,13 +55,17 @@
 			"writes": [
 				"session S1 insert",
 				"thread T1 insert",
-				"thread T1 update"
+				"session S1 update",
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
 			"rev": 3,
 			"by": "session.thread.configured",
 			"writes": [
+				"thread T1 update",
 				"thread T1 update"
 			]
 		},
@@ -69,32 +73,20 @@
 			"rev": 4,
 			"by": "session.prompt.admitted",
 			"writes": [
-				"inbox E1 insert"
-			]
-		},
-		{
-			"rev": 5,
-			"by": "plain write",
-			"writes": [
-				"thread T1 update"
-			]
-		},
-		{
-			"rev": 6,
-			"by": "plain write",
-			"writes": [
+				"inbox E1 insert",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 7,
+			"rev": 5,
 			"by": "session.execution.started",
 			"writes": [
+				"thread T1 update",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 8,
+			"rev": 6,
 			"by": "plain write",
 			"writes": [
 				"project P1 update",
@@ -102,61 +94,61 @@
 			]
 		},
 		{
-			"rev": 9,
+			"rev": 7,
 			"by": "session.prompt.promoted",
 			"writes": [
 				"inbox E1 update",
 				"entry E1 insert",
 				"thread T1 update",
-				"session S1 update",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 10,
+			"rev": 8,
 			"by": "session.thread.system.changed",
 			"writes": [
 				"entry E2 insert",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
-			"rev": 11,
+			"rev": 9,
 			"by": "plain write",
 			"writes": [
+				"thread T1 update",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 12,
+			"rev": 10,
 			"by": "session.llm.started",
 			"writes": [
 				"thread T1 update",
 				"entry E3 insert",
 				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
-			"rev": 13,
+			"rev": 11,
 			"by": "session.llm.ended",
 			"writes": [
 				"entry E3 update",
 				"thread T1 update",
-				"session S1 update",
+				"thread T1 update",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 14,
+			"rev": 12,
 			"by": "session.tool.settled",
 			"writes": [
-				"entry E3 update"
+				"entry E3 update",
+				"thread T1 update"
 			]
 		},
 		{
-			"rev": 15,
+			"rev": 13,
 			"by": "session.turn.ended",
 			"writes": [
 				"entry E3 update",
@@ -165,34 +157,35 @@
 			]
 		},
 		{
-			"rev": 16,
+			"rev": 14,
 			"by": "plain write",
 			"writes": [
+				"thread T1 update",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 17,
+			"rev": 15,
 			"by": "session.llm.started",
 			"writes": [
 				"thread T1 update",
 				"entry E4 insert",
 				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
-			"rev": 18,
+			"rev": 16,
 			"by": "session.llm.ended",
 			"writes": [
 				"entry E4 update",
 				"thread T1 update",
-				"session S1 update",
+				"thread T1 update",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 19,
+			"rev": 17,
 			"by": "session.turn.ended",
 			"writes": [
 				"entry E4 update",
@@ -201,38 +194,36 @@
 			]
 		},
 		{
-			"rev": 20,
-			"by": "plain write",
-			"writes": [
-				"thread T1 update",
-				"thread T1 update"
-			]
-		},
-		{
-			"rev": 21,
+			"rev": 18,
 			"by": "session.execution.succeeded",
 			"writes": [
+				"thread T1 update",
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 22,
+			"rev": 19,
 			"by": "session.thread.forked",
 			"writes": [
 				"thread T2 insert",
-				"thread T2 update"
+				"session S1 update",
+				"thread T2 update",
+				"thread T2 update",
+				"session S1 update"
 			]
 		},
 		{
-			"rev": 23,
+			"rev": 20,
 			"by": "plain write",
 			"writes": [
+				"thread T1 update",
+				"thread T2 update",
 				"thread T1 update",
 				"thread T2 update"
 			]
 		},
 		{
-			"rev": 24,
+			"rev": 21,
 			"by": "plain write",
 			"writes": [
 				"removed S1"
@@ -241,34 +232,34 @@
 	],
 	"rowsBeforeDelete": {
 		"project": [
-			"P1 rev=8"
+			"P1 rev=6"
 		],
 		"space": [
-			"SP1 rev=8"
+			"SP1 rev=6"
 		],
 		"session": [
-			"S1 rev=18"
+			"S1 rev=19"
 		],
 		"thread": [
-			"T1 rev=23",
-			"T2 rev=23"
+			"T1 rev=20",
+			"T2 rev=20"
 		],
 		"entry": [
-			"E1 rev=9",
-			"E2 rev=10",
-			"E3 rev=15",
-			"E4 rev=19"
+			"E1 rev=7",
+			"E2 rev=8",
+			"E3 rev=13",
+			"E4 rev=17"
 		],
 		"inbox": [
-			"E1 rev=9"
+			"E1 rev=7"
 		]
 	},
 	"rowsAfterDelete": {
 		"project": [
-			"P1 rev=8"
+			"P1 rev=6"
 		],
 		"space": [
-			"SP1 rev=8"
+			"SP1 rev=6"
 		],
 		"session": [],
 		"thread": [],
@@ -276,7 +267,7 @@
 		"inbox": []
 	},
 	"removed": [
-		"session S1 rev=24"
+		"session S1 rev=21"
 	],
 	"rejected": {
 		"staleRev": "rev is not the current revision",
diff --git a/packages/harness/test/__artifacts__/thread.lifecycle.json b/packages/harness/test/__artifacts__/thread.lifecycle.json
