From 2c7929ac2f89879b215ebf8dd1ea9078456ba46e Mon Sep 17 00:00:00 2001
From: Sanchit Rk <0xsanchit@gmail.com>
Date: Sun, 8 Nov 2026 06:20:42 +0530
Subject: [PATCH 1/7] fix(harness): keep the recovery mark for a prompt that
 wakes an ending run

A run that ends visibly (truncated, interrupted, crashloop) cleared the
thread's recovery mark unconditionally. A prompt admitted while that run
was still going woke the thread again, so its run followed in the same
busy period without the mark, and a crash in it was never resumed.

idle now keeps the mark while a prompt admitted after the run began is
pending, sharing endExecution's pending-prompt rule. A queue that was
already parked when the run began stays parked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../test/__artifacts__/recovery.ending.json   | 274 ++++++++++++++++++
 packages/codework/test/recovery.test.ts       |  56 ++++
 packages/harness/src/runner/loop.ts           |  19 +-
 packages/harness/src/thread/thread.ts         |  29 +-
 4 files changed, 362 insertions(+), 16 deletions(-)
 create mode 100644 packages/codework/test/__artifacts__/recovery.ending.json

diff --git a/packages/codework/test/__artifacts__/recovery.ending.json b/packages/codework/test/__artifacts__/recovery.ending.json
new file mode 100644
index 00000000..d06c8125
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.ending.json
@@ -0,0 +1,274 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 9,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 11,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Then answer this."
+		},
+		{
+			"seq": 12,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 13,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 14,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 15,
+			"type": "session.run.failed",
+			"reason": "truncated",
+			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
+		},
+		{
+			"seq": 16,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Then answer this."
+		},
+		{
+			"seq": 17,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 18,
+			"type": "session.execution.interrupted",
+			"reason": "crash"
+		},
+		{
+			"seq": 19,
+			"type": "session.execution.started",
+			"resumed": true
+		},
+		{
+			"seq": 20,
+			"type": "session.llm.failed",
+			"reason": "error",
+			"errorMessage": "The host stopped while the model was answering, on attempt 1",
+			"parts": []
+		},
+		{
+			"seq": 21,
+			"type": "session.retry.scheduled",
+			"attempt": 1,
+			"maxRetries": 3,
+			"delayMs": 10,
+			"message": "The host stopped while the model was answering, on attempt 1"
+		},
+		{
+			"seq": 22,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 23,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answered after the kill."
+				}
+			]
+		},
+		{
+			"seq": 24,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 25,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"rows": [
+		{
+			"step": "in flight",
+			"state": "running",
+			"stateAt": "17 session.llm.started",
+			"startedAt": "3 session.execution.started",
+			"endedAt": "15 session.run.failed",
+			"outcome": "failed",
+			"error": {
+				"_tag": "runFailed",
+				"reason": "truncated",
+				"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
+			},
+			"execution": "running"
+		},
+		{
+			"step": "resumed",
+			"state": "running",
+			"stateAt": "22 session.llm.started",
+			"startedAt": "19 session.execution.started",
+			"endedAt": null,
+			"outcome": null,
+			"error": null,
+			"execution": "running"
+		},
+		{
+			"step": "finished",
+			"state": "idle",
+			"stateAt": "25 session.execution.succeeded",
+			"startedAt": "19 session.execution.started",
+			"endedAt": "25 session.execution.succeeded",
+			"outcome": "succeeded",
+			"error": null,
+			"execution": null
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then answer this."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then answer this."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/recovery.test.ts b/packages/codework/test/recovery.test.ts
index 6a3e0d30..19185a5a 100644
--- a/packages/codework/test/recovery.test.ts
+++ b/packages/codework/test/recovery.test.ts
@@ -565,6 +565,62 @@ describe("recovery after the host is killed", () => {
 		).toMatchFileSnapshot("./__artifacts__/recovery.truncated.json");
 	}, 90_000);
 
+	it("a prompt sent while a run is ending as truncated keeps its run resumable across a kill", async () => {
+		const cut = gate();
+		const resend = gate();
+		const truncate = (response: Reply) => {
+			response.send(toolCalls([{ name: "bash", arguments: { command: "echo cut" } }]));
+			response.finish("length");
+		};
+		const fake = await streaming((_body, response, index) => {
+			if (index === 0) return truncate(response);
+			// The second cut-off ends the run: held until the prompt is in.
+			if (index === 1) return void cut.opened.then(() => truncate(response));
+			// The run the prompt woke, killed with its request in flight; then its resend.
+			if (index === 2) return hang(response);
+			void resend.opened.then(() => answer(response, "Answered after the kill."));
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const rows: Array<{ step: string } & ReturnType<typeof runRow>> = [];
+		const record = (step: string, events: ReadonlyArray<EventEnvelope>) =>
+			rows.push({ step, ...runRow(home, ids.threadId, events) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run a long command." }));
+		await logged(first.url, ids, "session.llm.started", 2);
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then answer this." }));
+		await logged(first.url, ids, "session.prompt.admitted", 2);
+		cut.open();
+		await logged(first.url, ids, "session.run.failed");
+		const inFlight = await logged(first.url, ids, "session.llm.started", 3);
+		record("in flight", inFlight);
+		await first.kill();
+
+		const second = await start();
+		record("resumed", await logged(second.url, ids, "session.llm.started", 4));
+		resend.open();
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		const events = await log(second.url, ids);
+		record("finished", events);
+
+		expect(rows.find((row) => row.step === "in flight")).toMatchObject({ execution: "running" });
+		expect(fake.requests).toHaveLength(4);
+		expect(sent(fake.requests[3]!)).toEqual(sent(fake.requests[2]!));
+
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				// Read from the database file: the woken run in flight when the host died, resumed, finished.
+				rows,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.ending.json");
+	}, 90_000);
+
 	it("a deferred tool loaded before the host died is still offered to the resent request", async () => {
 		const tools = (request: ChatRequest) => (request.tools ?? []).map((tool) => tool.function.name).sort();
 		const fake = await streaming((_body, response, index) => {
diff --git a/packages/harness/src/runner/loop.ts b/packages/harness/src/runner/loop.ts
index d77256f1..651bbe66 100644
--- a/packages/harness/src/runner/loop.ts
+++ b/packages/harness/src/runner/loop.ts
@@ -258,10 +258,14 @@ export const layer = (options: Options = {}) =>
 				yield* Effect.sleep(Duration.millis(delayMs));
 			});
 
-			/** Ends a run that is not resumed, leaving the thread idle with its queue kept. */
+			/**
+			 * Ends a run that is not resumed, leaving the thread idle with its queue kept. `since` is the log
+			 * position the run began at: a prompt admitted after it woke the thread for another run.
+			 */
 			const endRun = Effect.fn("Loop.endRun")(function* (
 				sessionId: SessionSchema.ID,
 				threadId: ThreadSchema.ID,
+				since: number,
 				reason: EventList.RunFailed["data"]["reason"],
 				message: string,
 			) {
@@ -274,7 +278,7 @@ export const layer = (options: Options = {}) =>
 							reason,
 							message,
 						});
-						yield* threads.idle(threadId);
+						yield* threads.idle(threadId, since);
 					}),
 				);
 				return "ended" as const;
@@ -602,10 +606,11 @@ export const layer = (options: Options = {}) =>
 				readonly force: boolean;
 				readonly recovered?: boolean;
 			}) {
+				const thread = yield* threads.get(input.threadId);
+				if (Option.isNone(thread)) return "drained" as const;
+				const since = yield* events.latestSequence(thread.value.sessionId);
 				// Only a dead host leaves a request marked in flight: every run that ends clears it.
-				const crashed = Option.getOrUndefined(
-					Option.flatMap(yield* threads.get(input.threadId), (row) => row.attempt),
-				);
+				const crashed = Option.getOrUndefined(thread.value.attempt);
 				const carried: Crashed | undefined =
 					crashed === undefined
 						? undefined
@@ -648,7 +653,7 @@ export const layer = (options: Options = {}) =>
 					if (carried !== undefined) {
 						const delayMs = Retry.delay(start.retry, carried.attempt, hostStopped(start, carried.message));
 						if (delayMs === undefined) {
-							return yield* endRun(start.sessionId, input.threadId, "interrupted", carried.message);
+							return yield* endRun(start.sessionId, input.threadId, since, "interrupted", carried.message);
 						}
 						yield* scheduleRetry(start, carried.attempt, delayMs, carried.message);
 					}
@@ -680,6 +685,7 @@ export const layer = (options: Options = {}) =>
 							return yield* endRun(
 								snapshot.sessionId,
 								input.threadId,
+								since,
 								"truncated",
 								`The response hit the output token limit with tool calls ${truncations} times in a row; the run is ended`,
 							);
@@ -714,6 +720,7 @@ export const layer = (options: Options = {}) =>
 				return yield* endRun(
 					SessionSchema.ID.make(thread.value.sessionId),
 					input.threadId,
+					yield* events.latestSequence(thread.value.sessionId),
 					"crashloop",
 					input.message,
 				);
diff --git a/packages/harness/src/thread/thread.ts b/packages/harness/src/thread/thread.ts
index 4f09192c..3c896ab5 100644
--- a/packages/harness/src/thread/thread.ts
+++ b/packages/harness/src/thread/thread.ts
@@ -234,10 +234,12 @@ export interface Interface {
 	/** Records the 1-based provider request now in flight, or none (null) once its response ended. */
 	readonly setAttempt: (threadId: ThreadSchema.ID, attempt: number | null) => Effect.Effect<void>;
 	/**
-	 * Leaves a run that is not resumed idle: no mark, no restarts, no request in flight, whatever is
-	 * queued. Its queued prompts wait for the next prompt to wake the thread.
+	 * Leaves a run that is not resumed idle: no restarts, no request in flight, whatever is queued. Its
+	 * queued prompts wait for the next prompt to wake the thread. The mark stays while a prompt
+	 * admitted after `since`, the log position the run began at, is pending: it woke the thread again,
+	 * so its run follows in this process and must survive a crash.
 	 */
-	readonly idle: (threadId: ThreadSchema.ID) => Effect.Effect<void>;
+	readonly idle: (threadId: ThreadSchema.ID, since: number) => Effect.Effect<void>;
 	/** Root threads with a run left unfinished, oldest first. */
 	readonly unfinished: Effect.Effect<ReadonlyArray<ThreadRow>>;
 	/**
@@ -955,6 +957,14 @@ export const layer = Layer.effect(
 			Effect.orDie,
 		);
 
+		/** Whether the thread has a prompt admitted after log position `after` still pending. */
+		const pendingAfter = (threadId: ThreadSchema.ID, after: number) => sql`
+			EXISTS (
+				SELECT 1 FROM inbox
+				WHERE thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NULL AND admitted_seq > ${after}
+			)
+		`;
+
 		const markRunning = Effect.fn("Thread.markRunning")(
 			function* (threadId: ThreadSchema.ID) {
 				yield* sql`UPDATE thread SET execution = 'running', rev = ${yield* store.rev} WHERE id = ${threadId}`;
@@ -977,11 +987,7 @@ export const layer = Layer.effect(
 				const after = end === "stopped" ? (stoppedAt ?? Number.MAX_SAFE_INTEGER) : -1;
 				yield* sql`
 				UPDATE thread SET execution = NULL, restarts = 0, rev = ${rev}
-				WHERE id = ${threadId} AND NOT EXISTS (
-					SELECT 1 FROM inbox
-					WHERE thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NULL
-						AND admitted_seq > ${after}
-				)
+				WHERE id = ${threadId} AND NOT ${pendingAfter(threadId, after)}
 			`;
 			},
 			store.write,
@@ -1020,9 +1026,12 @@ export const layer = Layer.effect(
 		);
 
 		const idle = Effect.fn("Thread.idle")(
-			function* (threadId: ThreadSchema.ID) {
+			function* (threadId: ThreadSchema.ID, since: number) {
 				yield* sql`
-				UPDATE thread SET execution = NULL, restarts = 0, attempt = NULL, rev = ${yield* store.rev} WHERE id = ${threadId}
+				UPDATE thread
+				SET execution = CASE WHEN ${pendingAfter(threadId, since)} THEN execution ELSE NULL END,
+					restarts = 0, attempt = NULL, rev = ${yield* store.rev}
+				WHERE id = ${threadId}
 			`;
 			},
 			store.write,

From b36b59a841d1b97ed7beb0a864a92eaa330a54f0 Mon Sep 17 00:00:00 2001
From: Sanchit Rk <0xsanchit@gmail.com>
Date: Sun, 8 Nov 2026 11:28:07 +0530
Subject: [PATCH 2/7] fix(harness): derive resumable runs from log positions

The recovery mark on thread rows was a stored copy of "will another run
follow?", and it drifted: a run that ended visibly cleared it while a
prompt that had already woken the thread ran next, unmarked, and a crash
in that run was never resumed.

Replace it with two positions on the session log. inbox.tail is the seq
of a prompt's admission or latest move to steer; thread.head is the seq
of the last unanswered run end (run.failed, execution.failed, a user
stop), written by the projector in that event's commit. A pending prompt
past the head is runnable; a thread is unfinished when its last run was
cut off by a crash or shutdown, or it has a runnable prompt.

- One run per drain that runs: execution.started before anything is
  promoted, one terminal decided from the stored run state.
- A run that ends without an answer never starts the next one: prompts
  queued before or during its end stay parked for the next prompt. A
  user stop is recorded even before its run opened.
- Crash vs shutdown and restart counting come from the run row; the
  execution column, markRunning, endExecution, idle and the in-memory
  stop position are gone.
- codework run --server ends on session.run.failed, and attributes a
  failure before promotion by log seq, not notification order.

E2E coverage in recovery.test.ts, cli.test.ts and client.test.ts, plus
a real-machine suite on OrbStack (recovery.machines.live.test.ts).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../recovery.machines.crash.json              |  83 ++++
 .../recovery.machines.crashloop.json          | 125 ++++++
 .../recovery.machines.network.json            |  99 +++++
 .../recovery.machines.shutdown.json           | 118 +++++
 .../__artifacts__/recovery.machines.stop.json | 105 +++++
 .../__artifacts__/sync.machines.crash.json    |   4 +-
 .../test/recovery.machines.live.test.ts       | 419 ++++++++++++++++++
 apps/server/test/sync.machines.live.test.ts   |   2 +-
 packages/codework/src/server/client.ts        |  43 +-
 packages/codework/src/server/server.ts        |   5 +-
 .../test/__artifacts__/cli.run-failed.json    |   4 +
 ...nding.json => recovery.after-failure.json} | 128 ++++--
 .../__artifacts__/recovery.crashloop.json     |   2 +-
 .../__artifacts__/recovery.interrupted.json   |   2 +-
 .../__artifacts__/recovery.lifecycle.json     |  10 +-
 .../test/__artifacts__/recovery.moved.json    | 312 +++++++++++++
 .../test/__artifacts__/recovery.parked.json   | 313 +++++++++++++
 .../test/__artifacts__/recovery.shutdown.json |  84 ++++
 .../test/__artifacts__/recovery.stop.json     | 300 +++++++++++++
 .../__artifacts__/recovery.truncated.json     |   2 +-
 .../test/__artifacts__/sync.thread.json       |  14 +-
 packages/codework/test/cli.test.ts            |  25 +-
 packages/codework/test/client.test.ts         |  83 ++++
 packages/codework/test/fixtures/cli.ts        |   9 +-
 packages/codework/test/recovery.test.ts       | 322 ++++++++++++--
 packages/codework/test/server.test.ts         |  12 +-
 packages/harness/src/control.ts               |  25 +-
 packages/harness/src/db/migrations.ts         |   6 +-
 packages/harness/src/db/schema.sql.ts         |   7 +-
 packages/harness/src/event/list.ts            |  12 +-
 packages/harness/src/inbox/inbox.ts           |  16 +-
 packages/harness/src/runner/coordinator.ts    |   3 -
 packages/harness/src/runner/execute.ts        | 120 +++--
 packages/harness/src/runner/loop.ts           |  31 +-
 packages/harness/src/session/projector.ts     |  62 ++-
 packages/harness/src/thread/schema.ts         |   8 -
 packages/harness/src/thread/thread.ts         | 134 +++---
 .../test/__artifacts__/store.revision.json    |  90 ++--
 .../test/__artifacts__/thread.lifecycle.json  |  45 +-
 .../test/__artifacts__/thread.recovery.json   |  28 +-
 packages/harness/test/control.prompt.test.ts  |  76 ++--
 .../harness/test/runner.coordinator.test.ts   |   5 +-
 packages/harness/test/runner.loop.test.ts     | 149 +++++--
 packages/harness/test/thread.test.ts          |  28 +-
 44 files changed, 2921 insertions(+), 549 deletions(-)
 create mode 100644 apps/server/test/__artifacts__/recovery.machines.crash.json
 create mode 100644 apps/server/test/__artifacts__/recovery.machines.crashloop.json
 create mode 100644 apps/server/test/__artifacts__/recovery.machines.network.json
 create mode 100644 apps/server/test/__artifacts__/recovery.machines.shutdown.json
 create mode 100644 apps/server/test/__artifacts__/recovery.machines.stop.json
 create mode 100644 apps/server/test/recovery.machines.live.test.ts
 create mode 100644 packages/codework/test/__artifacts__/cli.run-failed.json
 rename packages/codework/test/__artifacts__/{recovery.ending.json => recovery.after-failure.json} (80%)
 create mode 100644 packages/codework/test/__artifacts__/recovery.moved.json
 create mode 100644 packages/codework/test/__artifacts__/recovery.parked.json
 create mode 100644 packages/codework/test/__artifacts__/recovery.shutdown.json
 create mode 100644 packages/codework/test/__artifacts__/recovery.stop.json
 create mode 100644 packages/codework/test/client.test.ts

diff --git a/apps/server/test/__artifacts__/recovery.machines.crash.json b/apps/server/test/__artifacts__/recovery.machines.crash.json
new file mode 100644
index 00000000..2cc9e300
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.crash.json
@@ -0,0 +1,83 @@
+{
+	"log": [
+		"session.prompt.admitted steer \"gate\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"gate\"",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "in flight",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "killed",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "resumed",
+			"head": null,
+			"restarts": 1,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "finished",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.crashloop.json b/apps/server/test/__artifacts__/recovery.machines.crashloop.json
new file mode 100644
index 00000000..af000175
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.crashloop.json
@@ -0,0 +1,125 @@
+{
+	"log": [
+		"session.prompt.admitted steer \"hold\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"hold\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"parked by the loop\"",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.llm.started",
+		"session.execution.interrupted crash",
+		"session.execution.started resumed=true",
+		"session.llm.failed",
+		"session.run.failed crashloop",
+		"session.prompt.admitted steer \"next\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"next\"",
+		"session.llm.started",
+		"session.prompt.promoted followUp \"parked by the loop\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "crash loop",
+			"head": "session.run.failed crashloop",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "failed",
+			"error": {
+				"_tag": "runFailed",
+				"reason": "crashloop",
+				"message": "The run was interrupted 5 times in a row; it is not resumed again"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "parked by the loop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"parked by the loop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "restarted",
+			"head": "session.run.failed crashloop",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "failed",
+			"error": {
+				"_tag": "runFailed",
+				"reason": "crashloop",
+				"message": "The run was interrupted 5 times in a row; it is not resumed again"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "parked by the loop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"parked by the loop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": "session.run.failed crashloop",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "parked by the loop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"parked by the loop\"",
+					"promoted": "session.prompt.promoted followUp \"parked by the loop\"",
+					"runnable": false
+				},
+				{
+					"text": "next",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"next\"",
+					"promoted": "session.prompt.promoted steer \"next\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.network.json b/apps/server/test/__artifacts__/recovery.machines.network.json
new file mode 100644
index 00000000..34a12680
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.network.json
@@ -0,0 +1,99 @@
+{
+	"unreachable": true,
+	"log": [
+		"session.prompt.admitted steer \"gate\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"gate\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"sent while cut\"",
+		"session.prompt.promoted followUp \"sent while cut\"",
+		"session.llm.started",
+		"session.execution.succeeded",
+		"session.prompt.admitted steer \"on a slow link\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"on a slow link\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "cut",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "sent while cut",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"sent while cut\"",
+					"promoted": "session.prompt.promoted followUp \"sent while cut\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "retried",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "sent while cut",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"sent while cut\"",
+					"promoted": "session.prompt.promoted followUp \"sent while cut\"",
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "slow link",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "sent while cut",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"sent while cut\"",
+					"promoted": "session.prompt.promoted followUp \"sent while cut\"",
+					"runnable": false
+				},
+				{
+					"text": "on a slow link",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"on a slow link\"",
+					"promoted": "session.prompt.promoted steer \"on a slow link\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.shutdown.json b/apps/server/test/__artifacts__/recovery.machines.shutdown.json
new file mode 100644
index 00000000..72ed6094
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.shutdown.json
@@ -0,0 +1,118 @@
+{
+	"reason": "shutdown",
+	"log": [
+		"session.prompt.admitted steer \"gate\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"gate\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"after the boot\"",
+		"session.llm.failed",
+		"session.execution.interrupted shutdown",
+		"session.execution.started resumed=true",
+		"session.llm.started",
+		"session.prompt.promoted followUp \"after the boot\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "in flight",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": null,
+					"runnable": true
+				}
+			]
+		},
+		{
+			"step": "booted",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "interrupted",
+			"error": {
+				"_tag": "interrupted",
+				"reason": "shutdown"
+			},
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": null,
+					"runnable": true
+				}
+			]
+		},
+		{
+			"step": "resumed",
+			"head": null,
+			"restarts": 0,
+			"runState": "running",
+			"outcome": null,
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": null,
+					"runnable": true
+				}
+			]
+		},
+		{
+			"step": "finished",
+			"head": null,
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "gate",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"gate\"",
+					"promoted": "session.prompt.promoted steer \"gate\"",
+					"runnable": false
+				},
+				{
+					"text": "after the boot",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the boot\"",
+					"promoted": "session.prompt.promoted followUp \"after the boot\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/recovery.machines.stop.json b/apps/server/test/__artifacts__/recovery.machines.stop.json
new file mode 100644
index 00000000..afcb7ff8
--- /dev/null
+++ b/apps/server/test/__artifacts__/recovery.machines.stop.json
@@ -0,0 +1,105 @@
+{
+	"log": [
+		"session.prompt.admitted steer \"hold\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"hold\"",
+		"session.llm.started",
+		"session.prompt.admitted followUp \"after the stop\"",
+		"session.llm.failed",
+		"session.execution.interrupted user",
+		"session.prompt.admitted steer \"next\"",
+		"session.execution.started resumed=false",
+		"session.prompt.promoted steer \"next\"",
+		"session.llm.started",
+		"session.prompt.promoted followUp \"after the stop\"",
+		"session.llm.started",
+		"session.execution.succeeded"
+	],
+	"steps": [
+		{
+			"step": "stopped",
+			"head": "session.execution.interrupted user",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "interrupted",
+			"error": {
+				"_tag": "interrupted",
+				"reason": "user"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "after the stop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the stop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "restarted",
+			"head": "session.execution.interrupted user",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "interrupted",
+			"error": {
+				"_tag": "interrupted",
+				"reason": "user"
+			},
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "after the stop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the stop\"",
+					"promoted": null,
+					"runnable": false
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": "session.execution.interrupted user",
+			"restarts": 0,
+			"runState": "idle",
+			"outcome": "succeeded",
+			"error": null,
+			"prompts": [
+				{
+					"text": "hold",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"hold\"",
+					"promoted": "session.prompt.promoted steer \"hold\"",
+					"runnable": false
+				},
+				{
+					"text": "after the stop",
+					"delivery": "followUp",
+					"tail": "session.prompt.admitted followUp \"after the stop\"",
+					"promoted": "session.prompt.promoted followUp \"after the stop\"",
+					"runnable": false
+				},
+				{
+					"text": "next",
+					"delivery": "steer",
+					"tail": "session.prompt.admitted steer \"next\"",
+					"promoted": "session.prompt.promoted steer \"next\"",
+					"runnable": false
+				}
+			]
+		}
+	]
+}
diff --git a/apps/server/test/__artifacts__/sync.machines.crash.json b/apps/server/test/__artifacts__/sync.machines.crash.json
index ac144cad..a4a5a89e 100644
--- a/apps/server/test/__artifacts__/sync.machines.crash.json
+++ b/apps/server/test/__artifacts__/sync.machines.crash.json
@@ -4,13 +4,13 @@
 			"run_state": "running",
 			"run_outcome": null,
 			"run_error": null,
-			"execution": "running"
+			"head": 0
 		},
 		"swept": {
 			"run_state": "idle",
 			"run_outcome": "interrupted",
 			"run_error": "{\"_tag\":\"interrupted\",\"reason\":\"crash\"}",
-			"execution": "running"
+			"head": 0
 		},
 		"events": [
 			{
diff --git a/apps/server/test/recovery.machines.live.test.ts b/apps/server/test/recovery.machines.live.test.ts
new file mode 100644
index 00000000..04308e6f
--- /dev/null
+++ b/apps/server/test/recovery.machines.live.test.ts
@@ -0,0 +1,419 @@
+/* @effect-diagnostics nodeBuiltinImport:off -- the suite runs a CodeWork server on an OrbStack Linux machine. */
+import { Effect, Stream } from "effect";
+import { afterAll, beforeAll, describe, expect, it } from "vite-plus/test";
+import { Control, Session } from "../../../packages/harness/src/effect.ts";
+import { snapshot as match, waitFor } from "./fixtures/apps.ts";
+import { available, ensure, machine, orb } from "./machines/orb.ts";
+
+/*
+ * Durable runs across real failures of a real computer: the fixture CodeWork server (scripted model)
+ * runs on the OrbStack machine cw-a while the suite SIGKILLs it, shuts the whole machine down,
+ * crash-loops it, and cuts and throttles its network. What the store holds is read inside the
+ * machine with sqlite3; `recovery.machines.<name>.json` records the log and the rows across each
+ * failure, with log positions named by the event at them.
+ */
+
+const cw = machine("cw-a");
+const work = `${cw.cwHome}/work`;
+type Ids = { readonly sessionId: string; readonly threadId: string };
+type Row = Record<string, unknown>;
+
+/**
+ * Waits until the Mac reaches the server: after the machine boots, OrbStack takes up to a minute to
+ * route `<name>.orb.local` to it again.
+ */
+const reachable = () =>
+	waitFor(
+		() =>
+			fetch(cw.url.replace(/^ws/, "http"), { signal: AbortSignal.timeout(3_000) }).then(
+				() => true,
+				() => undefined,
+			),
+		"the server from the Mac",
+		180_000,
+	);
+
+/** A fresh store, with retries fast and many so a crash loop is the host's, not the request's. */
+const fresh = async () => {
+	await cw.net("restore");
+	await cw.net("fast");
+	await cw.stop("KILL");
+	await cw.wipe();
+	await cw.sh(
+		`mkdir -p ${work} && printf '%s' '{"retry":{"maxRetries":10,"baseDelayMs":10,"maxDelayMs":1000}}' > ${cw.cwHome}/settings.jsonc`,
+	);
+	await cw.start();
+	await reachable();
+};
+
+const create = () =>
+	cw.run((rpc) =>
+		rpc["session.create"]({ directory: work }).pipe(
+			Effect.map((created): Ids => ({ sessionId: created.session.id, threadId: created.id })),
+		),
+	);
+
+const prompt = (ids: Ids, text: string, options: { delivery?: "steer" | "followUp"; id?: string } = {}) =>
+	cw.run((rpc) =>
+		rpc["thread.prompt"]({
+			sessionId: Session.SessionSchema.ID.make(ids.sessionId),
+			threadId: Session.ThreadSchema.ID.make(ids.threadId),
+			text,
+			...(options.delivery === undefined ? {} : { delivery: options.delivery }),
+			...(options.id === undefined ? {} : { id: Session.SessionMessageSchema.ID.make(options.id) }),
+		}),
+	);
+
+const ref = (ids: Ids) => ({
+	sessionId: Session.SessionSchema.ID.make(ids.sessionId),
+	threadId: Session.ThreadSchema.ID.make(ids.threadId),
+});
+const idle = (ids: Ids) => cw.run((rpc) => rpc["thread.wait"](ref(ids)));
+const queue = (ids: Ids) =>
+	cw.run((rpc) => rpc["thread.queue"](ref(ids)).pipe(Effect.map(({ entries }) => entries.map((one) => one.text))));
+
+type Event = { readonly seq: number; readonly type: string; readonly data: Row };
+
+/** The session's durable log, read in the machine; the type without its version. */
+const events = async (ids: Ids): Promise<Array<Event>> =>
+	(await cw.sql(`SELECT seq, type, data FROM event WHERE aggregate_id = '${ids.sessionId}' ORDER BY seq`)).map(
+		(row) => ({
+			seq: Number(row["seq"]),
+			type: (row["type"] as string).replace(/\.\d+$/, ""),
+			data: JSON.parse(row["data"] as string) as Row,
+		}),
+	);
+
+const textOf = (data: Row) =>
+	((data["prompt"] as { parts?: ReadonlyArray<{ text?: string }> } | undefined)?.parts ?? [])
+		.map((part) => part.text ?? "")
+		.join("");
+
+const shown = new Set([
+	"session.prompt.admitted",
+	"session.prompt.promoted",
+	"session.prompt.updated",
+	"session.execution.started",
+	"session.execution.succeeded",
+	"session.execution.failed",
+	"session.execution.interrupted",
+	"session.run.failed",
+	"session.llm.started",
+	"session.llm.failed",
+]);
+
+/** What an event says, without ids, times or messages that carry them. */
+const describeEvent = (event: Event) => {
+	const { type, data } = event;
+	if (type === "session.prompt.admitted" || type === "session.prompt.promoted")
+		return `${type} ${data["delivery"] as string} "${textOf(data)}"`;
+	if (type === "session.prompt.updated") return `${type} ${(data["delivery"] as string | undefined) ?? ""}`.trim();
+	if (type === "session.execution.started") return `${type} resumed=${String(data["resumed"] as boolean)}`;
+	if (type === "session.execution.interrupted" || type === "session.run.failed")
+		return `${type} ${data["reason"] as string}`;
+	return type;
+};
+
+const count = (log: ReadonlyArray<Event>, type: string) => log.filter((event) => event.type === type).length;
+
+/** The thread's row and its prompts, log positions named by the event at them. */
+const rows = async (ids: Ids) => {
+	const log = await events(ids);
+	const at = (seq: unknown) => {
+		if (seq === null || seq === undefined || seq === 0) return null;
+		const event = log.find((one) => one.seq === Number(seq));
+		return event === undefined ? `unmatched ${seq as number}` : describeEvent(event);
+	};
+	const [thread] = await cw.sql(
+		`SELECT head, restarts, run_state, run_outcome, run_error FROM thread WHERE id = '${ids.threadId}'`,
+	);
+	const prompts = await cw.sql(
+		`SELECT data, delivery, admitted_seq, tail, promoted_seq FROM inbox WHERE thread_id = '${ids.threadId}' ORDER BY admitted_seq`,
+	);
+	const head = Number(thread!["head"]);
+	return {
+		head: at(head),
+		restarts: thread!["restarts"],
+		runState: thread!["run_state"],
+		outcome: thread!["run_outcome"],
+		error: thread!["run_error"] === null ? null : (JSON.parse(thread!["run_error"] as string) as Row),
+		prompts: prompts.map((row) => ({
+			text: textOf({ prompt: JSON.parse(row["data"] as string) }),
+			delivery: row["delivery"],
+			tail: at(row["tail"]),
+			promoted: at(row["promoted_seq"]),
+			runnable: row["promoted_seq"] === null && Number(row["tail"]) > head,
+		})),
+	};
+};
+
+/** The lifecycle part of the log, in order. */
+const lifecycle = async (ids: Ids) =>
+	(await events(ids)).filter((event) => shown.has(event.type)).map((event) => describeEvent(event));
+
+/** Waits until the log holds `n` events of `type`, and returns it. */
+const logged = (ids: Ids, type: string, n = 1, timeout = 120_000) =>
+	waitFor(
+		async () => {
+			const log = await events(ids);
+			return count(log, type) >= n ? log : undefined;
+		},
+		`${n} × ${type}`,
+		timeout,
+	);
+
+/** Waits until the thread's request is out, as the store records it. */
+const inFlight = (ids: Ids, timeout = 120_000) =>
+	waitFor(
+		async () => {
+			const [row] = await cw.sql(`SELECT run_state, attempt FROM thread WHERE id = '${ids.threadId}'`);
+			return row?.["run_state"] === "running" && row["attempt"] !== null ? row : undefined;
+		},
+		"the request in flight",
+		timeout,
+	);
+
+/** Gives a server that just started time to resume what it owes, then says what ran since `from`. */
+const settledSince = async (ids: Ids, from: number) => {
+	await new Promise((resolve) => setTimeout(resolve, 3_000));
+	await idle(ids);
+	return (await events(ids)).filter((event) => event.seq > from && shown.has(event.type)).map(describeEvent);
+};
+
+const lastSeq = async (ids: Ids) => (await events(ids)).at(-1)?.seq ?? 0;
+
+const releases = async (n: number) => {
+	for (let step = 0; step < n; step++) await cw.release();
+};
+
+const snapshot = (name: string, artifact: unknown) => match(`recovery.machines.${name}`, artifact);
+
+const describeMachines = available ? describe : describe.skip;
+
+describeMachines("durable runs across real machine failures", () => {
+	beforeAll(async () => {
+		await ensure(cw.name);
+		await cw.setup();
+	}, 1_800_000);
+
+	afterAll(async () => {
+		await cw.net("fast").catch(() => undefined);
+		await cw.net("restore").catch(() => undefined);
+		await cw.stop("KILL").catch(() => undefined);
+	}, 120_000);
+
+	it("1. a host SIGKILLed mid-request is swept as a crash, resumed with one restart, and finishes", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "gate");
+		await inFlight(ids);
+		await record("in flight");
+		await cw.stop("KILL");
+		await record("killed");
+
+		await cw.start();
+		await logged(ids, "session.execution.started", 2);
+		await inFlight(ids);
+		await record("resumed");
+		expect(steps.at(-1)).toMatchObject({ restarts: 1, runState: "running" });
+		// The resumed request is the scripted `gate` again: one step at once, four held.
+		await releases(4);
+		await logged(ids, "session.execution.succeeded");
+		await idle(ids);
+		await record("finished");
+
+		expect(steps.at(-1)).toMatchObject({ restarts: 0, outcome: "succeeded" });
+		const log = await lifecycle(ids);
+		expect(log).toContain("session.execution.interrupted crash");
+		expect(log).toContain("session.execution.started resumed=true");
+		await snapshot("crash", { log, steps });
+	}, 300_000);
+
+	it("2. a machine shut down mid-request and booted again resumes the run, its queue intact", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "gate");
+		await inFlight(ids);
+		await prompt(ids, "after the boot", { delivery: "followUp" });
+		await record("in flight");
+
+		const init = () => cw.sh("ps -o lstart= -p 1");
+		const bootedAt = await init();
+		await orb(["stop", cw.name], { timeout: 300_000 });
+		const machines = JSON.parse(await orb(["list", "--format", "json"])) as Array<{ name: string; state: string }>;
+		expect(machines.find((one) => one.name === cw.name)?.state).toBe("stopped");
+		await orb(["start", cw.name], { timeout: 300_000 });
+		expect(await init()).not.toBe(bootedAt);
+		// A boot starts nothing: the server runs only once start.sh starts it.
+		expect((await cw.sh(`pgrep -f '[f]ixtures/codework.ts' || true`)).trim()).toBe("");
+		await cw.sh(`rm -f $HOME/cw.pid`);
+		await record("booted");
+		const ended = steps.at(-1)!.error as { reason?: string } | null;
+
+		await cw.start();
+		await reachable();
+		await logged(ids, "session.execution.started", 2);
+		await inFlight(ids);
+		await record("resumed");
+		await releases(4);
+		await logged(ids, "session.execution.succeeded", 1, 120_000);
+		await waitFor(async () => ((await queue(ids)).length === 0 ? true : undefined), "the follow-up to run", 120_000);
+		await logged(ids, "session.execution.succeeded");
+		await idle(ids);
+		await record("finished");
+
+		// A shutdown that published its own end resumes uncounted; one the OS cut off first is a crash.
+		const reason = ended === null ? "crash" : ended.reason;
+		expect(["shutdown", "crash"]).toContain(reason);
+		expect(steps.find((step) => step.step === "resumed")).toMatchObject({
+			restarts: reason === "shutdown" ? 0 : 1,
+		});
+		const finished = steps.at(-1)!;
+		expect(finished).toMatchObject({ restarts: 0, outcome: "succeeded" });
+		expect(finished.prompts.map((one) => [one.text, one.promoted !== null])).toEqual([
+			["gate", true],
+			["after the boot", true],
+		]);
+		await snapshot("shutdown", { reason, log: await lifecycle(ids), steps });
+	}, 900_000);
+
+	it("3. a user stop parks the queue: a SIGKILL and restart run nothing, the next prompt runs it all", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "hold");
+		await inFlight(ids);
+		await prompt(ids, "after the stop", { delivery: "followUp" });
+		await cw.run((rpc) => rpc["thread.interrupt"](ref(ids)));
+		await logged(ids, "session.execution.interrupted");
+		await idle(ids);
+		await record("stopped");
+		const stopped = steps.at(-1)!;
+		expect(stopped.head).toBe("session.execution.interrupted user");
+		expect(stopped.prompts.find((one) => one.text === "after the stop")).toMatchObject({ runnable: false });
+
+		const before = await lastSeq(ids);
+		await cw.stop("KILL");
+		await cw.start();
+		expect(await settledSince(ids, before)).toEqual([]);
+		expect(await queue(ids)).toEqual(["after the stop"]);
+		await record("restarted");
+
+		await prompt(ids, "next");
+		await waitFor(async () => ((await queue(ids)).length === 0 ? true : undefined), "the queue to run", 120_000);
+		await idle(ids);
+		await record("next prompt");
+		const ran = (await lifecycle(ids)).filter((line) => line.startsWith("session.prompt.promoted"));
+		expect(ran).toEqual([
+			'session.prompt.promoted steer "hold"',
+			'session.prompt.promoted steer "next"',
+			'session.prompt.promoted followUp "after the stop"',
+		]);
+		await snapshot("stop", { log: await lifecycle(ids), steps });
+	}, 300_000);
+
+	it("4. a host that keeps dying ends the run as a crash loop: its follow-up stays parked across another restart", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+
+		await prompt(ids, "hold");
+		await inFlight(ids);
+		await prompt(ids, "parked by the loop", { delivery: "followUp" });
+		// The first run, then a resume each until the limit: each dies with its request in flight.
+		for (let started = 1; started <= Control.RESTART_LIMIT; started++) {
+			await logged(ids, "session.llm.started", started);
+			await inFlight(ids);
+			await cw.stop("KILL");
+			await cw.start();
+		}
+		await logged(ids, "session.run.failed");
+		await idle(ids);
+		await record("crash loop");
+		const looped = steps.at(-1)!;
+		expect(looped.error).toMatchObject({ _tag: "runFailed", reason: "crashloop" });
+		expect(looped.head).toBe("session.run.failed crashloop");
+		expect(looped.prompts.find((one) => one.text === "parked by the loop")).toMatchObject({ runnable: false });
+
+		const before = await lastSeq(ids);
+		await cw.stop("KILL");
+		await cw.start();
+		expect(await settledSince(ids, before)).toEqual([]);
+		await record("restarted");
+
+		await prompt(ids, "next");
+		await waitFor(async () => ((await queue(ids)).length === 0 ? true : undefined), "the queue to run", 120_000);
+		await idle(ids);
+		await record("next prompt");
+		expect(steps.at(-1)).toMatchObject({ restarts: 0, outcome: "succeeded" });
+		const log = await lifecycle(ids);
+		expect(count(await events(ids), "session.llm.started")).toBe(Control.RESTART_LIMIT + 2);
+		await snapshot("crashloop", { log, steps });
+	}, 900_000);
+
+	it("5. a cut network leaves the run going; a retried prompt id lands once; the client catches up, also on a slow link", async () => {
+		await fresh();
+		const ids = await create();
+		const steps: Array<{ step: string } & Awaited<ReturnType<typeof rows>>> = [];
+		const record = async (step: string) => steps.push({ step, ...(await rows(ids)) });
+		const sent = Session.SessionMessageSchema.ID.create();
+
+		await prompt(ids, "gate", { id: sent });
+		await inFlight(ids);
+		await cw.net("cut");
+		const unreachable = await cw
+			.run((rpc) => rpc["thread.info"](ref(ids)))
+			.then(
+				() => false,
+				() => true,
+			);
+		expect(unreachable).toBe(true);
+
+		// Inside the machine, over loopback: a follow-up, and the held reply let through.
+		await cw.drive([["thread.prompt", { ...ref(ids), text: "sent while cut", delivery: "followUp" }]]);
+		await releases(4);
+		await logged(ids, "session.execution.succeeded");
+		await waitFor(
+			async () => ((await rows(ids)).prompts.every((one) => one.promoted !== null) ? true : undefined),
+			"the follow-up to run",
+			120_000,
+		);
+		await record("cut");
+		await cw.net("restore");
+
+		// The client never heard back about its prompt before the cut; retrying it is the same prompt.
+		await prompt(ids, "gate", { id: sent });
+		await idle(ids);
+		await record("retried");
+		const log = await events(ids);
+		expect(
+			log.filter((event) => event.type === "session.prompt.admitted" && event.data["messageId"] === sent),
+		).toHaveLength(1);
+		expect(steps.at(-1)!.prompts).toEqual(steps.at(-2)!.prompts);
+
+		const succeeded = count(await events(ids), "session.execution.succeeded");
+		await cw.net("slow");
+		await prompt(ids, "on a slow link");
+		await logged(ids, "session.execution.succeeded", succeeded + 1);
+		await idle(ids);
+		const caught = await cw.run((rpc) =>
+			rpc["session.log"]({ sessionId: Session.SessionSchema.ID.make(ids.sessionId) }).pipe(
+				Stream.runCollect,
+				Effect.map((items) => Array.from(items).filter((item) => item.type !== "log.synced").length),
+			),
+		);
+		await cw.net("fast");
+		await record("slow link");
+		expect(caught).toBe((await events(ids)).length);
+		await snapshot("network", { unreachable, log: await lifecycle(ids), steps });
+	}, 600_000);
+});
diff --git a/apps/server/test/sync.machines.live.test.ts b/apps/server/test/sync.machines.live.test.ts
index ccbf0967..db292855 100644
--- a/apps/server/test/sync.machines.live.test.ts
+++ b/apps/server/test/sync.machines.live.test.ts
@@ -471,7 +471,7 @@ describeMachines("sync across OrbStack machines", () => {
 		const crashedAt = lastSeq(appHome);
 