index 2060ee4d..0eb22025 100644
--- a/packages/harness/test/__artifacts__/thread.lifecycle.json
+++ b/packages/harness/test/__artifacts__/thread.lifecycle.json
@@ -11,9 +11,7 @@
 		"19 session.execution.started.1 T1 {\"resumed\":true}",
 		"20 session.llm.started.1 T1",
 		"24 session.llm.started.1 T1",
-		"27 session.execution.succeeded.1 T1",
-		"29 session.execution.started.1 T2 {\"resumed\":false}",
-		"30 session.execution.interrupted.1 T2 {\"reason\":\"shutdown\"}"
+		"27 session.execution.succeeded.1 T1"
 	],
 	"states": [
 		{
@@ -25,7 +23,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": null
+			"head": 0
 		},
 		{
 			"step": "succeeded",
@@ -36,7 +34,7 @@
 			"endedAt": "9 session.execution.succeeded.1",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
+			"head": 0
 		},
 		{
 			"step": "in flight",
@@ -47,7 +45,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "stopped",
@@ -61,7 +59,7 @@
 				"_tag": "interrupted",
 				"reason": "user"
 			},
-			"execution": null
+			"head": 15
 		},
 		{
 			"step": "died",
@@ -72,7 +70,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 15
 		},
 		{
 			"step": "swept",
@@ -86,7 +84,7 @@
 				"_tag": "interrupted",
 				"reason": "crash"
 			},
-			"execution": "running"
+			"head": 15
 		},
 		{
 			"step": "resumed",
@@ -97,7 +95,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 15
 		},
 		{
 			"step": "finished",
@@ -108,32 +106,7 @@
 			"endedAt": "27 session.execution.succeeded.1",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
-		},
-		{
-			"step": "swept after shutdown",
-			"thread": "T1",
-			"state": "idle",
-			"stateAt": "27 session.execution.succeeded.1",
-			"startedAt": "19 session.execution.started.1",
-			"endedAt": "27 session.execution.succeeded.1",
-			"outcome": "succeeded",
-			"error": null,
-			"execution": null
-		},
-		{
-			"step": "swept after shutdown",
-			"thread": "T2",
-			"state": "idle",
-			"stateAt": "30 session.execution.interrupted.1",
-			"startedAt": "29 session.execution.started.1",
-			"endedAt": "30 session.execution.interrupted.1",
-			"outcome": "interrupted",
-			"error": {
-				"_tag": "interrupted",
-				"reason": "shutdown"
-			},
-			"execution": "closed"
+			"head": 15
 		}
 	]
 }
diff --git a/packages/harness/test/__artifacts__/thread.recovery.json b/packages/harness/test/__artifacts__/thread.recovery.json
index 5d83c547..d1596ca9 100644
--- a/packages/harness/test/__artifacts__/thread.recovery.json
+++ b/packages/harness/test/__artifacts__/thread.recovery.json
@@ -11,15 +11,17 @@
 		"9 session.execution.succeeded.1 T1",
 		"10 session.thread.forked.1 T2",
 		"11 session.prompt.admitted.1 T2",
-		"12 session.prompt.promoted.1 T2",
-		"13 session.llm.started.1 T2",
-		"14 session.execution.started.1 T2",
-		"15 session.llm.failed.1 T2",
-		"16 session.thread.system.changed.1 T2",
-		"17 session.llm.started.1 T2",
-		"18 session.llm.ended.1 T2",
-		"19 session.turn.ended.1 T2",
-		"20 session.execution.succeeded.1 T2"
+		"12 session.execution.started.1 T2",
+		"13 session.prompt.promoted.1 T2",
+		"14 session.llm.started.1 T2",
+		"15 session.execution.interrupted.1 T2",
+		"16 session.execution.started.1 T2",
+		"17 session.llm.failed.1 T2",
+		"18 session.thread.system.changed.1 T2",
+		"19 session.llm.started.1 T2",
+		"20 session.llm.ended.1 T2",
+		"21 session.turn.ended.1 T2",
+		"22 session.execution.succeeded.1 T2"
 	],
 	"threads": [
 		{
@@ -39,10 +41,10 @@
 		"E1 T1 user seq=4 committed=4 committed",
 		"E2 T1 system seq=5 committed=5 committed",
 		"E3 T1 assistant seq=6 committed=8 committed",
-		"E4 T2 user seq=12 committed=12 committed",
-		"E5 T2 assistant seq=13 committed=15 aborted",
-		"E6 T2 system seq=16 committed=16 committed",
-		"E7 T2 assistant seq=17 committed=19 committed"
+		"E4 T2 user seq=13 committed=13 committed",
+		"E5 T2 assistant seq=14 committed=17 aborted",
+		"E6 T2 system seq=18 committed=18 committed",
+		"E7 T2 assistant seq=19 committed=21 committed"
 	],
 	"documents": [
 		{
diff --git a/packages/harness/test/control.prompt.test.ts b/packages/harness/test/control.prompt.test.ts
index 09da03b5..adf67179 100644
--- a/packages/harness/test/control.prompt.test.ts
+++ b/packages/harness/test/control.prompt.test.ts
@@ -1,4 +1,4 @@
-import { Cause, Effect, Exit, Layer, Option, Schema } from "effect";
+import { Cause, DateTime, Effect, Exit, Layer, Option, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import * as TestClock from "effect/testing/TestClock";
 import { describe, expect } from "vite-plus/test";
@@ -435,8 +435,9 @@ describe("Control.update", () => {
 		}),
 	);
 