 		await cwA.stop("KILL");
-		const harnessRow = `SELECT run_state, run_outcome, run_error, execution FROM thread WHERE id = '${ref.threadId}'`;
+		const harnessRow = `SELECT run_state, run_outcome, run_error, head FROM thread WHERE id = '${ref.threadId}'`;
 		const open = await cwA.sql(harnessRow);
 		await cwA.sweep();
 		const swept = await cwA.sql(harnessRow);
diff --git a/packages/codework/src/server/client.ts b/packages/codework/src/server/client.ts
index 43948386..ed90907d 100644
--- a/packages/codework/src/server/client.ts
+++ b/packages/codework/src/server/client.ts
@@ -41,9 +41,20 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 	let admitted = false;
 	let promoted = false;
 	let settled = false;
-	let unattributed: ExecutionError | undefined;
-	// Raised once a busy period ends without our prompt in it: the session may be
-	// about to go idle, and only idleness proves our prompt is never running.
+	// By log position, since notifications may arrive out of order: a run that started after our
+	// admission is one our prompt woke, so its failure before promoting us is ours. A run already going
+	// fails on its own, and parks our prompt behind it.
+	let admittedAt: number | undefined;
+	const starts: Array<number> = [];
+	// Runs that ended before promoting us, failed ones with their error.
+	const ends: Array<{ readonly at: number; readonly error: ExecutionError | undefined }> = [];
+	const ours = () =>
+		ends.findLast(({ at, error }) => {
+			const start = Math.max(...starts.filter((seq) => seq < at));
+			return error !== undefined && admittedAt !== undefined && start > admittedAt;
+		})?.error;
+	// Raised once a run ends after our admission without our prompt in it: the session may be about to
+	// go idle, and only idleness proves our prompt is never running.
 	const stalled = yield* Deferred.make<void>();
 
 	const terminal = (event: EventSchema.Payload): ExecutionError | undefined => {
@@ -52,6 +63,8 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 				type: "aborted",
 				message: event.data.reason === "shutdown" ? "Server stopped the session" : "Session interrupted",
 			});
+		if (Schema.is(EventList.RunFailed)(event))
+			return new ExecutionError({ type: `run.${event.data.reason}`, message: event.data.message });
 		if (Schema.is(EventList.ExecutionFailed)(event))
 			return new ExecutionError({
 				type: event.data.error.type,
@@ -72,21 +85,22 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 					Effect.catchTag("UnknownEventTypeError", () => Effect.void),
 				);
 				if (event === undefined) return;
-				if (Schema.is(EventList.PromptAdmitted)(event) && event.data.messageId === id) admitted = true;
-				if (Schema.is(EventList.Prompted)(event) && event.data.messageId === id) {
-					promoted = true;
-					// Our prompt is running after all; whatever ended before it was not ours.
-					unattributed = undefined;
+				const seq = event.durable?.seq;
+				if (Schema.is(EventList.ExecutionStarted)(event) && seq !== undefined) starts.push(seq);
+				if (Schema.is(EventList.PromptAdmitted)(event) && event.data.messageId === id) {
+					admitted = true;
+					admittedAt = seq;
 				}
-				if (!admitted) return;
+				if (Schema.is(EventList.Prompted)(event) && event.data.messageId === id) promoted = true;
 
 				const ended = terminal(event);
 				const succeeded = Schema.is(EventList.ExecutionSucceeded)(event);
 				if (!promoted) {
-					if (ended !== undefined) unattributed = ended;
-					// A busy period that ended without us: wait for idle to find out
-					// whether a successor still picks our prompt up.
-					if (ended !== undefined || succeeded) yield* Deferred.succeed(stalled, undefined);
+					// Kept whatever arrives first: our admission comes from another fiber than the runs, so a
+					// run's end may be notified before it.
+					if ((ended !== undefined || succeeded) && seq !== undefined) ends.push({ at: seq, error: ended });
+					if (admitted && ends.some(({ at }) => admittedAt === undefined || at > admittedAt))
+						yield* Deferred.succeed(stalled, undefined);
 					return;
 				}
 				if (ended !== undefined) return yield* ended;
@@ -121,8 +135,7 @@ export const run = Effect.fn("Client.run")(function* <E, R>(
 
 	yield* Effect.raceFirst(consume, reconcile);
 	if (settled) return;
-	if (abandoned)
-		return yield* unattributed ?? new ExecutionError({ type: "unknown", message: "Prompt was not promoted" });
+	if (abandoned) return yield* ours() ?? new ExecutionError({ type: "unknown", message: "Prompt was not promoted" });
 	return yield* new ExecutionError({
 		type: "transport.disconnected",
 		message: "Event stream ended before the prompt finished; its output was not rendered",
diff --git a/packages/codework/src/server/server.ts b/packages/codework/src/server/server.ts
index 282baeb4..f65e4033 100644
--- a/packages/codework/src/server/server.ts
+++ b/packages/codework/src/server/server.ts
@@ -57,8 +57,9 @@ const managedShutdown = Layer.unwrap(
 const sweep = Layer.effectDiscard(Effect.flatMap(Control.Service, (control) => control.sweep));
 
 /**
- * Resumes the runs the last server left unfinished, whether it crashed or shut down: the session
- * table records them as they start, so this needs nothing from the previous process.
+ * Resumes the runs the last server left unfinished, whether it crashed or shut down, and the prompts
+ * woken past a thread's head: the log and its projections record both, so this needs nothing from the
+ * previous process.
  */
 const resumeUnfinished = Layer.effectDiscard(
 	Effect.gen(function* () {
diff --git a/packages/codework/test/__artifacts__/cli.run-failed.json b/packages/codework/test/__artifacts__/cli.run-failed.json
new file mode 100644
index 00000000..a168a07a
--- /dev/null
+++ b/packages/codework/test/__artifacts__/cli.run-failed.json
@@ -0,0 +1,4 @@
+{
+	"status": 1,
+	"stderr": "error[run.truncated]: The response hit the output token limit with tool calls 2 times in a row; the run is ended\n"
+}
diff --git a/packages/codework/test/__artifacts__/recovery.ending.json b/packages/codework/test/__artifacts__/recovery.after-failure.json
similarity index 80%
rename from packages/codework/test/__artifacts__/recovery.ending.json
rename to packages/codework/test/__artifacts__/recovery.after-failure.json
index d06c8125..e86f7f3d 100644
--- a/packages/codework/test/__artifacts__/recovery.ending.json
+++ b/packages/codework/test/__artifacts__/recovery.after-failure.json
@@ -59,12 +59,6 @@
 		},
 		{
 			"seq": 11,
-			"type": "session.prompt.admitted",
-			"delivery": "steer",
-			"text": "Then answer this."
-		},
-		{
-			"seq": 12,
 			"type": "session.llm.ended",
 			"reason": "length",
 			"parts": [
@@ -75,7 +69,7 @@
 			]
 		},
 		{
-			"seq": 13,
+			"seq": 12,
 			"type": "session.tool.settled",
 			"part": {
 				"tool": "bash",
@@ -84,44 +78,55 @@
 			}
 		},
 		{
-			"seq": 14,
+			"seq": 13,
 			"type": "session.turn.ended"
 		},
 		{
-			"seq": 15,
+			"seq": 14,
 			"type": "session.run.failed",
 			"reason": "truncated",
 			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
 		},
+		{
+			"seq": 15,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Now this."
+		},
 		{
 			"seq": 16,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 17,
 			"type": "session.prompt.promoted",
 			"delivery": "steer",
-			"text": "Then answer this."
+			"text": "Now this."
 		},
 		{
-			"seq": 17,
+			"seq": 18,
 			"type": "session.llm.started"
 		},
 		{
-			"seq": 18,
+			"seq": 19,
 			"type": "session.execution.interrupted",
 			"reason": "crash"
 		},
 		{
-			"seq": 19,
+			"seq": 20,
 			"type": "session.execution.started",
 			"resumed": true
 		},
 		{
-			"seq": 20,
+			"seq": 21,
 			"type": "session.llm.failed",
 			"reason": "error",
 			"errorMessage": "The host stopped while the model was answering, on attempt 1",
 			"parts": []
 		},
 		{
-			"seq": 21,
+			"seq": 22,
 			"type": "session.retry.scheduled",
 			"attempt": 1,
 			"maxRetries": 3,
@@ -129,11 +134,11 @@
 			"message": "The host stopped while the model was answering, on attempt 1"
 		},
 		{
-			"seq": 22,
+			"seq": 23,
 			"type": "session.llm.started"
 		},
 		{
-			"seq": 23,
+			"seq": 24,
 			"type": "session.llm.ended",
 			"reason": "stop",
 			"parts": [
@@ -143,48 +148,77 @@
 			]
 		},
 		{
-			"seq": 24,
+			"seq": 25,
 			"type": "session.turn.ended"
 		},
 		{
-			"seq": 25,
+			"seq": 26,
 			"type": "session.execution.succeeded"
 		}
 	],
-	"rows": [
+	"steps": [
 		{
 			"step": "in flight",
-			"state": "running",
-			"stateAt": "17 session.llm.started",
-			"startedAt": "3 session.execution.started",
-			"endedAt": "15 session.run.failed",
-			"outcome": "failed",
-			"error": {
-				"_tag": "runFailed",
-				"reason": "truncated",
-				"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
-			},
-			"execution": "running"
+			"head": 14,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Now this.",
+					"delivery": "steer",
+					"admittedSeq": 15,
+					"tail": 15,
+					"promotedSeq": 17
+				}
+			]
 		},
 		{
 			"step": "resumed",
-			"state": "running",
-			"stateAt": "22 session.llm.started",
-			"startedAt": "19 session.execution.started",
-			"endedAt": null,
-			"outcome": null,
-			"error": null,
-			"execution": "running"
+			"head": 14,
+			"restarts": 1,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Now this.",
+					"delivery": "steer",
+					"admittedSeq": 15,
+					"tail": 15,
+					"promotedSeq": 17
+				}
+			]
 		},
 		{
 			"step": "finished",
-			"state": "idle",
-			"stateAt": "25 session.execution.succeeded",
-			"startedAt": "19 session.execution.started",
-			"endedAt": "25 session.execution.succeeded",
-			"outcome": "succeeded",
-			"error": null,
-			"execution": null
+			"head": 14,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Now this.",
+					"delivery": "steer",
+					"admittedSeq": 15,
+					"tail": 15,
+					"promotedSeq": 17
+				}
+			]
 		}
 	],
 	"requests": [
@@ -237,7 +271,7 @@
 			},
 			{
 				"role": "user",
-				"text": "Then answer this."
+				"text": "Now this."
 			}
 		],
 		[
@@ -267,7 +301,7 @@
 			},
 			{
 				"role": "user",
-				"text": "Then answer this."
+				"text": "Now this."
 			}
 		]
 	]
diff --git a/packages/codework/test/__artifacts__/recovery.crashloop.json b/packages/codework/test/__artifacts__/recovery.crashloop.json
index a6202630..d3e6d136 100644
--- a/packages/codework/test/__artifacts__/recovery.crashloop.json
+++ b/packages/codework/test/__artifacts__/recovery.crashloop.json
@@ -236,7 +236,7 @@
 			"reason": "crashloop",
 			"message": "The run was interrupted 5 times in a row; it is not resumed again"
 		},
-		"execution": null
+		"head": 30
 	},
 	"requests": [
 		[
diff --git a/packages/codework/test/__artifacts__/recovery.interrupted.json b/packages/codework/test/__artifacts__/recovery.interrupted.json
index 88ba0a37..27a6215e 100644
--- a/packages/codework/test/__artifacts__/recovery.interrupted.json
+++ b/packages/codework/test/__artifacts__/recovery.interrupted.json
@@ -110,7 +110,7 @@
 			"reason": "interrupted",
 			"message": "The host stopped while the model was answering, on attempt 2"
 		},
-		"execution": null
+		"head": 16
 	},
 	"requests": [
 		[
diff --git a/packages/codework/test/__artifacts__/recovery.lifecycle.json b/packages/codework/test/__artifacts__/recovery.lifecycle.json
index 1f1c8114..a9838497 100644
--- a/packages/codework/test/__artifacts__/recovery.lifecycle.json
+++ b/packages/codework/test/__artifacts__/recovery.lifecycle.json
@@ -50,7 +50,7 @@
 			"endedAt": "9 session.execution.succeeded",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
+			"head": 0
 		},
 		{
 			"step": "in flight",
@@ -60,7 +60,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "killed",
@@ -70,7 +70,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "resumed",
@@ -80,7 +80,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "finished",
@@ -90,7 +90,7 @@
 			"endedAt": "21 session.execution.succeeded",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
+			"head": 0
 		}
 	],
 	"requests": [
diff --git a/packages/codework/test/__artifacts__/recovery.moved.json b/packages/codework/test/__artifacts__/recovery.moved.json
new file mode 100644
index 00000000..ca4cb7b0
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.moved.json
@@ -0,0 +1,312 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 9,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 11,
+			"type": "session.prompt.admitted",
+			"delivery": "followUp",
+			"text": "Then this."
+		},
+		{
+			"seq": 12,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 13,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 14,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 15,
+			"type": "session.run.failed",
+			"reason": "truncated",
+			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
+		},
+		{
+			"seq": 16,
+			"type": "session.prompt.updated"
+		},
+		{
+			"seq": 17,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 18,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Then this."
+		},
+		{
+			"seq": 19,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 20,
+			"type": "session.execution.interrupted",
+			"reason": "crash"
+		},
+		{
+			"seq": 21,
+			"type": "session.execution.started",
+			"resumed": true
+		},
+		{
+			"seq": 22,
+			"type": "session.llm.failed",
+			"reason": "error",
+			"errorMessage": "The host stopped while the model was answering, on attempt 1",
+			"parts": []
+		},
+		{
+			"seq": 23,
+			"type": "session.retry.scheduled",
+			"attempt": 1,
+			"maxRetries": 3,
+			"delayMs": 10,
+			"message": "The host stopped while the model was answering, on attempt 1"
+		},
+		{
+			"seq": 24,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 25,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answered after the kill."
+				}
+			]
+		},
+		{
+			"seq": 26,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 27,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"steps": [
+		{
+			"step": "resent",
+			"head": 15,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then this.",
+					"delivery": "followUp",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "moved",
+			"head": 15,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 16,
+					"promotedSeq": 18
+				}
+			]
+		},
+		{
+			"step": "finished",
+			"head": 15,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 16,
+					"promotedSeq": 18
+				}
+			]
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then this."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then this."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.parked.json b/packages/codework/test/__artifacts__/recovery.parked.json
new file mode 100644
index 00000000..09615d41
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.parked.json
@@ -0,0 +1,313 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run a long command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 9,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 11,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Then answer this."
+		},
+		{
+			"seq": 12,
+			"type": "session.prompt.admitted",
+			"delivery": "followUp",
+			"text": "And this."
+		},
+		{
+			"seq": 13,
+			"type": "session.prompt.updated"
+		},
+		{
+			"seq": 14,
+			"type": "session.llm.ended",
+			"reason": "length",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 15,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "skipped",
+				"result": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		},
+		{
+			"seq": 16,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 17,
+			"type": "session.run.failed",
+			"reason": "truncated",
+			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
+		},
+		{
+			"seq": 18,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 19,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 20,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Then answer this."
+		},
+		{
+			"seq": 21,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "And this."
+		},
+		{
+			"seq": 22,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 23,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 24,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answered with the queue."
+				}
+			]
+		},
+		{
+			"seq": 25,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 26,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"steps": [
+		{
+			"step": "parked",
+			"head": 17,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then answer this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": null
+				},
+				{
+					"text": "And this.",
+					"delivery": "steer",
+					"admittedSeq": 12,
+					"tail": 13,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "reopened",
+			"head": 17,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then answer this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": null
+				},
+				{
+					"text": "And this.",
+					"delivery": "steer",
+					"admittedSeq": 12,
+					"tail": 13,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": 17,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run a long command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Then answer this.",
+					"delivery": "steer",
+					"admittedSeq": 11,
+					"tail": 11,
+					"promotedSeq": 20
+				},
+				{
+					"text": "And this.",
+					"delivery": "steer",
+					"admittedSeq": 12,
+					"tail": 13,
+					"promotedSeq": 21
+				},
+				{
+					"text": "Next.",
+					"delivery": "steer",
+					"admittedSeq": 18,
+					"tail": 18,
+					"promotedSeq": 22
+				}
+			]
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run a long command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool call \"bash\" was not executed: the response hit the output token limit, so its arguments may be truncated. Re-issue the tool call with complete arguments."
+			},
+			{
+				"role": "user",
+				"text": "Then answer this."
+			},
+			{
+				"role": "user",
+				"text": "And this."
+			},
+			{
+				"role": "user",
+				"text": "Next."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.shutdown.json b/packages/codework/test/__artifacts__/recovery.shutdown.json
new file mode 100644
index 00000000..33cd96c0
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.shutdown.json
@@ -0,0 +1,84 @@
+{
+	"log": [
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 8,
+			"type": "session.execution.interrupted",
+			"reason": "shutdown"
+		},
+		{
+			"seq": 9,
+			"type": "session.execution.started",
+			"resumed": true
+		},
+		{
+			"seq": 10,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 13,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"stopped": {
+		"head": 0,
+		"restarts": 0,
+		"prompts": [
+			{
+				"text": "First.",
+				"delivery": "steer",
+				"admittedSeq": 2,
+				"tail": 2,
+				"promotedSeq": 4
+			}
+		]
+	},
+	"resumed": {
+		"head": 0,
+		"restarts": 0,
+		"prompts": [
+			{
+				"text": "First.",
+				"delivery": "steer",
+				"admittedSeq": 2,
+				"tail": 2,
+				"promotedSeq": 4
+			}
+		]
+	},
+	"finished": {
+		"head": 0,
+		"restarts": 0,
+		"prompts": [
+			{
+				"text": "First.",
+				"delivery": "steer",
+				"admittedSeq": 2,
+				"tail": 2,
+				"promotedSeq": 4
+			}
+		]
+	},
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "First."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "First."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.stop.json b/packages/codework/test/__artifacts__/recovery.stop.json
new file mode 100644
index 00000000..72298146
--- /dev/null
+++ b/packages/codework/test/__artifacts__/recovery.stop.json
@@ -0,0 +1,300 @@
+{
+	"log": [
+		{
+			"seq": 1,
+			"type": "session.created"
+		},
+		{
+			"seq": 2,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Run the stubborn command."
+		},
+		{
+			"seq": 3,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 4,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Run the stubborn command."
+		},
+		{
+			"seq": 5,
+			"type": "session.thread.system.changed"
+		},
+		{
+			"seq": 6,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 7,
+			"type": "session.llm.ended",
+			"reason": "toolUse",
+			"parts": [
+				{
+					"tool": "bash",
+					"status": "pending"
+				}
+			]
+		},
+		{
+			"seq": 8,
+			"type": "session.prompt.admitted",
+			"delivery": "followUp",
+			"text": "Queued before the stop."
+		},
+		{
+			"seq": 9,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Sent while stopping."
+		},
+		{
+			"seq": 10,
+			"type": "session.tool.settled",
+			"part": {
+				"tool": "bash",
+				"status": "aborted",
+				"result": "Tool Execution Interrupted"
+			}
+		},
+		{
+			"seq": 11,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 12,
+			"type": "session.execution.interrupted",
+			"reason": "user"
+		},
+		{
+			"seq": 13,
+			"type": "session.prompt.admitted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 14,
+			"type": "session.execution.started",
+			"resumed": false
+		},
+		{
+			"seq": 15,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Sent while stopping."
+		},
+		{
+			"seq": 16,
+			"type": "session.prompt.promoted",
+			"delivery": "steer",
+			"text": "Next."
+		},
+		{
+			"seq": 17,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 18,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answer 1."
+				}
+			]
+		},
+		{
+			"seq": 19,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 20,
+			"type": "session.prompt.promoted",
+			"delivery": "followUp",
+			"text": "Queued before the stop."
+		},
+		{
+			"seq": 21,
+			"type": "session.llm.started"
+		},
+		{
+			"seq": 22,
+			"type": "session.llm.ended",
+			"reason": "stop",
+			"parts": [
+				{
+					"text": "Answer 2."
+				}
+			]
+		},
+		{
+			"seq": 23,
+			"type": "session.turn.ended"
+		},
+		{
+			"seq": 24,
+			"type": "session.execution.succeeded"
+		}
+	],
+	"steps": [
+		{
+			"step": "stopped",
+			"head": 12,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run the stubborn command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Queued before the stop.",
+					"delivery": "followUp",
+					"admittedSeq": 8,
+					"tail": 8,
+					"promotedSeq": null
+				},
+				{
+					"text": "Sent while stopping.",
+					"delivery": "steer",
+					"admittedSeq": 9,
+					"tail": 9,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "reopened",
+			"head": 12,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run the stubborn command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Queued before the stop.",
+					"delivery": "followUp",
+					"admittedSeq": 8,
+					"tail": 8,
+					"promotedSeq": null
+				},
+				{
+					"text": "Sent while stopping.",
+					"delivery": "steer",
+					"admittedSeq": 9,
+					"tail": 9,
+					"promotedSeq": null
+				}
+			]
+		},
+		{
+			"step": "next prompt",
+			"head": 12,
+			"restarts": 0,
+			"prompts": [
+				{
+					"text": "Run the stubborn command.",
+					"delivery": "steer",
+					"admittedSeq": 2,
+					"tail": 2,
+					"promotedSeq": 4
+				},
+				{
+					"text": "Queued before the stop.",
+					"delivery": "followUp",
+					"admittedSeq": 8,
+					"tail": 8,
+					"promotedSeq": 20
+				},
+				{
+					"text": "Sent while stopping.",
+					"delivery": "steer",
+					"admittedSeq": 9,
+					"tail": 9,
+					"promotedSeq": 15
+				},
+				{
+					"text": "Next.",
+					"delivery": "steer",
+					"admittedSeq": 13,
+					"tail": 13,
+					"promotedSeq": 16
+				}
+			]
+		}
+	],
+	"requests": [
+		[
+			{
+				"role": "user",
+				"text": "Run the stubborn command."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run the stubborn command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool Execution Interrupted"
+			},
+			{
+				"role": "user",
+				"text": "Sent while stopping."
+			},
+			{
+				"role": "user",
+				"text": "Next."
+			}
+		],
+		[
+			{
+				"role": "user",
+				"text": "Run the stubborn command."
+			},
+			{
+				"role": "assistant",
+				"calls": [
+					"bash"
+				]
+			},
+			{
+				"role": "tool",
+				"text": "Tool Execution Interrupted"
+			},
+			{
+				"role": "user",
+				"text": "Sent while stopping."
+			},
+			{
+				"role": "user",
+				"text": "Next."
+			},
+			{
+				"role": "assistant",
+				"text": "Answer 1."
+			},
+			{
+				"role": "user",
+				"text": "Queued before the stop."
+			}
+		]
+	]
+}
diff --git a/packages/codework/test/__artifacts__/recovery.truncated.json b/packages/codework/test/__artifacts__/recovery.truncated.json
index 6da9d032..45823938 100644
--- a/packages/codework/test/__artifacts__/recovery.truncated.json
+++ b/packages/codework/test/__artifacts__/recovery.truncated.json
@@ -118,7 +118,7 @@
 			"reason": "truncated",
 			"message": "The response hit the output token limit with tool calls 2 times in a row; the run is ended"
 		},
-		"execution": null
+		"head": 14
 	},
 	"requests": [
 		[
diff --git a/packages/codework/test/__artifacts__/sync.thread.json b/packages/codework/test/__artifacts__/sync.thread.json
index c5724a60..50148d8c 100644
--- a/packages/codework/test/__artifacts__/sync.thread.json
+++ b/packages/codework/test/__artifacts__/sync.thread.json
@@ -195,7 +195,7 @@
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 8>"
+			"rev": "<rev 7>"
 		}
 	],
 	"settled": [
@@ -221,7 +221,7 @@
 				],
 				"size": 89
 			},
-			"rev": "<rev 9>"
+			"rev": "<rev 8>"
 		},
 		{
 			"_tag": "Entry",
@@ -241,7 +241,7 @@
 				],
 				"size": 38
 			},
-			"rev": "<rev 10>"
+			"rev": "<rev 9>"
 		},
 		{
 			"_tag": "Inbox",
@@ -253,7 +253,7 @@
 				"createdAt": "<time>"
 			},
 			"state": "promoted",
-			"rev": "<rev 10>"
+			"rev": "<rev 9>"
 		},
 		{
 			"_tag": "Entry",
@@ -273,12 +273,12 @@
 				],
 				"size": 35
 			},
-			"rev": "<rev 11>"
+			"rev": "<rev 10>"
 		},
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 12>"
+			"rev": "<rev 11>"
 		}
 	],
 	"streamed": [
@@ -354,7 +354,7 @@
 				],
 				"size": 89
 			},
-			"rev": "<rev 9>"
+			"rev": "<rev 8>"
 		}
 	],
 	"otherThread": {
diff --git a/packages/codework/test/cli.test.ts b/packages/codework/test/cli.test.ts
index e9778904..ac59fb4d 100644
--- a/packages/codework/test/cli.test.ts
+++ b/packages/codework/test/cli.test.ts
@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it, onTestFinished } from "vite-plus/test";
-import { runCli, truncating, writeSettings } from "./fixtures/cli.ts";
+import { runCli, serveCli, streaming, toolCalls, truncating, writeSettings } from "./fixtures/cli.ts";
 
 const cli = fileURLToPath(new URL("../src/index.ts", import.meta.url));
 const models = fileURLToPath(new URL("../../../models.gen.json", import.meta.url));
@@ -480,6 +480,29 @@ describe("codework CLI", () => {
 		).toMatchFileSnapshot("./__artifacts__/cli.truncated.json");
 	}, 60_000);
 