-	// "Send now" on a steer left waiting by a stop: nothing to change, but the session must wake.
-	itWatched("wakes for a steer already in the steer lane without recording a change", () =>
+	// "Send now" on a steer left waiting by a stop: the lane is unchanged, but the move is recorded, since
+	// that is what makes the parked prompt run, now or after a crash.
+	itWatched("records and wakes a move to the steer lane for a steer already in it", () =>
 		Effect.gen(function* () {
 			const { control, sessionId, threadId } = yield* setup;
 			const steer = yield* control.prompt({ sessionId, prompt: prompt("Parked") });
@@ -445,7 +446,7 @@ describe("Control.update", () => {
 			expect(yield* control.update(threadId, steer.id, { delivery: "steer" })).toBe(true);
 
 			expect(wakes).toEqual([threadId]);
-			expect(yield* eventCount("session.prompt.updated.1")).toBe(0);
+			expect(yield* eventCount("session.prompt.updated.1")).toBe(1);
 		}),
 	);
 
@@ -658,55 +659,59 @@ describe("Control queue races", () => {
 });
 
 describe("Control unfinished runs", () => {
-	const executionOf = (threadId: string) =>
+	const unfinished = (threadId: string) =>
 		Effect.gen(function* () {
-			const sql = yield* SqlClient.SqlClient;
-			const [row] = yield* sql<{ execution: string | null }>`SELECT execution FROM thread WHERE id = ${threadId}`;
-			return row?.execution;
+			const threads = yield* Thread.Service;
+			return (yield* threads.unfinished).some((row) => row.id === threadId);
 		});
-
-	// Marked before the wake: a crash between accepting the prompt and its run starting must not lose it.
-	it("marks a thread running as soon as a prompt is accepted", () =>
+	const end = (
+		event: typeof EventList.RunFailed | typeof EventList.ExecutionInterrupted,
+		ids: {
+			readonly sessionId: SessionSchema.ID;
+			readonly threadId: ThreadSchema.ID;
+		},
+	) =>
 		Effect.gen(function* () {
-			const { control, sessionId, threadId } = yield* setup;
-			expect(yield* executionOf(threadId)).toBeNull();
-
-			yield* control.prompt({ sessionId, prompt: prompt(text) });
-
-			expect(yield* executionOf(threadId)).toBe("running");
-		}));
+			const events = yield* Event.Service;
+			const timestamp = yield* DateTime.now;
+			if (event === EventList.RunFailed)
+				return yield* events.publish(EventList.RunFailed, {
+					...ids,
+					timestamp,
+					reason: "truncated",
+					message: "cut",
+				});
+			return yield* events.publish(EventList.ExecutionInterrupted, { ...ids, timestamp, reason: "user" });
+		});
 
-	it("keeps a finished run marked while accepted prompts are still pending", () =>
+	// The admission itself records what makes the prompt run: a crash right after accepting it must not lose it.
+	it("leaves an accepted prompt runnable, and unfinished, from its admission", () =>
 		Effect.gen(function* () {
 			const { threads, control, sessionId, threadId } = yield* setup;
-			const admitted = yield* control.prompt({ sessionId, prompt: prompt(text) });
+			expect(yield* threads.runnable(threadId)).toBe(false);
 
-			yield* threads.endExecution(threadId, "finished");
-			expect(yield* executionOf(threadId)).toBe("running");
+			yield* control.prompt({ sessionId, prompt: prompt(text) });
 
-			// Cancelling leaves the mark alone; the run that next ends with nothing pending clears it.
-			yield* control.cancel(threadId, admitted.id);
-			expect(yield* executionOf(threadId)).toBe("running");
-			yield* threads.endExecution(threadId, "finished");
-			expect(yield* executionOf(threadId)).toBeNull();
+			expect(yield* threads.runnable(threadId)).toBe(true);
+			expect(yield* unfinished(threadId)).toBe(true);
 		}));
 
-	it("keeps a closed run, and clears a stopped one unless a prompt came after the stop", () =>
+	it("parks what an unanswered end leaves queued; a later prompt or a move to steer wakes it", () =>
 		Effect.gen(function* () {
 			const { threads, control, sessionId, threadId } = yield* setup;
-			const events = yield* Event.Service;
-			yield* control.prompt({ sessionId, prompt: prompt("Parked by the stop") });
+			const queued = yield* control.prompt({ sessionId, prompt: prompt("Queued"), delivery: "followUp" });
 
-			yield* threads.endExecution(threadId, "closed");
-			expect(yield* executionOf(threadId)).toBe("closed");
+			yield* end(EventList.RunFailed, { sessionId, threadId });
+			expect(yield* threads.runnable(threadId)).toBe(false);
+			expect(yield* unfinished(threadId)).toBe(false);
 
-			// Sent while the stop was being cleaned up: its wake survives, so the mark must too.
-			const stop = yield* events.latestSequence(sessionId);
-			yield* control.prompt({ sessionId, prompt: prompt("Sent after the stop") });
-			yield* threads.endExecution(threadId, "stopped", stop);
-			expect(yield* executionOf(threadId)).toBe("running");
+			yield* control.update(threadId, queued.id, { delivery: "steer" });
+			expect(yield* threads.runnable(threadId)).toBe(true);
 
-			yield* threads.endExecution(threadId, "stopped", yield* events.latestSequence(sessionId));
-			expect(yield* executionOf(threadId)).toBeNull();
+			// A user stop parks the same way, and a prompt sent after it is runnable again.
+			yield* end(EventList.ExecutionInterrupted, { sessionId, threadId });
+			expect(yield* threads.runnable(threadId)).toBe(false);
+			yield* control.prompt({ sessionId, prompt: prompt("After the stop") });
+			expect(yield* threads.runnable(threadId)).toBe(true);
 		}));
 });
diff --git a/packages/harness/test/runner.coordinator.test.ts b/packages/harness/test/runner.coordinator.test.ts
index 47dda1be..d6d171c4 100644
--- a/packages/harness/test/runner.coordinator.test.ts
+++ b/packages/harness/test/runner.coordinator.test.ts
@@ -158,12 +158,11 @@ describe("RunCoordinator", () => {
 	);
 
 	it.effect(
-		"lifecycle hooks run once across coalesced drains in one busy period",
+		"the settled hook runs once across coalesced drains in one busy period",
 		Effect.gen(function* () {
 			const started = yield* Deferred.make<void>();
 			const gate = yield* Deferred.make<void>();
 			let drains = 0;
-			let starts = 0;
 			const exits: Exit.Exit<void, never>[] = [];
 			const coordinator = yield* RunCoordinator.make<string, never>({
 				drain: () => {
@@ -172,7 +171,6 @@ describe("RunCoordinator", () => {
 						? Deferred.succeed(started, undefined).pipe(Effect.andThen(Deferred.await(gate)))
 						: Effect.void;
 				},
-				started: () => Effect.sync(() => void starts++),
 				settled: (_key, exit) => Effect.sync(() => void exits.push(exit)),
 			});
 
@@ -183,7 +181,6 @@ describe("RunCoordinator", () => {
 			yield* coordinator.awaitIdle("thread");
 
 			expect(drains).toBe(2);
-			expect(starts).toBe(1);
 			expect(exits).toHaveLength(1);
 			expect(Exit.isSuccess(exits[0]!)).toBe(true);
 		}),
diff --git a/packages/harness/test/runner.loop.test.ts b/packages/harness/test/runner.loop.test.ts
index 7db39b2c..85f02e1f 100644
--- a/packages/harness/test/runner.loop.test.ts
+++ b/packages/harness/test/runner.loop.test.ts
@@ -398,8 +398,9 @@ describe("runner loop — crash healing", () => {
 		}),
 	);
 
+	// The doorbell is only a hint: with nothing past the head there is no run, so nothing is touched.
 	it(
-		"heals a dangling draft before eligibility, then idles without capturing state",
+		"runs nothing for a wake with no prompt past the head",
 		Effect.gen(function* () {
 			contexts.length = 0;
 			snapshots = 0;
@@ -427,9 +428,7 @@ describe("runner loop — crash healing", () => {
 			while ((yield* execution.active).has(threadId)) yield* Effect.yieldNow;
 
 			const path = yield* threads.line(threadId);
-			expect(path).toHaveLength(1);
-			expect(path[0]!.entry.state).toBe("aborted");
-			expect(path[0]!.parts).toEqual([]);
+			expect(path.map((entry) => entry.entry.state)).toEqual(["draft"]);
 			expect(contexts).toEqual([]);
 			expect(snapshots).toBe(0);
 		}),
@@ -1042,9 +1041,10 @@ describe("runner loop — queued input", () => {
 		}),
 	);
 
-	// A prompt's wake survives the failure, so what was sent while the run failed goes out after it.
+	// A failed run does not start the next one: what was sent while it failed is parked, and the next
+	// prompt places it, steers with that prompt and follow-ups after.
 	it(
-		"runs prompts sent while a run fails right after it, steers first",
+		"keeps prompts sent while a run fails queued until the next prompt places them",
 		Effect.gen(function* () {
 			yield* reset;
 			const seen = yield* outcomes;
@@ -1060,8 +1060,67 @@ describe("runner loop — queued input", () => {
 			yield* send(threadId, "A");
 			yield* settle(threadId);
 