+	// A run ends with `session.run.failed`, never a success: a remote run must take that as its end.
+	it("reports a remote run ended by replies cut off with tool calls, and exits 1", async () => {
+		const home = mkdtempSync(join(tmpdir(), "codework-cli-run-failed-"));
+		onTestFinished(() => rmSync(home, { recursive: true, force: true }));
+		const fake = await streaming((_body, response) => {
+			response.send(toolCalls([{ name: "bash", arguments: { command: "echo cut" } }]));
+			response.finish("length");
+		});
+		writeSettings(home, fake.url);
+		const env = { ...process.env, HOME: home, CODEWORK_MODELS_FILE: models };
+		const server = await serveCli(["--home", home, "--user-config-dir", home], { cwd: home, env });
+
+		const result = await runCli(["run", "--server", server.url, "Run a long command."], { cwd: home, env });
+
+		expect(result.status, result.stderr).toBe(1);
+		expect(fake.requests).toHaveLength(2);
+		const message = "The response hit the output token limit with tool calls 2 times in a row; the run is ended";
+		expect(result.stderr, result.stderr).toContain(message);
+		await expect(
+			`${JSON.stringify({ status: result.status, stderr: result.stderr.slice(result.stderr.indexOf("error")) }, null, "\t")}\n`,
+		).toMatchFileSnapshot("./__artifacts__/cli.run-failed.json");
+	}, 60_000);
+
 	it("reports a failed refresh", () => {
 		const result = runIsolated(
 			{ CODEWORK_MODELS_FILE: undefined, CODEWORK_CATALOG_URL: "http://127.0.0.1:1/v1/models.json" },
diff --git a/packages/codework/test/client.test.ts b/packages/codework/test/client.test.ts
new file mode 100644
index 00000000..b149eb6e
--- /dev/null
+++ b/packages/codework/test/client.test.ts
@@ -0,0 +1,83 @@
+import { EventList, EventSchema, PromptSchema, Session } from "@codeworksh/harness/effect";
+import { DateTime, Effect, Exit, Queue, Stream } from "effect";
+import { describe, expect, it } from "vite-plus/test";
+import { Client } from "../src/server/client.ts";
+import { Envelope, type EventEnvelope } from "../src/server/envelope.ts";
+
+/*
+ * Notifications of one thread may arrive out of log order: a prompt's admission is published by the
+ * RPC that sent it, a run's events by the run. A real server cannot be made to reorder them on
+ * demand, so a stub delivers them in the order under test.
+ */
+
+const sessionId = Session.SessionSchema.ID.create();
+const threadId = Session.ThreadSchema.ID.create();
+const durable = (seq: number) => ({ aggregateId: sessionId, seq, version: 1 });
+
+const envelope = (type: string, seq: number, data: Record<string, unknown>) =>
+	Envelope.encode({
+		id: EventSchema.ID.create(),
+		type,
+		durable: durable(seq),
+		data: { sessionId, threadId, timestamp: DateTime.makeUnsafe(seq), ...data },
+	} as EventSchema.Payload);
+
+/** A client whose server answers its prompt with `events`, delivered in the order given. */
+const stub = (
+	events: (messageId: Session.SessionMessageSchema.ID) => ReadonlyArray<ReturnType<typeof Envelope.encode>>,
+) =>
+	Effect.gen(function* () {
+		const queue = yield* Queue.unbounded<EventEnvelope>();
+		yield* Queue.offer(
+			queue,
+			yield* Envelope.encode({ id: EventSchema.ID.create(), type: Envelope.Connected.type, data: {} }),
+		);
+		const rpc = {
+			"event.subscribe": () => Stream.fromQueue(queue),
+			"thread.prompt": ({ id }: { readonly id: Session.SessionMessageSchema.ID }) =>
+				Effect.forEach(events(id), (next) => Effect.flatMap(next, (one) => Queue.offer(queue, one))).pipe(
+					Effect.orDie,
+					Effect.as({ threadId }),
+				),
+			"thread.wait": () => Effect.void,
+			"thread.message": () => Effect.succeed({ found: false }),
+		};
+		return rpc as unknown as Client.Client;
+	});
+
+const admitted = (messageId: Session.SessionMessageSchema.ID, seq: number) =>
+	envelope(EventList.PromptAdmitted.type, seq, {
+		messageId,
+		prompt: PromptSchema.Prompt.fromText("ours"),
+		delivery: "followUp",
+	});
+const started = (seq: number) => envelope(EventList.ExecutionStarted.type, seq, { resumed: false });
+const failed = (seq: number) =>
+	envelope(EventList.ExecutionFailed.type, seq, { error: { type: "provider", message: "their run failed" } });
+
+const run = (events: Parameters<typeof stub>[0]) =>
+	Effect.gen(function* () {
+		const rpc = yield* stub(events);
+		return yield* Client.run(rpc, { sessionId, threadId, text: "ours" }, () => Effect.void).pipe(Effect.exit);
+	}).pipe(Effect.timeout("5 seconds"), Effect.runPromise);
+
+const failure = (exit: Exit.Exit<void, unknown>) =>
+	Exit.isFailure(exit) ? (exit.cause.reasons[0] as { readonly error?: unknown } | undefined)?.error : undefined;
+
+describe("Client.run attribution", () => {
+	// Another client's run started at 10 and failed at 12; our prompt was admitted at 11, between them.
+	it("does not hang or adopt another run's failure notified before its own admission", async () => {
+		const exit = await run((id) => [started(10), failed(12), admitted(id, 11)]);
+		expect(failure(exit)).toMatchObject({ type: "unknown", message: "Prompt was not promoted" });
+	});
+
+	it("does not adopt another run's failure when its start is notified after the admission", async () => {
+		const exit = await run((id) => [admitted(id, 11), started(10), failed(12)]);
+		expect(failure(exit)).toMatchObject({ type: "unknown", message: "Prompt was not promoted" });
+	});
+
+	it("adopts the failure of the run its prompt woke, before promoting it", async () => {
+		const exit = await run((id) => [admitted(id, 11), started(12), failed(13)]);
+		expect(failure(exit)).toMatchObject({ type: "provider", message: "their run failed" });
+	});
+});
diff --git a/packages/codework/test/fixtures/cli.ts b/packages/codework/test/fixtures/cli.ts
index a4e922d7..e9b47dfc 100644
--- a/packages/codework/test/fixtures/cli.ts
+++ b/packages/codework/test/fixtures/cli.ts
@@ -179,6 +179,8 @@ export interface Served {
 	readonly url: string;
 	/** SIGKILLs the server, as a host dying would, and resolves once it is gone. */
 	readonly kill: () => Promise<void>;
+	/** SIGTERMs the server, a clean shutdown, and resolves once it is gone. */
+	readonly stop: () => Promise<void>;
 }
 
 /** Starts `codework serve` from source on an ephemeral port; resolves once it listens. */
@@ -192,10 +194,11 @@ export const serveCli = (
 			env: options.env,
 		});
 		const exited = new Promise<void>((done) => child.on("exit", () => done()));
-		const kill = () => {
-			if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+		const signal = (name: NodeJS.Signals) => () => {
+			if (child.exitCode === null && child.signalCode === null) child.kill(name);
 			return exited;
 		};
+		const kill = signal("SIGKILL");
 		onTestFinished(kill);
 		let output = "";
 		const deadline = setTimeout(() => {
@@ -207,7 +210,7 @@ export const serveCli = (
 			const url = /listening on (ws:\/\/\S+)/.exec(output)?.[1];
 			if (url === undefined) return;
 			clearTimeout(deadline);
-			resolve({ url, kill });
+			resolve({ url, kill, stop: signal("SIGTERM") });
 		};
 		child.stdout.on("data", listen);
 		child.stderr.on("data", (data: Buffer) => (output += data.toString("utf8")));
diff --git a/packages/codework/test/recovery.test.ts b/packages/codework/test/recovery.test.ts
index 19185a5a..8bfc8bdc 100644
--- a/packages/codework/test/recovery.test.ts
+++ b/packages/codework/test/recovery.test.ts
@@ -1,8 +1,8 @@
 /* @effect-diagnostics nodeBuiltinImport:off -- this suite writes its home and settings with node:fs. */
 /* @effect-diagnostics globalTimers:off -- polling for a dying server runs outside any Effect. */
 /* @effect-diagnostics globalDate:off -- so does its deadline. */
-import { Control } from "@codeworksh/harness/effect";
-import { Effect, Fiber, Layer, Stream } from "effect";
+import { Control, Session } from "@codeworksh/harness/effect";
+import { Effect, Fiber, Layer, Predicate, Stream } from "effect";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { DatabaseSync } from "node:sqlite";
@@ -35,6 +35,12 @@ const setup = (url: string, settings: object = {}) => {
 	return { home, project, start };
 };
 
+/** A connection that never opened sent nothing, so opening another is safe; a loaded host can be slow to accept. */
+const unopened = (error: unknown) =>
+	Predicate.isTagged(error, "RpcClientError") &&
+	Predicate.hasProperty(error, "reason") &&
+	Predicate.isTagged(error.reason, "SocketOpenError");
+
 /** One RPC exchange over its own connection. */
 const call = <A, E>(url: string, use: (rpc: Client.Client) => Effect.Effect<A, E>) =>
 	Effect.runPromise(
@@ -42,7 +48,7 @@ const call = <A, E>(url: string, use: (rpc: Client.Client) => Effect.Effect<A, E
 			const context = yield* Layer.build(Client.layer(url));
 			const rpc = yield* Client.make.pipe(Effect.provideContext(context));
 			return yield* use(rpc);
-		}).pipe(Effect.scoped),
+		}).pipe(Effect.scoped, Effect.retry({ times: 2, while: unopened })),
 	);
 
 type Ids = { readonly sessionId: Parameters<Client.Client["thread.wait"]>[0]["sessionId"] };
@@ -208,7 +214,7 @@ const runRow = (home: string, threadId: string, events: ReadonlyArray<EventEnvel
 	const db = new DatabaseSync(join(home, "data", "codework.db"));
 	const row = db
 		.prepare(
-			"SELECT run_state, run_state_at, run_started_at, run_ended_at, run_outcome, run_error, execution FROM thread WHERE id = ?",
+			"SELECT run_state, run_state_at, run_started_at, run_ended_at, run_outcome, run_error, head FROM thread WHERE id = ?",
 		)
 		.get(threadId)!;
 	db.close();
@@ -235,7 +241,7 @@ const runRow = (home: string, threadId: string, events: ReadonlyArray<EventEnvel
 		endedAt: at("run_ended_at", ends),
 		outcome: row["run_outcome"],
 		error: row["run_error"] === null ? null : JSON.parse(String(row["run_error"])),
-		execution: row["execution"],
+		head: row["head"],
 	};
 };
 
@@ -246,6 +252,34 @@ const endedRow = async (url: string, home: string, ids: Ids & { readonly threadI
 	return row;
 };
 
+/** Cuts the reply off at the output limit with a tool call, as a run that gets truncated sees it. */
+const truncate = (response: Reply) => {
+	response.send(toolCalls([{ name: "bash", arguments: { command: "echo cut" } }]));
+	response.finish("length");
+};
+
+/** The thread's head and restart count, and each prompt's tail, read from the database file. */
+const positions = (home: string, threadId: string) => {
+	const db = new DatabaseSync(join(home, "data", "codework.db"));
+	const thread = db.prepare("SELECT head, restarts FROM thread WHERE id = ?").get(threadId)!;
+	const prompts = db
+		.prepare(
+			"SELECT data, delivery, admitted_seq, tail, promoted_seq FROM inbox WHERE thread_id = ? ORDER BY admitted_seq",
+		)
+		.all(threadId)
+		.map((row) => ({
+			text: (JSON.parse(String(row["data"])) as { parts: ReadonlyArray<{ text?: string }> }).parts
+				.map((one) => one.text)
+				.join(""),
+			delivery: row["delivery"],
+			admittedSeq: row["admitted_seq"],
+			tail: row["tail"],
+			promotedSeq: row["promoted_seq"],
+		}));
+	db.close();
+	return { head: Number(thread["head"]), restarts: Number(thread["restarts"]), prompts };
+};
+
 describe("recovery after the host is killed", () => {
 	it("the stored run of a killed host is swept as a crash before clients connect, then resumed", async () => {
 		const resend = gate();
@@ -268,6 +302,8 @@ describe("recovery after the host is killed", () => {
 		record("succeeded", await log(first.url, ids));
 		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Second." }));
 		const inFlight = await logged(first.url, ids, "session.llm.started", 2);
+		// `llm.started` goes out before the request: killed sooner, the resend would take the hanging slot.
+		await until("the second request", () => fake.requests.length === 2);
 		record("in flight", inFlight);
 		await first.kill();
 		// What the dead host left: the run still open.
@@ -292,7 +328,7 @@ describe("recovery after the host is killed", () => {
 		);
 		// Swept first, resumed after, with nothing of the run in between.
 		expect(resumed).toBe(swept + 1);
-		expect(rows.find((row) => row.step === "resumed")).toMatchObject({ state: "running", execution: "running" });
+		expect(rows.find((row) => row.step === "resumed")).toMatchObject({ state: "running" });
 
 		const lifecycle = new Set([
 			"session.execution.started",
@@ -416,11 +452,14 @@ describe("recovery after the host is killed", () => {
 		await logged(first.url, ids, "session.llm.started");
 		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then this.", delivery: "followUp" }));
 		await logged(first.url, ids, "session.prompt.admitted", 2);
+		await until("the request", () => fake.requests.length === 1);
 		await first.kill();
 
 		// The one retry: the request is resent, and the host dies with it in flight again.
 		const second = await start();
 		await logged(second.url, ids, "session.llm.started", 2);
+		// `llm.started` goes out before the request: wait for it, or the kill can beat the resend.
+		await until("the resend", () => fake.requests.length === 2);
 		await second.kill();
 
 		const third = await start();
@@ -462,6 +501,7 @@ describe("recovery after the host is killed", () => {
 		// The first run, then a resume each until the limit: each dies with its request in flight.
 		for (let started = 1; started <= Control.RESTART_LIMIT; started++) {
 			await logged(server.url, ids, "session.llm.started", started);
+			await until(`request ${started}`, () => fake.requests.length === started);
 			await server.kill();
 			server = await start();
 		}
@@ -565,18 +605,188 @@ describe("recovery after the host is killed", () => {
 		).toMatchFileSnapshot("./__artifacts__/recovery.truncated.json");
 	}, 90_000);
 
-	it("a prompt sent while a run is ending as truncated keeps its run resumable across a kill", async () => {
+	it("prompts sent while a run fails are parked: a kill runs none of them, the next prompt runs them all", async () => {
+		const cut = gate();
+		const fake = await streaming((_body, response, index) => {
+			if (index === 0) return truncate(response);
+			// The second cut-off ends the run: held until the prompts are in.
+			if (index === 1) return void cut.opened.then(() => truncate(response));
+			answer(response, "Answered with the queue.");
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run a long command." }));
+		await logged(first.url, ids, "session.llm.started", 2);
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then answer this." }));
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "And this.", delivery: "followUp" }));
+		const queued = await call(first.url, (rpc) => rpc["thread.queue"](ids));
+		const moved = queued.entries.find((entry) => entry.text === "And this.")!;
+		// Moved to steer while the run is still failing: that wake is before the end too.
+		await call(first.url, (rpc) =>
+			rpc["thread.update"]({ ...ids, messageId: Session.SessionMessageSchema.ID.make(moved.id), delivery: "steer" }),
+		);
+		cut.open();
+		await logged(first.url, ids, "session.run.failed");
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		record("parked");
+		expect(fake.requests).toHaveLength(2);
+		await first.kill();
+
+		const second = await start();
+		const reopened = await call(second.url, (rpc) => rpc["thread.queue"](ids));
+		record("reopened");
+		expect(reopened.entries.map((entry) => [entry.delivery, entry.text])).toEqual([
+			["steer", "Then answer this."],
+			["steer", "And this."],
+		]);
+		await call(second.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Next." }));
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		record("next prompt");
+
+		// Nothing ran between the failure and the next prompt, which took the parked queue with it.
+		expect(fake.requests).toHaveLength(3);
+		const events = await log(second.url, ids);
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				// Read from the database file: head, and each prompt's tail, across the kill.
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.parked.json");
+	}, 90_000);
+
+	it("a prompt sent after a run failed runs, and is resumed after a kill", async () => {
+		const resend = gate();
+		const fake = await streaming((_body, response, index) => {
+			if (index <= 1) return truncate(response);
+			// The prompt's run, killed with its request in flight; then its resend.
+			if (index === 2) return hang(response);
+			void resend.opened.then(() => answer(response, "Answered after the kill."));
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run a long command." }));
+		await logged(first.url, ids, "session.run.failed");
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Now this." }));
+		await logged(first.url, ids, "session.llm.started", 3);
+		// `llm.started` goes out before the request: killed sooner, the resend would take the hanging slot.
+		await until("the prompt's request", () => fake.requests.length === 3);
+		record("in flight");
+		await first.kill();
+
+		const second = await start();
+		await logged(second.url, ids, "session.llm.started", 4);
+		record("resumed");
+		resend.open();
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		record("finished");
+
+		expect(fake.requests).toHaveLength(4);
+		expect(sent(fake.requests[3]!)).toEqual(sent(fake.requests[2]!));
+		const events = await log(second.url, ids);
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.after-failure.json");
+	}, 90_000);
+
+	it("a stop parks what was queued and what was sent while it wound down: a kill runs none, the next prompt runs all", async () => {
+		const marker = join(realpathSync(mkdtempSync(join(tmpdir(), "codework-recovery-marker-"))), "ran");
+		onTestFinished(() => rmSync(join(marker, ".."), { recursive: true, force: true }));
+		const fake = await streaming((_body, response, index) => {
+			if (index > 0) return answer(response, `Answer ${index}.`);
+			// Ignores SIGTERM, so the stop winds down for the whole force-kill grace.
+			response.send(
+				toolCalls([{ name: "bash", arguments: { command: `trap '' TERM; echo ran > ${marker}; sleep 20` } }]),
+			);
+			response.finish("tool_calls");
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
+
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run the stubborn command." }));
+		await until("the tool to run", () => existsSync(marker));
+		await call(first.url, (rpc) =>
+			rpc["thread.prompt"]({ ...ids, text: "Queued before the stop.", delivery: "followUp" }),
+		);
+		// Sent together on one connection: the prompt waits for no reply, so it lands inside the kill grace.
+		await call(first.url, (rpc) =>
+			Effect.all([rpc["thread.interrupt"](ids), rpc["thread.prompt"]({ ...ids, text: "Sent while stopping." })], {
+				concurrency: "unbounded",
+			}),
+		);
+		await logged(first.url, ids, "session.execution.interrupted");
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		record("stopped");
+		const stopped = await log(first.url, ids);
+		const seqOf = (type: string, text?: string) =>
+			stopped.find(
+				(event) =>
+					event.type === type && (text === undefined || (summary(event) as { text?: string }).text === text),
+			)!.durable!.seq;
+		// The prompt really landed while the stop wound down: after the stop was asked, before it ended.
+		expect(seqOf("session.prompt.admitted", "Sent while stopping.")).toBeLessThan(
+			seqOf("session.execution.interrupted"),
+		);
+		expect(fake.requests).toHaveLength(1);
+		await first.kill();
+
+		const second = await start();
+		const reopened = await call(second.url, (rpc) => rpc["thread.queue"](ids));
+		record("reopened");
+		expect(reopened.entries.map((entry) => entry.text)).toEqual(["Queued before the stop.", "Sent while stopping."]);
+		await call(second.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Next." }));
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		record("next prompt");
+
+		// Steers with the next prompt, the follow-up once they are answered.
+		expect(fake.requests.map((request) => sent(request).at(-1)?.text)).toEqual([
+			"Run the stubborn command.",
+			"Next.",
+			"Queued before the stop.",
+		]);
+		const events = await log(second.url, ids);
+		await expect(
+			artifact({
+				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.stop.json");
+	}, 90_000);
+
+	it("a parked prompt moved to steer runs now and is resumed after a kill; resending it changes nothing", async () => {
 		const cut = gate();
 		const resend = gate();
-		const truncate = (response: Reply) => {
-			response.send(toolCalls([{ name: "bash", arguments: { command: "echo cut" } }]));
-			response.finish("length");
-		};
 		const fake = await streaming((_body, response, index) => {
 			if (index === 0) return truncate(response);
-			// The second cut-off ends the run: held until the prompt is in.
 			if (index === 1) return void cut.opened.then(() => truncate(response));
-			// The run the prompt woke, killed with its request in flight; then its resend.
+			// The run the move started, killed with its request in flight; then its resend.
 			if (index === 2) return hang(response);
 			void resend.opened.then(() => answer(response, "Answered after the kill."));
 		});
@@ -585,40 +795,95 @@ describe("recovery after the host is killed", () => {
 		const first = await start();
 		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
 		const ids = { sessionId: created.session.id, threadId: created.id };
-		const rows: Array<{ step: string } & ReturnType<typeof runRow>> = [];
-		const record = (step: string, events: ReadonlyArray<EventEnvelope>) =>
-			rows.push({ step, ...runRow(home, ids.threadId, events) });
+		const steps: Array<{ step: string } & ReturnType<typeof positions>> = [];
+		const record = (step: string) => steps.push({ step, ...positions(home, ids.threadId) });
 