+			expect(seen).toEqual(["failed"]);
+			expect(contexts.map(texts)).toEqual([["A"]]);
+
+			yield* send(threadId, "N");
+			yield* settle(threadId);
+
+			expect(seen).toEqual(["failed", "succeeded"]);
+			expect(contexts.map(texts).slice(1)).toEqual([
+				["A", "S1", "N"],
+				["A", "S1", "N", "F1"],
+			]);
+		}),
+	);
+
+	// Asking for the steer lane wakes a parked prompt even when it already is a steer: "send now" runs it.
+	it(
+		"runs a parked steer asked for the steer lane again",
+		Effect.gen(function* () {
+			yield* reset;
+			const control = yield* Control.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			const services = yield* Effect.context<Control.Service | Thread.Service>();
+			script.push("fail");
+			during.run = send(threadId, "S1").pipe(Effect.asVoid, Effect.orDie, Effect.provideContext(services));
+
+			yield* send(threadId, "A");
+			yield* settle(threadId);
+			expect(yield* control.update(threadId, SessionMessageSchema.ID.make("S1"), { delivery: "steer" })).toBe(true);
+			yield* settle(threadId);
+
+			expect(seen).toEqual(["failed", "succeeded"]);
+			expect(contexts.map(texts)).toEqual([["A"], ["A", "S1"]]);
+		}),
+	);
+
+	// A prompt accepted after a failure, whose host died before running it, runs on the next start as its
+	// wake would have: the parked follow-up first, not another answer to the failed reply.
+	it(
+		"runs a prompt accepted after a failure on the next start as its wake would have",
+		Effect.gen(function* () {
+			yield* reset;
+			const control = yield* Control.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			const services = yield* Effect.context<Control.Service | Thread.Service>();
+			script.push("fail");
+			during.run = send(threadId, "F1", "followUp").pipe(
+				Effect.asVoid,
+				Effect.orDie,
+				Effect.provideContext(services),
+			);
+
+			yield* send(threadId, "A");
+			yield* settle(threadId);
+			// Accepted, with no wake: the host died before its run.
+			yield* admit({ id: "C", threadId, delivery: "followUp" });
+			yield* control.resumeUnfinished;
+
 			expect(seen).toEqual(["failed", "succeeded"]);
-			expect(contexts.map(texts)).toEqual([["A"], ["A", "S1"], ["A", "S1", "F1"]]);
+			expect(contexts.map(texts)).toEqual([["A"], ["A", "F1"], ["A", "F1", "C"]]);
 		}),
 	);
 
@@ -1114,21 +1173,20 @@ describe("runner loop — resume after restart", () => {
 	const { contexts, script } = provider;
 	const { effect: it } = testEffect(runtime({ open: provider.open }));
 
+	/** Whether the next server start would resume the thread, and its restart count. */
 	const stateOf = (threadId: ThreadSchema.ID) =>
 		Effect.gen(function* () {
-			const sql = yield* SqlClient.SqlClient;
-			const [row] = yield* sql<{ execution: string | null; restarts: number }>`
-				SELECT execution, restarts FROM thread WHERE id = ${threadId}
-			`;
-			return row;
+			const threads = yield* Thread.Service;
+			const row = Option.getOrThrow(yield* threads.get(threadId));
+			return { unfinished: yield* threads.resumable(threadId), restarts: row.restarts };
 		});
 
 	/** The thread's state each time a run starts, as it starts. */
 	const atEachStart = (threadId: ThreadSchema.ID) =>
 		Effect.gen(function* () {
 			const events = yield* Event.Service;
-			const sql = yield* SqlClient.SqlClient;
-			const seen: Array<{ execution: string | null; restarts: number } | undefined> = [];
+			const threads = yield* Thread.Service;
+			const seen: Array<{ unfinished: boolean; restarts: number }> = [];
 			yield* events.listen((event) =>
 				Schema.is(EventList.ExecutionStarted)(event) && event.data.threadId === threadId
 					? stateOf(threadId).pipe(
@@ -1136,7 +1194,7 @@ describe("runner loop — resume after restart", () => {
 								seen.push(state);
 							}),
 							Effect.orDie,
-							Effect.provideService(SqlClient.SqlClient, sql),
+							Effect.provideService(Thread.Service, threads),
 						)
 					: Effect.void,
 			);
@@ -1156,12 +1214,11 @@ describe("runner loop — resume after restart", () => {
 	});
 