 		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Run a long command." }));
 		await logged(first.url, ids, "session.llm.started", 2);
-		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then answer this." }));
-		await logged(first.url, ids, "session.prompt.admitted", 2);
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Then this.", delivery: "followUp" }));
 		cut.open();
 		await logged(first.url, ids, "session.run.failed");
-		const inFlight = await logged(first.url, ids, "session.llm.started", 3);
-		record("in flight", inFlight);
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		const [parked] = (await call(first.url, (rpc) => rpc["thread.queue"](ids))).entries;
+		const messageId = Session.SessionMessageSchema.ID.make(parked!.id);
+
+		// A retry of the same request is the same prompt: it stays parked.
+		await call(first.url, (rpc) =>
+			rpc["thread.prompt"]({ ...ids, id: messageId, text: "Then this.", delivery: "followUp" }),
+		);
+		await call(first.url, (rpc) => rpc["thread.wait"](ids));
+		record("resent");
+		expect(fake.requests).toHaveLength(2);
+
+		await call(first.url, (rpc) => rpc["thread.update"]({ ...ids, messageId, delivery: "steer" }));
+		await logged(first.url, ids, "session.llm.started", 3);
+		await until("the moved prompt's request", () => fake.requests.length === 3);
+		record("moved");
 		await first.kill();
 
 		const second = await start();
-		record("resumed", await logged(second.url, ids, "session.llm.started", 4));
+		await logged(second.url, ids, "session.llm.started", 4);
 		resend.open();
 		await logged(second.url, ids, "session.execution.succeeded");
 		await call(second.url, (rpc) => rpc["thread.wait"](ids));
-		const events = await log(second.url, ids);
-		record("finished", events);
+		record("finished");
 
-		expect(rows.find((row) => row.step === "in flight")).toMatchObject({ execution: "running" });
 		expect(fake.requests).toHaveLength(4);
 		expect(sent(fake.requests[3]!)).toEqual(sent(fake.requests[2]!));
-
+		const events = await log(second.url, ids);
 		await expect(
 			artifact({
 				log: events.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
-				// Read from the database file: the woken run in flight when the host died, resumed, finished.
-				rows,
+				steps,
+				requests: fake.requests.map(sent),
+			}),
+		).toMatchFileSnapshot("./__artifacts__/recovery.moved.json");
+	}, 90_000);
+
+	it("a run a clean shutdown stopped resumes without counting a restart", async () => {
+		const resend = gate();
+		const fake = await streaming((_body, response, index) => {
+			if (index === 0) return hang(response);
+			void resend.opened.then(() => answer(response, "Answered after the restart."));
+		});
+		const { home, start } = setup(fake.url, retry);
+
+		const first = await start();
+		const created = await call(first.url, (rpc) => rpc["session.create"]({}));
+		const ids = { sessionId: created.session.id, threadId: created.id };
+		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "First." }));
+		await logged(first.url, ids, "session.llm.started");
+		await until("the request", () => fake.requests.length === 1);
+		await first.stop();
+		const stopped = positions(home, ids.threadId);
+
+		const second = await start();
+		await logged(second.url, ids, "session.llm.started", 2);
+		await until("the resend", () => fake.requests.length === 2);
+		// Read while the resumed run is in flight: a run that completes resets the count either way.
+		const resumed = positions(home, ids.threadId);
+		resend.open();
+		await logged(second.url, ids, "session.execution.succeeded");
+		await call(second.url, (rpc) => rpc["thread.wait"](ids));
+		const events = await log(second.url, ids);
+
+		expect(stopped.restarts).toBe(0);
+		expect(resumed.restarts).toBe(0);
+		expect(summary(events.find((event) => event.type === "session.execution.interrupted")!)).toEqual({
+			type: "session.execution.interrupted",
+			reason: "shutdown",
+		});
+		await expect(
+			artifact({
+				log: events
+					.filter((event) => event.type.startsWith("session.execution.") || event.type === "session.llm.started")
+					.map((event) => ({ seq: event.durable?.seq, ...summary(event) })),
+				stopped,
+				resumed,
+				finished: positions(home, ids.threadId),
 				requests: fake.requests.map(sent),
 			}),
-		).toMatchFileSnapshot("./__artifacts__/recovery.ending.json");
+		).toMatchFileSnapshot("./__artifacts__/recovery.shutdown.json");
 	}, 90_000);
 
 	it("a deferred tool loaded before the host died is still offered to the resent request", async () => {
@@ -645,6 +910,7 @@ describe("recovery after the host is killed", () => {
 		const ids = { sessionId: created.session.id, threadId: created.id };
 		await call(first.url, (rpc) => rpc["thread.prompt"]({ ...ids, text: "Find the echo tool." }));
 		await logged(first.url, ids, "session.llm.started", 2);
+		await until("the second request", () => fake.requests.length === 2);
 		await first.kill();
 
 		const second = await start();
diff --git a/packages/codework/test/server.test.ts b/packages/codework/test/server.test.ts
index c56f21c0..136581c1 100644
--- a/packages/codework/test/server.test.ts
+++ b/packages/codework/test/server.test.ts
@@ -1017,7 +1017,7 @@ describe("WebSocket client", () => {
 				expect(`${JSON.stringify(artifact, null, "\t")}\n`).toMatchFileSnapshot("./__artifacts__/server.fork.json"),
 			));
 
-	it("does not adopt a failure that belongs to another client's prompt", () =>
+	it("leaves its prompt queued behind another client's failed run, without adopting that failure", () =>
 		Effect.gen(function* () {
 			const firstEntered = yield* Deferred.make<void>();
 			const release = yield* Deferred.make<void>();
@@ -1054,8 +1054,14 @@ describe("WebSocket client", () => {
 				}
 				yield* Deferred.succeed(release, undefined);
 
-				// The successor drain promotes ours; the remembered failure is dropped.
-				yield* Fiber.join(ours);
+				// Their run failing does not start the next one: ours stays queued, and their failure is not ours.
+				const exit = yield* Fiber.await(ours);
+				expect(exit).toMatchObject({
+					_tag: "Failure",
+					cause: { reasons: [{ error: { type: "unknown", message: "Prompt was not promoted" } }] },
+				});
+				const queued = yield* rpc["thread.queue"]({ sessionId: session.session.id, threadId: session.id });
+				expect(queued.entries.map((entry) => entry.text)).toEqual(["ours"]);
 			}).pipe(
 				Effect.scoped,
 				Effect.provide(
diff --git a/packages/harness/src/control.ts b/packages/harness/src/control.ts
index c10435aa..0640f15a 100644
--- a/packages/harness/src/control.ts
+++ b/packages/harness/src/control.ts
@@ -101,16 +101,16 @@ export interface Interface {
 	/** Threads this process is currently draining. */
 	readonly active: Effect.Effect<ReadonlySet<ThreadSchema.ID>>;
 	/**
-	 * Resumes the runs the last process left unfinished, as the server starts. One a crash cut off
-	 * counts a restart, one a shutdown closed does not; at {@link RESTART_LIMIT} the run ends visibly
-	 * instead, the thread idle with its queue kept for the next prompt. Resolves once every resumed
-	 * run has settled.
+	 * Resumes the runs the last process left unfinished, as the server starts: a run a crash or a
+	 * shutdown cut off, or a prompt woken past the thread's head. A crash counts a restart, a shutdown
+	 * does not; at {@link RESTART_LIMIT} the run ends visibly instead, its queue parked for the next
+	 * prompt. Resolves once every resumed run has settled.
 	 */
 	readonly resumeUnfinished: Effect.Effect<void>;
 	/**
-	 * Ends every stored run the last process left open with a durable `execution.interrupted`:
-	 * `shutdown` where it closed the run, `crash` where it died in it. Runs as the server starts,
-	 * before it accepts connections and before {@link resumeUnfinished}.
+	 * Ends every stored run the last process left open with a durable `execution.interrupted`
+	 * `crash`: a shutdown ends its runs itself. Runs as the server starts, before it accepts
+	 * connections and before {@link resumeUnfinished}.
 	 */
 	readonly sweep: Effect.Effect<void>;
 	/** Prompts admitted but not yet in the conversation, steers and follow-ups, in admission order. */
@@ -142,9 +142,9 @@ export const layer = Layer.effect(
 		const events = yield* Event.Service;
 		const isLifecycleConflict = Schema.is(Inbox.LifecycleConflict);
 
-		// Marked before the wake, so a prompt accepted here survives a crash before its run starts.
-		const wake = (threadId: ThreadSchema.ID) =>
-			threads.markRunning(threadId).pipe(Effect.andThen(execution.wake(threadId)));
+		// Only a hint: the admission or move to steer already recorded the prompt's tail, which is what makes
+		// it run, now or after a crash.
+		const wake = (threadId: ThreadSchema.ID) => execution.wake(threadId);
 
 		const resolve = Effect.fn("Control.resolve")(function* (ref: ThreadRef) {
 			if (ref.threadId === undefined) {
@@ -215,7 +215,6 @@ export const layer = Layer.effect(
 
 		const resume = Effect.fn("Control.resume")(function* (threadId: ThreadSchema.ID) {
 			yield* requireThread(threadId);
-			yield* threads.markRunning(threadId);
 			yield* execution.resume(threadId);
 		});
 
@@ -303,13 +302,13 @@ export const layer = Layer.effect(
 		}).pipe(Effect.withSpan("Control.resumeUnfinished"));
 
 		const sweep = Effect.gen(function* () {
+			// A shutdown ends its runs itself, so a run still open is one the process died in.
 			for (const row of yield* threads.open) {
-				const execution = Option.getOrUndefined(row.execution);
 				yield* events.publish(EventList.ExecutionInterrupted, {
 					timestamp: yield* DateTime.now,
 					sessionId: SessionSchema.ID.make(row.sessionId),
 					threadId: ThreadSchema.ID.make(row.id),
-					reason: execution === "closed" ? "shutdown" : "crash",
+					reason: "crash",
 				});
 			}
 		}).pipe(Effect.withSpan("Control.sweep"));
diff --git a/packages/harness/src/db/migrations.ts b/packages/harness/src/db/migrations.ts
index b05f982b..1ee2aaa4 100644
--- a/packages/harness/src/db/migrations.ts
+++ b/packages/harness/src/db/migrations.ts
@@ -147,7 +147,6 @@ export const migrations = {
 				origin_entry_id    TEXT,
 				origin_call_id     TEXT,
 				title              TEXT,
-				execution          TEXT,
 				-- the run lifecycle, projected from the execution.* events; times are the events'
 				run_state          TEXT NOT NULL DEFAULT 'idle',
 				run_state_at       INTEGER,
@@ -157,6 +156,8 @@ export const migrations = {
 				run_error          TEXT,
 				restarts           INTEGER NOT NULL DEFAULT 0,
 				attempt            INTEGER,
+				-- the seq of the last run end that parks the queue; a pending prompt past it is runnable
+				head               INTEGER NOT NULL DEFAULT 0,
 				cost               REAL NOT NULL DEFAULT 0,
 				tokens_input       INTEGER NOT NULL DEFAULT 0,
 				tokens_output      INTEGER NOT NULL DEFAULT 0,
@@ -186,7 +187,6 @@ export const migrations = {
 			CREATE UNIQUE INDEX thread_call_idx ON thread (origin_thread_id, origin_call_id)
 			WHERE origin_call_id IS NOT NULL
 		`;
-		yield* sql`CREATE INDEX thread_running_idx ON thread (session_id) WHERE execution = 'running'`;
 
 		yield* sql`
 			CREATE TABLE entry (
@@ -249,6 +249,8 @@ export const migrations = {
 				data          TEXT NOT NULL,
 				delivery      TEXT NOT NULL,
 				admitted_seq  INTEGER NOT NULL,
+				-- the seq of its admission or latest move to steer: what wakes it
+				tail          INTEGER NOT NULL,
 				promoted_seq  INTEGER,
 				cancelled_seq INTEGER,
 				created_at    INTEGER NOT NULL,
diff --git a/packages/harness/src/db/schema.sql.ts b/packages/harness/src/db/schema.sql.ts
index 46feae2d..a041addb 100644
--- a/packages/harness/src/db/schema.sql.ts
+++ b/packages/harness/src/db/schema.sql.ts
@@ -147,7 +147,6 @@ export class ThreadRow extends Model.Class<ThreadRow>("ThreadRow")({
 	originCallId: Model.FieldOption(Schema.String),
 	// Absent until the thread's first own prompt names it.
 	title: Model.FieldOption(Schema.String),
-	execution: Model.FieldOption(ThreadSchema.Execution),
 	// The run lifecycle, written only by the session projector (`Thread.projectRun`). `runStateAt` is
 	// when `runState` last changed; the rest describe the last run, absent before the first.
 	runState: Model.GeneratedByDb(ThreadSchema.RunState),
@@ -157,6 +156,9 @@ export class ThreadRow extends Model.Class<ThreadRow>("ThreadRow")({
 	runOutcome: Model.GeneratedByDb(Schema.OptionFromNullOr(ThreadSchema.RunOutcome)),
 	runError: Model.GeneratedByDb(Schema.OptionFromNullOr(Schema.fromJsonString(ThreadSchema.RunError))),
 	restarts: Model.GeneratedByDb(Schema.Int),
+	// The seq of the last run end that parks the queue (`run.failed`, `execution.failed`, a user stop),
+	// written only by the session projector. A pending prompt whose `tail` is past it is runnable.
+	head: Model.GeneratedByDb(NonNegativeInt),
 	// The 1-based number of the provider request in flight, from its start until its response ends, the
 	// turn commits or the run ends: still set on recovery, the host died with that request out.
 	attempt: Model.FieldOption(Schema.Int),
@@ -181,6 +183,9 @@ export class InboxRow extends Model.Class<InboxRow>("InboxRow")({
 	data: Model.JsonFromString(Prompt),
 	delivery: Schema.Literals(inputDeliveries),
 	admittedSeq: Schema.Int,
+	// The seq of its admission, or of its latest move to the steer lane: what wakes it. Past the
+	// thread's `head` it is runnable; at or before it, parked until the next prompt.
+	tail: NonNegativeInt,
 	promotedSeq: Model.FieldOption(Schema.Int),
 	cancelledSeq: Model.FieldOption(Schema.Int),
 	createdAt: Model.DateTimeInsertFromNumber,
diff --git a/packages/harness/src/event/list.ts b/packages/harness/src/event/list.ts
index b81deb50..00d07336 100644
--- a/packages/harness/src/event/list.ts
+++ b/packages/harness/src/event/list.ts
@@ -322,11 +322,11 @@ export const ToolSettled = EventSchema.define({
 export type ToolSettled = typeof ToolSettled.Type;
 