 	/**
-	 * What a process that died mid-reply leaves: the prompt in the conversation, the reply it was
-	 * streaming still a draft, and the run still marked running.
+	 * What a process that died mid-reply leaves, once the next start swept it: the prompt in the
+	 * conversation, the reply it was streaming still a draft, and the run interrupted by a crash.
 	 */
 	const crashedMidReply = Effect.fnUntraced(function* (threadId: ThreadSchema.ID, id: string) {
 		const events = yield* Event.Service;
-		const threads = yield* Thread.Service;
 		const inputs = yield* Inbox.make;
 		yield* admit({ id, threadId, delivery: "steer" });
 		yield* inputs.promoteSteers(threadId, Number.MAX_SAFE_INTEGER);
@@ -1180,7 +1237,12 @@ describe("runner loop — resume after restart", () => {
 			messageId: SessionMessageSchema.ID.from(draft.messageId),
 			message: draft,
 		});
-		yield* threads.markRunning(threadId);
+		yield* events.publish(EventList.ExecutionInterrupted, {
+			timestamp: DateTime.makeUnsafe(2),
+			sessionId: yield* sessionOf(threadId),
+			threadId,
+			reason: "crash",
+		});
 	});
 
 	it(
@@ -1199,8 +1261,8 @@ describe("runner loop — resume after restart", () => {
 			yield* execution.interrupt(threadId, "user", { awaitSettlement: true });
 			yield* settle(threadId);
 
-			// The stop is the user's: what was queued behind it stays queued, unmarked.
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			// The stop is the user's: what was queued behind it stays parked, not resumed.
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 			yield* control.resumeUnfinished;
 
 			expect(seen).toEqual(["interrupted"]);
@@ -1230,17 +1292,18 @@ describe("runner loop — resume after restart", () => {
 			yield* execution.interrupt(threadId, "shutdown", { awaitSettlement: true });
 			yield* settle(threadId);
 
-			expect(yield* stateOf(threadId)).toEqual({ execution: "closed", restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: true, restarts: 0 });
 			const atStart = yield* atEachStart(threadId);
 			yield* control.resumeUnfinished;
 
-			expect(atStart).toEqual([{ execution: "running", restarts: 0 }]);
+			// S1 and F1 are still queued as the resumed run starts.
+			expect(atStart).toEqual([{ unfinished: true, restarts: 0 }]);
 			expect(seen).toEqual(["interrupted", "succeeded"]);
 			expect(contexts.map(texts).slice(1)).toEqual([
 				["A", "S1"],
 				["A", "S1", "F1"],
 			]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 		}),
 	);
 
@@ -1278,7 +1341,7 @@ describe("runner loop — resume after restart", () => {
 
 			yield* control.resumeUnfinished;
 
-			expect(atStart).toEqual([{ execution: "running", restarts: 1 }]);
+			expect(atStart).toEqual([{ unfinished: false, restarts: 1 }]);
 			expect(contexts.map(texts)).toEqual([["A"]]);
 			const path = yield* threads.line(threadId);
 			expect(path.map((entry) => [entry.entry.type, entry.entry.state])).toEqual([
@@ -1287,26 +1350,31 @@ describe("runner loop — resume after restart", () => {
 				["system", "committed"],
 				["assistant", "committed"],
 			]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 		}),
 	);
 
-	// Recovery chose the session, then the user ran and stopped it: the stop cleared the mark, and the
+	// Recovery chose the session, then the user ran and stopped it: the stop ended the run, and the
 	// recovered run must find nothing to resume rather than force another turn.
 	it(
 		"runs nothing when a session recovery chose was stopped before its run began",
 		Effect.gen(function* () {
 			yield* provider.reset;
-			const threads = yield* Thread.Service;
+			const events = yield* Event.Service;
 			const execution = yield* RunnerExecution.Service;
 			const { threadId } = yield* seedSession();
 			yield* crashedMidReply(threadId, "A");
-			yield* threads.endExecution(threadId, "stopped");
+			yield* events.publish(EventList.ExecutionInterrupted, {
+				timestamp: yield* DateTime.now,
+				sessionId: yield* sessionOf(threadId),
+				threadId,
+				reason: "user",
+			});
 
 			yield* execution.recover(threadId);
 
 			expect(contexts).toEqual([]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 		}),
 	);
 
@@ -1333,7 +1401,7 @@ describe("runner loop — resume after restart", () => {
 			yield* control.resumeUnfinished;
 
 			expect(contexts).toEqual([]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 			expect(failures.map((failure) => [failure.reason, failure.message])).toEqual([
 				["crashloop", `The run was interrupted ${Control.RESTART_LIMIT} times in a row; it is not resumed again`],
 			]);
@@ -1345,7 +1413,132 @@ describe("runner loop — resume after restart", () => {
 			yield* settle(threadId);
 