 /**
- * Lifecycle of a process-owned busy period. One `started` and exactly one
- * terminal per period, covering every drain the period coalesced. The terminals
- * are separate types rather than one event with a status, so each carries only
- * what its outcome actually has: a failure has an error, an interruption has a
- * reason, and a success has neither.
+ * Lifecycle of one run: a drain that ran, from `started`, published before it promotes anything, to
+ * exactly one terminal (or `session.run.failed`). The terminals are separate types rather than one
+ * event with a status, so each carries only what its outcome actually has: a failure has an error,
+ * an interruption has a reason, and a success has neither. A failure or a user stop parks the queue;
+ * see `thread.head`.
  */
 export const ExecutionStarted = EventSchema.define({
 	type: "session.execution.started",
@@ -360,7 +360,7 @@ export type ExecutionInterrupted = typeof ExecutionInterrupted.Type;
 /**
  * A run ended without its answer and is not resumed: the host died in it too often (`crashloop`),
  * with no retry left for the request it cut off (`interrupted`), or replies kept hitting the output
- * limit with tool calls (`truncated`). Queued prompts stay queued.
+ * limit with tool calls (`truncated`). Queued prompts stay parked until the next prompt.
  */
 export const RunFailed = EventSchema.define({
 	type: "session.run.failed",
diff --git a/packages/harness/src/inbox/inbox.ts b/packages/harness/src/inbox/inbox.ts
index e2749d4e..69f3ab55 100644
--- a/packages/harness/src/inbox/inbox.ts
+++ b/packages/harness/src/inbox/inbox.ts
@@ -90,6 +90,8 @@ export interface ProjectCancelledInput {
 export interface ProjectUpdatedInput {
 	readonly id: SessionMessageSchema.ID;
 	readonly threadId: ThreadSchema.ID;
+	/** The update event's seq: a move to the steer lane wakes the prompt there. */
+	readonly seq: number;
 	readonly prompt?: Prompt | undefined;
 	readonly delivery?: Delivery | undefined;
 }
@@ -184,12 +186,15 @@ export const make = Effect.gen(function* () {
 			threadId: Schema.String,
 			data: Schema.NullOr(Schema.fromJsonString(Prompt)),
 			delivery: Schema.NullOr(Delivery),
+			tail: Schema.NullOr(Schema.Int),
 			rev: Schema.Int,
 		}),
 		Result: Schema.Struct({ id: Schema.String }),
 		// A null field is one the update left alone.
-		execute: ({ id, threadId, data, delivery, rev }) => sql`
-      UPDATE inbox SET data = COALESCE(${data}, data), delivery = COALESCE(${delivery}, delivery), rev = ${rev}
+		execute: ({ id, threadId, data, delivery, tail, rev }) => sql`
+      UPDATE inbox
+      SET data = COALESCE(${data}, data), delivery = COALESCE(${delivery}, delivery), tail = COALESCE(${tail}, tail),
+        rev = ${rev}
       WHERE id = ${id} AND thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NULL
       RETURNING id
     `,
@@ -209,8 +214,8 @@ export const make = Effect.gen(function* () {
 		Result: Schema.Struct({ id: Schema.String }),
 		execute: ({ id, threadId, data, delivery, admittedSeq, createdAt, rev }) => sql`
       UPDATE inbox
-      SET data = ${data}, delivery = ${delivery}, admitted_seq = ${admittedSeq}, created_at = ${createdAt},
-        cancelled_seq = NULL, rev = ${rev}
+      SET data = ${data}, delivery = ${delivery}, admitted_seq = ${admittedSeq}, tail = ${admittedSeq},
+        created_at = ${createdAt}, cancelled_seq = NULL, rev = ${rev}
       WHERE id = ${id} AND thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NOT NULL
       RETURNING id
     `,
@@ -362,6 +367,7 @@ export const make = Effect.gen(function* () {
 				data: input.prompt,
 				delivery: input.delivery,
 				admittedSeq: input.admittedSeq,
+				tail: input.admittedSeq,
 				promotedSeq: Option.none(),
 				cancelledSeq: Option.none(),
 				createdAt: VariantSchema.Override(input.timeCreated),
@@ -421,6 +427,7 @@ export const make = Effect.gen(function* () {
 				data: input.prompt,
 				delivery: input.delivery,
 				admittedSeq: input.promotedSeq,
+				tail: input.promotedSeq,
 				promotedSeq: Option.some(input.promotedSeq),
 				cancelledSeq: Option.none(),
 				createdAt: VariantSchema.Override(input.timeCreated),
@@ -451,6 +458,7 @@ export const make = Effect.gen(function* () {
 				threadId: input.threadId,
 				data: input.prompt ?? null,
 				delivery: input.delivery ?? null,
+				tail: input.delivery === "steer" ? input.seq : null,
 				rev: yield* store.rev,
 			});
 			if (updated.length > 0) return;
diff --git a/packages/harness/src/runner/coordinator.ts b/packages/harness/src/runner/coordinator.ts
index ade808fb..3cc994e7 100644
--- a/packages/harness/src/runner/coordinator.ts
+++ b/packages/harness/src/runner/coordinator.ts
@@ -41,8 +41,6 @@ type Execution<E, Reason> = {
 export const make = <Key, E, Reason = never>(options: {
 	/** Actual work serialized by the coordinator. */
 	readonly drain: (key: Key, force: boolean) => Effect.Effect<void, E>;
-	/** Runs once when a busy period begins, before its first drain. */
-	readonly started?: (key: Key) => Effect.Effect<void>;
 	/** Runs after the final drain exits and before joiners are released. */
 	readonly settled?: (key: Key, exit: Exit.Exit<void, E>, reason?: Reason) => Effect.Effect<void>;
 }): Effect.Effect<Coordinator<Key, E, Reason>, never, Scope.Scope> =>
@@ -73,7 +71,6 @@ export const make = <Key, E, Reason = never>(options: {
 			// trampolines successor executions after synchronous failures.
 			execution.owner = fork(
 				Effect.yieldNow.pipe(
-					Effect.andThen(Effect.uninterruptible(options.started?.(key) ?? Effect.void)),
 					Effect.andThen(loop(key, execution, force)),
 					Effect.onExit((exit) =>
 						Effect.sync(() => {
diff --git a/packages/harness/src/runner/execute.ts b/packages/harness/src/runner/execute.ts
index f768eb22..aa832019 100644
--- a/packages/harness/src/runner/execute.ts
+++ b/packages/harness/src/runner/execute.ts
@@ -71,82 +71,79 @@ export const layer = Layer.effect(
 				yield* publish({ sessionId: sessionId.value, threadId, timestamp: yield* DateTime.now });
 			});
 
-		// Threads being recovered: their run neither marks the thread nor runs once it is unmarked.
+		// Threads being recovered: their run is announced as resumed.
 		const recovering = new Set<ThreadId>();
 		// Recovered threads whose run is ended instead of resumed, with the message it ends with.
 		const abandoning = new Map<ThreadId, string>();
-		// The log position at each user stop: prompts admitted after it are new work, not parked by it.
-		const stoppedAt = new Map<ThreadId, number>();
-		// Threads whose last drain ended its run itself, by publishing `session.run.failed`.
-		const ended = new Set<ThreadId>();
+		// Threads whose current drain opened a run with `execution.started`.
+		const opened = new Set<ThreadId>();
 
 		const coordinator = yield* RunCoordinator.make<ThreadId, Runner.RunError, SessionSchema.InterruptReason>({
-			// The run is recorded unfinished before it starts, so a process dying anywhere in it
-			// leaves the thread for the next server start to resume. A recovered one already is.
-			started: (threadId) =>
-				Effect.suspend(() => {
-					const resumed = recovering.has(threadId);
-					return reportLifecycle(
-						threadId,
-						(resumed ? Effect.void : threads.markRunning(threadId)).pipe(
-							Effect.andThen(
-								publishLifecycle(threadId, (base) =>
-									events.publish(EventList.ExecutionStarted, { ...base, resumed }),
-								),
-							),
-						),
-					);
-				}),
-			// One terminal per busy period, covering every drain it coalesced.
+			// A drain that failed or was interrupted ends the busy period, and the run it opened ends here unless
+			// it already published its own terminal: the stored run state says which, so a run ends exactly once.
 			settled: (threadId, exit, reason) =>
 				reportLifecycle(
 					threadId,
 					Effect.gen(function* () {
-						// A shutdown leaves the run to resume on the next start; a user stop or any other end
-						// finishes it.
-						const interrupted = Exit.isFailure(exit) && Cause.hasInterruptsOnly(exit.cause);
-						const stop = stoppedAt.get(threadId);
-						stoppedAt.delete(threadId);
-						yield* threads.endExecution(
-							threadId,
-							!interrupted ? "finished" : reason === "user" ? "stopped" : "closed",
-							stop,
+						const ran = opened.delete(threadId);
+						if (Exit.isSuccess(exit)) return;
+						const interrupted = Cause.hasInterruptsOnly(exit.cause);
+						const thread = yield* threads.get(threadId);
+						if (Option.isNone(thread)) return;
+						// A user stop is recorded even before its run opened: it parks what woke the drain.
+						if (ran ? thread.value.runState === "idle" : !(interrupted && reason === "user")) return;
+						yield* publishLifecycle(threadId, (base) =>
+							interrupted
+								? // Nobody named a reason, so the process took the decision itself.
+									events.publish(EventList.ExecutionInterrupted, { ...base, reason: reason ?? "shutdown" })
+								: events.publish(EventList.ExecutionFailed, {
+										...base,
+										error: SessionFailure.fromCause(Cause.squash(exit.cause)),
+									}),
 						);
-						// One terminal per run: an abandoned run already ended with its failure and reason, which a
-						// success published after it would overwrite.
-						if (ended.delete(threadId) && Exit.isSuccess(exit)) return;
-						const sessionId = yield* sessionOf(threadId);
-						if (Option.isNone(sessionId)) return;
-						const base = { sessionId: sessionId.value, threadId, timestamp: yield* DateTime.now };
-						if (Exit.isSuccess(exit)) return yield* events.publish(EventList.ExecutionSucceeded, base);
-						if (Cause.hasInterruptsOnly(exit.cause))
-							// Nobody named a reason, so the process took the decision itself.
-							return yield* events.publish(EventList.ExecutionInterrupted, {
-								...base,
-								reason: reason ?? "shutdown",
-							});
-						return yield* events.publish(EventList.ExecutionFailed, {
-							...base,
-							error: SessionFailure.fromCause(Cause.squash(exit.cause)),
-						});
 					}),
 				),
+			// One run per drain that runs, opened before it promotes anything: a process dying anywhere in it
+			// leaves an open run, which the next server start sweeps as a crash and resumes.
 			drain: Effect.fnUntraced(function* (threadId: ThreadId, force) {
-				ended.delete(threadId);
-				const record = (outcome: Runner.Outcome) =>
-					Effect.sync(() => {
-						if (outcome === "ended") ended.add(threadId);
-					});
+				opened.delete(threadId);
 				const thread = yield* threads.get(threadId);
 				// Deleted with its session after something woke it: nothing is left to run.
 				if (Option.isNone(thread)) return;
 				const sessionId = thread.value.sessionId;
 				const recovered = recovering.delete(threadId);
-				if (recovered && Option.isNone(thread.value.execution)) return;
+				// A recovery claimed the thread before its drain: a stop since then must stand.
+				if (recovered && !(yield* threads.resumable(threadId))) return;
+				// The doorbell is only a hint: an unforced drain runs only for a prompt woken past the head.
+				if (!force && !(yield* threads.runnable(threadId))) return;
+				// Whole or not at all: a stop lands either before the run opened or on an open run.
+				yield* Effect.uninterruptible(
+					Effect.sync(() => opened.add(threadId)).pipe(
+						Effect.andThen(
+							reportLifecycle(
+								threadId,
+								publishLifecycle(threadId, (base) =>
+									events.publish(EventList.ExecutionStarted, { ...base, resumed: recovered }),
+								),
+							),
+						),
+					),
+				);
+				// `ended`: the run published its own terminal, `session.run.failed`. A stop arriving meanwhile
+				// waits for the success to land, so `settled` finds the run ended.
+				const close = (outcome: Runner.Outcome) =>
+					outcome === "ended"
+						? Effect.void
+						: Effect.uninterruptible(
+								reportLifecycle(
+									threadId,
+									publishLifecycle(threadId, (base) => events.publish(EventList.ExecutionSucceeded, base)),
+								),
+							);
 				// Only the drain the abandon itself started: one it joined is a live run, which must stand.
 				const abandoned = recovered && force ? abandoning.get(threadId) : undefined;
 				if (abandoned !== undefined)
-					return yield* runner.abandon({ threadId, message: abandoned }).pipe(Effect.flatMap(record));
+					return yield* runner.abandon({ threadId, message: abandoned }).pipe(Effect.flatMap(close));
 				// The thread's placement, else the session's space and directory. A placement names its
 				// space in a document no FK guards, so a space gone since is typed: `relink --thread`
 				// is the repair.
@@ -190,7 +187,7 @@ export const layer = Layer.effect(
 					yield* mcp.lease({ sessionId, threadId });
 					return yield* runner
 						.run({ threadId, force, recovered })
-						.pipe(Effect.provideContext(Context.merge(locationContext, mountContext)), Effect.flatMap(record));
+						.pipe(Effect.provideContext(Context.merge(locationContext, mountContext)), Effect.flatMap(close));
 				});
 
 				return yield* scopedRun.pipe(
@@ -205,16 +202,7 @@ export const layer = Layer.effect(
 		});
 
 		const interrupt: RunnerExecution.Interface["interrupt"] = (threadId, reason, options) =>
-			Effect.gen(function* () {
-				// The first stop of a run sets its position; a repeat while it settles keeps that one.
-				const sessionId = reason === "user" && !stoppedAt.has(threadId) ? yield* sessionOf(threadId) : undefined;
-				const recorded = sessionId !== undefined && Option.isSome(sessionId);
-				if (recorded) stoppedAt.set(threadId, yield* events.latestSequence(sessionId.value));
-				const accepted = yield* coordinator.interrupt(threadId, reason, options);
-				// Nothing was running, so no settlement will read the position this call set.
-				if (recorded && !accepted) stoppedAt.delete(threadId);
-				return accepted;
-			});
+			coordinator.interrupt(threadId, reason, options);
 
 		// Under the thread's execution like any run, so a prompt that wakes it meanwhile cannot heal
 		// the same draft.
diff --git a/packages/harness/src/runner/loop.ts b/packages/harness/src/runner/loop.ts
index 651bbe66..6ba3d41a 100644
--- a/packages/harness/src/runner/loop.ts
+++ b/packages/harness/src/runner/loop.ts
@@ -259,26 +259,22 @@ export const layer = (options: Options = {}) =>
 			});
 
 			/**
-			 * Ends a run that is not resumed, leaving the thread idle with its queue kept. `since` is the log
-			 * position the run began at: a prompt admitted after it woke the thread for another run.
+			 * Ends a run that is not resumed. Its terminal parks the queue: a prompt woken before it waits for
+			 * the next one.
 			 */
 			const endRun = Effect.fn("Loop.endRun")(function* (
 				sessionId: SessionSchema.ID,
 				threadId: ThreadSchema.ID,
-				since: number,
 				reason: EventList.RunFailed["data"]["reason"],
 				message: string,
 			) {
 				yield* Effect.uninterruptible(
-					Effect.gen(function* () {
-						yield* events.publish(EventList.RunFailed, {
-							timestamp: yield* DateTime.now,
-							sessionId,
-							threadId,
-							reason,
-							message,
-						});
-						yield* threads.idle(threadId, since);
+					events.publish(EventList.RunFailed, {
+						timestamp: yield* DateTime.now,
+						sessionId,
+						threadId,
+						reason,
+						message,
 					}),
 				);
 				return "ended" as const;
@@ -606,11 +602,10 @@ export const layer = (options: Options = {}) =>
 				readonly force: boolean;
 				readonly recovered?: boolean;
 			}) {
-				const thread = yield* threads.get(input.threadId);
-				if (Option.isNone(thread)) return "drained" as const;
-				const since = yield* events.latestSequence(thread.value.sessionId);
 				// Only a dead host leaves a request marked in flight: every run that ends clears it.
-				const crashed = Option.getOrUndefined(thread.value.attempt);
+				const crashed = Option.getOrUndefined(
+					Option.flatMap(yield* threads.get(input.threadId), (row) => row.attempt),
+				);
 				const carried: Crashed | undefined =
 					crashed === undefined
 						? undefined
@@ -653,7 +648,7 @@ export const layer = (options: Options = {}) =>
 					if (carried !== undefined) {
 						const delayMs = Retry.delay(start.retry, carried.attempt, hostStopped(start, carried.message));
 						if (delayMs === undefined) {
-							return yield* endRun(start.sessionId, input.threadId, since, "interrupted", carried.message);
+							return yield* endRun(start.sessionId, input.threadId, "interrupted", carried.message);
 						}
 						yield* scheduleRetry(start, carried.attempt, delayMs, carried.message);
 					}
@@ -685,7 +680,6 @@ export const layer = (options: Options = {}) =>
 							return yield* endRun(
 								snapshot.sessionId,
 								input.threadId,
-								since,
 								"truncated",
 								`The response hit the output token limit with tool calls ${truncations} times in a row; the run is ended`,
 							);
@@ -720,7 +714,6 @@ export const layer = (options: Options = {}) =>
 				return yield* endRun(
 					SessionSchema.ID.make(thread.value.sessionId),
 					input.threadId,
-					yield* events.latestSequence(thread.value.sessionId),
 					"crashloop",
 					input.message,
 				);
diff --git a/packages/harness/src/session/projector.ts b/packages/harness/src/session/projector.ts
index e05cce11..adf99892 100644
--- a/packages/harness/src/session/projector.ts
+++ b/packages/harness/src/session/projector.ts
@@ -108,11 +108,14 @@ export const layer = Layer.effectDiscard(
 		);
 
 		yield* events.project(EventList.PromptUpdated, (event) =>
-			input.projectUpdated({
-				id: event.data.messageId,
-				threadId: event.data.threadId,
-				...(event.data.prompt === undefined ? {} : { prompt: event.data.prompt }),
-				...(event.data.delivery === undefined ? {} : { delivery: event.data.delivery }),
+			Effect.gen(function* () {
+				yield* input.projectUpdated({
+					id: event.data.messageId,
+					threadId: event.data.threadId,
+					seq: yield* seqOf(event),
+					...(event.data.prompt === undefined ? {} : { prompt: event.data.prompt }),
+					...(event.data.delivery === undefined ? {} : { delivery: event.data.delivery }),
+				});
 			}),
 		);
 
@@ -162,28 +165,41 @@ export const layer = Layer.effectDiscard(
 		yield* events.project(EventList.ExecutionStarted, ({ data }) =>
 			threads.projectRun(data.threadId, data.timestamp, { _tag: "started" }),
 		);
-		yield* events.project(EventList.ExecutionSucceeded, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, { _tag: "ended", outcome: "succeeded" }),
+		// A run's end settles the thread at the event's own seq: an unanswered end moves its head.
+		const ended = (
+			event: { readonly type: string; readonly durable?: { readonly seq: number } },
+			threadId: ThreadSchema.ID,
+			at: DateTime.Utc,
+			outcome: ThreadSchema.RunOutcome,
+			error?: ThreadSchema.RunError,
+		) =>
+			seqOf(event).pipe(
+				Effect.flatMap((seq) =>
+					threads.projectRun(threadId, at, {
+						_tag: "ended",
+						outcome,
+						seq,
+						...(error === undefined ? {} : { error }),
+					}),
+				),
+			);
+		yield* events.project(EventList.ExecutionSucceeded, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "succeeded"),
 		);
-		yield* events.project(EventList.ExecutionFailed, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, {
-				_tag: "ended",
-				outcome: "failed",
-				error: { _tag: "failed", error: data.error },
-			}),
+		yield* events.project(EventList.ExecutionFailed, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "failed", { _tag: "failed", error: event.data.error }),
 		);
-		yield* events.project(EventList.ExecutionInterrupted, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, {
-				_tag: "ended",
-				outcome: "interrupted",
-				error: { _tag: "interrupted", reason: data.reason },
+		yield* events.project(EventList.ExecutionInterrupted, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "interrupted", {
+				_tag: "interrupted",
+				reason: event.data.reason,
 			}),
 		);
-		yield* events.project(EventList.RunFailed, ({ data }) =>
-			threads.projectRun(data.threadId, data.timestamp, {
-				_tag: "ended",
-				outcome: "failed",
-				error: { _tag: "runFailed", reason: data.reason, message: data.message },
+		yield* events.project(EventList.RunFailed, (event) =>
+			ended(event, event.data.threadId, event.data.timestamp, "failed", {
+				_tag: "runFailed",
+				reason: event.data.reason,
+				message: event.data.message,
 			}),
 		);
 
diff --git a/packages/harness/src/thread/schema.ts b/packages/harness/src/thread/schema.ts
index 34d807ad..685958c0 100644
--- a/packages/harness/src/thread/schema.ts
+++ b/packages/harness/src/thread/schema.ts
@@ -24,14 +24,6 @@ export type Origin =
 	 */
 	| { readonly kind: "subagent"; readonly threadId: ThreadID; readonly callId: string; readonly entryId?: string };
 