 			expect(contexts.map(texts)).toEqual([["A", "B"]]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+		}),
+	);
+
+	// The run's own terminal is its end: a stop that lands while `run.failed` commits must not end it twice
+	// as interrupted, which would make the thread resumable and run its parked queue on the next start.
+	it(
+		"ends a run once when a stop lands while its run.failed commits",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const control = yield* Control.Service;
+			const events = yield* Event.Service;
+			const execution = yield* RunnerExecution.Service;
+			const sql = yield* SqlClient.SqlClient;
+			const { threadId } = yield* seedSession();
+			const terminals: Array<string> = [];
+			yield* events.listen((event) =>
+				event.type === EventList.RunFailed.type
+					? execution
+							.interrupt(threadId, "user")
+							.pipe(Effect.andThen(Effect.sync(() => terminals.push(event.type))))
+					: event.type.startsWith("session.execution.") && event.type !== EventList.ExecutionStarted.type
+						? Effect.sync(() => terminals.push(event.type))
+						: Effect.void,
+			);
+			yield* crashedMidReply(threadId, "A");
+			yield* admit({ id: "Q", threadId, delivery: "followUp" });
+			yield* sql`UPDATE thread SET restarts = ${Control.RESTART_LIMIT - 1}, rev = (SELECT rev FROM store) WHERE id = ${threadId}`;
+
+			// The stop interrupts the recovery it joined.
+			yield* Effect.exit(control.resumeUnfinished);
+			yield* settle(threadId);
+
+			// The sweep's crash, then the abandoned run's own end, and nothing after it.
+			expect(terminals).toEqual(["session.execution.interrupted", "session.run.failed"]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+		}),
+	);
+
+	// The stop lands after the run's success but before its drain returns: it is still the user's, so a prompt
+	// sent as the run ended is parked rather than left to run on the next start.
+	it(
+		"parks a prompt sent as its run succeeds when a stop lands before the drain returns",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const control = yield* Control.Service;
+			const events = yield* Event.Service;
+			const execution = yield* RunnerExecution.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			const sessionId = yield* sessionOf(threadId);
+			let stopped = false;
+			yield* events.listen((event) =>
+				event.type === EventList.ExecutionSucceeded.type && !stopped
+					? Effect.sync(() => (stopped = true)).pipe(
+							Effect.andThen(
+								control.prompt({
+									sessionId,
+									threadId,
+									id: SessionMessageSchema.ID.make("Q"),
+									prompt: PromptSchema.Prompt.fromText("Q"),
+									delivery: "followUp",
+								}),
+							),
+							Effect.andThen(execution.interrupt(threadId, "user")),
+							Effect.orDie,
+							Effect.asVoid,
+						)
+					: Effect.void,
+			);
+
+			yield* send(threadId, "A");
+			yield* settle(threadId);
+			yield* control.resumeUnfinished;
+
+			expect(seen).toEqual(["succeeded", "interrupted"]);
+			expect(contexts.map(texts)).toEqual([["A"]]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+			expect((yield* delivered(threadId)).map((row) => [row.id, row.promotedSeq])).toEqual([
+				["A", expect.any(Number)],
+				["Q", null],
+			]);
+		}),
+	);
+
+	// A thread a crash cut off, stopped before a drain opened a run: nothing is runnable, but the stop must
+	// still stand, or the next start resumes the run the user stopped.
+	it(
+		"keeps a stop that lands before the run opened on a thread a crash cut off",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const control = yield* Control.Service;
+			const execution = yield* RunnerExecution.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			yield* crashedMidReply(threadId, "A");
+
+			yield* execution.wake(threadId);
+			expect(yield* execution.interrupt(threadId, "user")).toBe(true);
+			yield* settle(threadId);
+			yield* control.resumeUnfinished;
+
+			expect(contexts).toEqual([]);
+			expect(seen).toEqual(["interrupted", "interrupted"]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+		}),
+	);
+
+	// The stop is accepted before the drain opened its run: it is still the user's, so what woke the drain
+	// is parked rather than left to run on the next start.
+	it(
+		"parks a prompt whose drain a stop interrupted before its run opened",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const execution = yield* RunnerExecution.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+
+			yield* send(threadId, "A");
+			expect(yield* execution.interrupt(threadId, "user")).toBe(true);
+			yield* settle(threadId);
+
+			expect(contexts).toEqual([]);
+			expect(seen).toEqual(["interrupted"]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+			expect((yield* delivered(threadId)).map((row) => [row.id, row.promotedSeq])).toEqual([["A", null]]);
 		}),
 	);
 
@@ -1366,7 +1559,7 @@ describe("runner loop — resume after restart", () => {
 			yield* send(threadId, "A");
 			yield* streaming;
 
-			expect(yield* stateOf(threadId)).toEqual({ execution: "running", restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 			yield* execution.interrupt(threadId, "user", { awaitSettlement: true });
 		}),
 	);
@@ -1377,15 +1570,15 @@ describe("runner loop — cancel and unfinished replies", () => {
 	const { effect: it } = testEffect(runtime({ open: provider.open }));
 
 	// A shutdown cut off the reply to A while B waited. Cancelling B must not drop A's unfinished
-	// reply: the session stays marked for the next start.
+	// reply: the next start still resumes the thread.
 	it(
-		"keeps a session marked when cancelling the last queued prompt leaves a reply cut off",
+		"keeps a thread unfinished when cancelling the last queued prompt leaves a reply cut off",
 		Effect.gen(function* () {
 			yield* provider.reset;
 			const control = yield* Control.Service;
 			const execution = yield* RunnerExecution.Service;
 			const events = yield* Event.Service;
-			const sql = yield* SqlClient.SqlClient;
+			const threads = yield* Thread.Service;
 			const { threadId } = yield* seedSession();
 			const streaming = yield* Deferred.make<void>();
 			yield* events.listen((event) =>
@@ -1402,8 +1595,7 @@ describe("runner loop — cancel and unfinished replies", () => {
 
 			yield* control.cancel(threadId, SessionMessageSchema.ID.make("B"));
 
-			const [row] = yield* sql<{ execution: string | null }>`SELECT execution FROM thread WHERE id = ${threadId}`;
-			expect(row?.execution).toBe("closed");
+			expect(yield* threads.resumable(threadId)).toBe(true);
 		}),
 	);
 });
diff --git a/packages/harness/test/thread.test.ts b/packages/harness/test/thread.test.ts
index e002ec2a..a8043af5 100644
--- a/packages/harness/test/thread.test.ts
+++ b/packages/harness/test/thread.test.ts
@@ -510,12 +510,13 @@ describe("threads", () => {
 			const [first] = yield* threads.line(main);
 			const t2 = ThreadSchema.ID.make((yield* threads.fork({ threadId: main, entryId: first!.entry.id })).thread.id);
 
-			// What a process dying mid-turn leaves: a promoted prompt, an open draft, the run still marked.
+			// What a process dying mid-turn leaves: a promoted prompt, an open draft, its run never ended.
 			const timestamp = yield* DateTime.now;
 			const prompt = PromptSchema.Prompt.fromText("cut off");
 			const messageId = SessionMessageSchema.ID.make("prompt_cut");
 			const base = { timestamp, sessionId, threadId: t2, messageId, prompt, delivery: "followUp" as const };
 			yield* events.publish(EventList.PromptAdmitted, base);
+			yield* events.publish(EventList.ExecutionStarted, { timestamp, sessionId, threadId: t2, resumed: false });
 			yield* events.publish(EventList.Prompted, base);
 			yield* events.publish(EventList.LLMStarted, {
 				timestamp,
@@ -542,7 +543,8 @@ describe("threads", () => {
 					parts: [{ type: "text", text: "half a rep" }],
 				}),
 			});
-			yield* threads.markRunning(t2);
+			// The next start sweeps the open run as a crash.
+			yield* control.sweep;
 
 			script.set(t2, [{ _tag: "reply", text: "answered again" }]);
 			yield* control.resumeUnfinished;
@@ -552,7 +554,7 @@ describe("threads", () => {
 				.map(({ entry }) => `${entry.type} ${entry.state}`);
 			expect(own).toEqual(["user committed", "assistant aborted", "system committed", "assistant committed"]);
 			const thread = Option.getOrThrow(yield* threads.get(t2));
-			expect(Option.getOrUndefined(thread.execution)).toBeUndefined();
+			expect(yield* threads.resumable(t2)).toBe(false);
 			expect(thread.restarts).toBe(0);
 			// Only the thread that was cut off ran again, from its committed entries: the inherited
 			// prompt and its own, without the aborted draft.
@@ -685,7 +687,7 @@ describe("threads", () => {
 							endedAt: at(log, row.id, row.runEndedAt, terminals),
 							outcome: Option.getOrNull(row.runOutcome),
 							error: Option.getOrNull(row.runError),
-							execution: Option.getOrNull(row.execution),
+							head: row.head,
 						});
 					}
 				});
@@ -714,7 +716,7 @@ describe("threads", () => {
 			yield* control.interrupt(main, { awaitSettlement: true });
 			yield* record("stopped");
 
-			// What a process dying mid-run leaves: a follow-up admitted, its run started and marked, never ended.
+			// What a process dying mid-run leaves: a follow-up admitted, its run started, never ended.
 			const died = (threadId: ThreadSchema.ID) =>
 				Effect.gen(function* () {
 					yield* events.publish(EventList.ExecutionStarted, {
@@ -723,7 +725,6 @@ describe("threads", () => {
 						threadId,
 						resumed: false,
 					});
-					yield* threads.markRunning(threadId);
 				});
 			yield* inputs.admit({
 				id: SessionMessageSchema.ID.make("prompt_cut"),
@@ -755,21 +756,6 @@ describe("threads", () => {
 			yield* Fiber.join(resuming);
 			yield* record("finished");
 
-			// A shutdown that closed the run and died before publishing its end: the sweep says `shutdown`.
-			const [first] = yield* threads.line(main);
-			const fork = ThreadSchema.ID.make(
-				(yield* threads.fork({ threadId: main, entryId: first!.entry.id })).thread.id,
-			);
-			name("T", fork);
-			yield* died(fork);
-			yield* threads.endExecution(fork, "closed");
-			yield* control.sweep;
-			yield* record("swept after shutdown");
-			expect(Option.getOrUndefined(Option.getOrThrow(yield* threads.get(fork)).runError)).toEqual({
-				_tag: "interrupted",
-				reason: "shutdown",
-			});
-
 			const log = yield* journal;
 			const resumed = log.filter((event) => event.type === lifecycle[0] && event.data["resumed"] === true);
 			expect(resumed.map((event) => event.data["threadId"])).toEqual([main]);