-/**
- * A run left unfinished: `running` while one is in flight, and still after the process died during
- * it; `closed` once a shutdown stopped it. Either resumes when the server starts again; a run that
- * ended any other way leaves none.
- */
-export const Execution = Schema.Literals(["running", "closed"]);
-export type Execution = typeof Execution.Type;
-
 /**
  * Where the thread's run is, projected from its lifecycle events: `starting` from
  * `execution.started` until the first `llm.started`, `running` after it, `idle` once it ended.
diff --git a/packages/harness/src/thread/thread.ts b/packages/harness/src/thread/thread.ts
index 3c896ab5..15234ab2 100644
--- a/packages/harness/src/thread/thread.ts
+++ b/packages/harness/src/thread/thread.ts
@@ -133,7 +133,7 @@ export interface Forked {
 	readonly text?: string;
 }
 
-/** What a projector inserts for a new thread; usage and execution start empty. */
+/** What a projector inserts for a new thread; usage and run state start empty. */
 export interface InsertThread {
 	readonly id: ThreadSchema.ID;
 	readonly sessionId: SessionSchema.ID;
@@ -146,7 +146,13 @@ export interface InsertThread {
 export type RunChange =
 	| { readonly _tag: "started" }
 	| { readonly _tag: "running" }
-	| { readonly _tag: "ended"; readonly outcome: ThreadSchema.RunOutcome; readonly error?: ThreadSchema.RunError };
+	| {
+			readonly _tag: "ended";
+			readonly outcome: ThreadSchema.RunOutcome;
+			readonly error?: ThreadSchema.RunError;
+			/** The ending event's seq. */
+			readonly seq: number;
+	  };
 
 // Entry row + its part rows, zipped. Message decode happens above this layer.
 export interface HydratedEntry {
@@ -210,41 +216,29 @@ export interface Interface {
 	readonly projectForked: (input: EventList.ThreadForked["data"], seq: number) => Effect.Effect<void>;
 	/** Names an untitled thread. Returns whether the title changed. */
 	readonly retitle: (threadId: ThreadSchema.ID, title: string) => Effect.Effect<boolean>;
-	/** Records that the thread has a run to do: one starting, or one a prompt just woke. */
-	readonly markRunning: (threadId: ThreadSchema.ID) => Effect.Effect<void>;
 	/**
-	 * Records how a run ended. `closed` (a shutdown) leaves it to resume. `stopped` (the user) and
-	 * `finished` clear it and the restart count, except that a finished run with prompts still
-	 * pending stays marked: they are accepted work a successor, or the next server start, runs.
-	 */
-	readonly endExecution: (
-		threadId: ThreadSchema.ID,
-		end: "finished" | "stopped" | "closed",
-		/** For a stop: the log position it was asked at. A prompt admitted after it keeps the mark. */
-		stoppedAt?: number,
-	) => Effect.Effect<void>;
-	/**
-	 * Claims a thread's unfinished run for recovery: marks it running again, counting a restart when
-	 * a dying process left it running (a shutdown's closed run is not counted). The new count, or none
-	 * when nothing is unfinished any more, say because the user stopped it since.
+	 * Claims a thread's unfinished run for recovery, counting a restart when the sweep found its host
+	 * dead in it (a shutdown is not counted). The new count, or none when nothing is unfinished any
+	 * more, say because the user stopped it since.
 	 */
 	readonly claimRestart: (threadId: ThreadSchema.ID) => Effect.Effect<Option.Option<number>>;
 	/** A committed turn is progress: the restart count starts over. Runs inside `TurnEnded`'s commit. */
 	readonly resetRestarts: (threadId: ThreadSchema.ID) => Effect.Effect<void>;
 	/** Records the 1-based provider request now in flight, or none (null) once its response ended. */
 	readonly setAttempt: (threadId: ThreadSchema.ID, attempt: number | null) => Effect.Effect<void>;
+	/** Whether a pending prompt of the thread is past its head: woken since its last unanswered end. */
+	readonly runnable: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
+	/** Whether the thread is among {@link unfinished}: still owed a resume, say not stopped since. */
+	readonly resumable: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
 	/**
-	 * Leaves a run that is not resumed idle: no restarts, no request in flight, whatever is queued. Its
-	 * queued prompts wait for the next prompt to wake the thread. The mark stays while a prompt
-	 * admitted after `since`, the log position the run began at, is pending: it woke the thread again,
-	 * so its run follows in this process and must survive a crash.
+	 * Root threads with a run left to resume, oldest first: their last run was interrupted by a crash or
+	 * a shutdown, or a pending prompt is runnable. Read after the startup sweep has closed open runs.
 	 */
-	readonly idle: (threadId: ThreadSchema.ID, since: number) => Effect.Effect<void>;
-	/** Root threads with a run left unfinished, oldest first. */
 	readonly unfinished: Effect.Effect<ReadonlyArray<ThreadRow>>;
 	/**
-	 * Projector-only: the `run_*` columns, at the time `at` of the event that changed them. The one
-	 * writer of those columns.
+	 * Projector-only: the `run_*` columns, at the time `at` of the event that changed them, and what a
+	 * run's end settles: `head` moves to an unanswered end (a failure or a user stop), which parks the
+	 * queue; the restart count and the request in flight clear, except where the run resumes.
 	 */
 	readonly projectRun: (threadId: ThreadSchema.ID, at: DateTime.Utc, change: RunChange) => Effect.Effect<void>;
 	/** Threads whose stored run is not idle: at startup, the runs a dead process left open. */
@@ -514,7 +508,6 @@ export const layer = Layer.effect(
 					originEntryId: origin.kind === "main" ? Option.none() : Option.fromUndefinedOr(origin.entryId),
 					originCallId: origin.kind === "subagent" ? Option.some(origin.callId) : Option.none(),
 					title: Option.fromUndefinedOr(input.title),
-					execution: Option.none(),
 					attempt: Option.none(),
 					createdSeq: input.seq,
 					rev: yield* store.rev,
@@ -957,50 +950,23 @@ export const layer = Layer.effect(
 			Effect.orDie,
 		);
 
-		/** Whether the thread has a prompt admitted after log position `after` still pending. */
-		const pendingAfter = (threadId: ThreadSchema.ID, after: number) => sql`
-			EXISTS (
-				SELECT 1 FROM inbox
-				WHERE thread_id = ${threadId} AND promoted_seq IS NULL AND cancelled_seq IS NULL AND admitted_seq > ${after}
-			)
-		`;
-
-		const markRunning = Effect.fn("Thread.markRunning")(
-			function* (threadId: ThreadSchema.ID) {
-				yield* sql`UPDATE thread SET execution = 'running', rev = ${yield* store.rev} WHERE id = ${threadId}`;
-			},
-			store.write,
-			Effect.orDie,
-		);
-
-		const endExecution = Effect.fn("Thread.endExecution")(
-			function* (threadId: ThreadSchema.ID, end: "finished" | "stopped" | "closed", stoppedAt?: number) {
-				// A run that ended in this process has no request in flight: only a dead host leaves one.
-				const rev = yield* store.rev;
-				if (end === "closed") {
-					yield* sql`UPDATE thread SET execution = 'closed', attempt = NULL, rev = ${rev} WHERE id = ${threadId}`;
-					return;
-				}
-				yield* sql`UPDATE thread SET attempt = NULL, rev = ${rev} WHERE id = ${threadId}`;
-				// Pending prompts that keep the mark: any for a finished run; for a stop, only those sent
-				// after it, since what was queued before it stays parked by the user's choice.
-				const after = end === "stopped" ? (stoppedAt ?? Number.MAX_SAFE_INTEGER) : -1;
-				yield* sql`
-				UPDATE thread SET execution = NULL, restarts = 0, rev = ${rev}
-				WHERE id = ${threadId} AND NOT ${pendingAfter(threadId, after)}
-			`;
-			},
-			store.write,
-			Effect.orDie,
-		);
+		/** Over a `thread` row: a pending prompt past its head, woken since the last unanswered end. */
+		const runnableOf = sql`EXISTS (
+			SELECT 1 FROM inbox
+			WHERE inbox.thread_id = thread.id AND inbox.promoted_seq IS NULL AND inbox.cancelled_seq IS NULL
+				AND inbox.tail > thread.head
+		)`;
+		/** Over a `thread` row: its last run was cut off by the host, not ended. */
+		const interruptedOf = (reasons: ReadonlyArray<SessionSchema.InterruptReason>) =>
+			sql`(thread.run_outcome = 'interrupted' AND json_extract(thread.run_error, '$.reason') IN ${sql.in(reasons)})`;
+		const unfinishedOf = sql`(${interruptedOf(["crash", "shutdown"])} OR ${runnableOf})`;
 
 		const claimRestart = Effect.fn("Thread.claimRestart")(
 			function* (threadId: ThreadSchema.ID) {
 				const rows = yield* sql<{ restarts: number }>`
 				UPDATE thread
-				SET restarts = restarts + (CASE WHEN execution = 'running' THEN 1 ELSE 0 END), execution = 'running',
-					rev = ${yield* store.rev}
-				WHERE id = ${threadId} AND execution IS NOT NULL
+				SET restarts = restarts + (CASE WHEN ${interruptedOf(["crash"])} THEN 1 ELSE 0 END), rev = ${yield* store.rev}
+				WHERE id = ${threadId} AND ${unfinishedOf}
 				RETURNING restarts
 			`;
 				return Option.fromUndefinedOr(rows[0]?.restarts);
@@ -1025,24 +991,19 @@ export const layer = Layer.effect(
 			Effect.orDie,
 		);
 
-		const idle = Effect.fn("Thread.idle")(
-			function* (threadId: ThreadSchema.ID, since: number) {
-				yield* sql`
-				UPDATE thread
-				SET execution = CASE WHEN ${pendingAfter(threadId, since)} THEN execution ELSE NULL END,
-					restarts = 0, attempt = NULL, rev = ${yield* store.rev}
-				WHERE id = ${threadId}
-			`;
-			},
-			store.write,
-			Effect.orDie,
-		);
+		const holds = (name: string, predicate: Statement.Fragment) =>
+			Effect.fn(name)(function* (threadId: ThreadSchema.ID) {
+				const rows = yield* sql<{ holds: number }>`SELECT ${predicate} AS holds FROM thread WHERE id = ${threadId}`;
+				return rows[0]?.holds === 1;
+			}, Effect.orDie);
+		const runnable = holds("Thread.runnable", runnableOf);
+		const resumable = holds("Thread.resumable", unfinishedOf);
 
 		const findUnfinished = SqlSchema.findAll({
 			Request: Schema.Void,
 			Result: ThreadRow,
 			execute: () => sql`
-				SELECT * FROM thread WHERE execution IS NOT NULL AND origin_kind <> 'subagent' ORDER BY updated_at
+				SELECT * FROM thread WHERE origin_kind <> 'subagent' AND ${unfinishedOf} ORDER BY updated_at
 			`,
 		});
 		const unfinished = findUnfinished(undefined).pipe(Effect.orDie, Effect.withSpan("Thread.unfinished"));
@@ -1072,10 +1033,18 @@ export const layer = Layer.effect(
 				return;
 			}
 			const error = change.error === undefined ? null : yield* encodeRunError(change.error);
+			const interrupted = change.error?._tag === "interrupted" ? change.error.reason : undefined;
+			// An unanswered end parks what is queued: a prompt woken before it waits for the next one.
+			const head = change.outcome === "failed" || interrupted === "user" ? sql`MAX(head, ${change.seq})` : sql`head`;
+			// A run the host cut off resumes: a crash keeps its count for the resume to claim and its request
+			// in flight for the retry; a shutdown ended its request itself.
+			const restarts = interrupted === "crash" || interrupted === "shutdown" ? sql`restarts` : sql`0`;
+			const attempt = interrupted === "crash" ? sql`attempt` : sql`NULL`;
 			yield* sql`
 				UPDATE thread SET
 					run_state_at = ${stateAt}, run_state = ${state}, run_ended_at = ${time},
-					run_outcome = ${change.outcome}, run_error = ${error}, rev = ${rev}
+					run_outcome = ${change.outcome}, run_error = ${error}, head = ${head}, restarts = ${restarts},
+					attempt = ${attempt}, rev = ${rev}
 				WHERE id = ${threadId}
 			`;
 		}, Effect.orDie);
@@ -1125,12 +1094,11 @@ export const layer = Layer.effect(
 			fork,
 			projectForked,
 			retitle,
-			markRunning,
-			endExecution,
 			claimRestart,
 			resetRestarts,
 			setAttempt,
-			idle,
+			runnable,
+			resumable,
 			unfinished,
 			projectRun,
 			open,
diff --git a/packages/harness/test/__artifacts__/store.revision.json b/packages/harness/test/__artifacts__/store.revision.json
index e306d91f..6f353e4c 100644
--- a/packages/harness/test/__artifacts__/store.revision.json
+++ b/packages/harness/test/__artifacts__/store.revision.json
@@ -3,7 +3,7 @@
 		"idIsSet": true,
 		"startRev": 0,
 		"sameId": true,
-		"head": 24
+		"head": 21
 	},
 	"doorbellRang": true,
 	"steps": [
@@ -25,19 +25,19 @@
 		},
 		{
 			"step": "prompt (tool call, settle, reply)",
-			"head": 21
+			"head": 18
 		},
 		{
 			"step": "fork",
-			"head": 22
+			"head": 19
 		},
 		{
 			"step": "session-scoped document",
-			"head": 23
+			"head": 20
 		},
 		{
 			"step": "session.delete",
-			"head": 24
+			"head": 21
 		}
 	],
 	"commits": [
@@ -74,27 +74,13 @@
 		},
 		{
 			"rev": 5,
-			"by": "plain write",
-			"writes": [
-				"thread T1 update"
-			]
-		},
-		{
-			"rev": 6,
-			"by": "plain write",
-			"writes": [
-				"thread T1 update"
-			]
-		},
-		{
-			"rev": 7,
 			"by": "session.execution.started",
 			"writes": [
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 8,
+			"rev": 6,
 			"by": "plain write",
 			"writes": [
 				"project P1 update",
@@ -102,7 +88,7 @@
 			]
 		},
 		{
-			"rev": 9,
+			"rev": 7,
 			"by": "session.prompt.promoted",
 			"writes": [
 				"inbox E1 update",
@@ -113,7 +99,7 @@
 			]
 		},
 		{
-			"rev": 10,
+			"rev": 8,
 			"by": "session.thread.system.changed",
 			"writes": [
 				"entry E2 insert",
@@ -122,14 +108,14 @@
 			]
 		},
 		{
-			"rev": 11,
+			"rev": 9,
 			"by": "plain write",
 			"writes": [
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 12,
+			"rev": 10,
 			"by": "session.llm.started",
 			"writes": [
 				"thread T1 update",
@@ -139,7 +125,7 @@
 			]
 		},
 		{
-			"rev": 13,
+			"rev": 11,
 			"by": "session.llm.ended",
 			"writes": [
 				"entry E3 update",
@@ -149,14 +135,14 @@
 			]
 		},
 		{
-			"rev": 14,
+			"rev": 12,
 			"by": "session.tool.settled",
 			"writes": [
 				"entry E3 update"
 			]
 		},
 		{
-			"rev": 15,
+			"rev": 13,
 			"by": "session.turn.ended",
 			"writes": [
 				"entry E3 update",
@@ -165,14 +151,14 @@
 			]
 		},
 		{
-			"rev": 16,
+			"rev": 14,
 			"by": "plain write",
 			"writes": [
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 17,
+			"rev": 15,
 			"by": "session.llm.started",
 			"writes": [
 				"thread T1 update",
@@ -182,7 +168,7 @@
 			]
 		},
 		{
-			"rev": 18,
+			"rev": 16,
 			"by": "session.llm.ended",
 			"writes": [
 				"entry E4 update",
@@ -192,7 +178,7 @@
 			]
 		},
 		{
-			"rev": 19,
+			"rev": 17,
 			"by": "session.turn.ended",
 			"writes": [
 				"entry E4 update",
@@ -201,22 +187,14 @@
 			]
 		},
 		{
-			"rev": 20,
-			"by": "plain write",
-			"writes": [
-				"thread T1 update",
-				"thread T1 update"
-			]
-		},
-		{
-			"rev": 21,
+			"rev": 18,
 			"by": "session.execution.succeeded",
 			"writes": [
 				"thread T1 update"
 			]
 		},
 		{
-			"rev": 22,
+			"rev": 19,
 			"by": "session.thread.forked",
 			"writes": [
 				"thread T2 insert",
@@ -224,7 +202,7 @@
 			]
 		},
 		{
-			"rev": 23,
+			"rev": 20,
 			"by": "plain write",
 			"writes": [
 				"thread T1 update",
@@ -232,7 +210,7 @@
 			]
 		},
 		{
-			"rev": 24,
+			"rev": 21,
 			"by": "plain write",
 			"writes": [
 				"removed S1"
@@ -241,34 +219,34 @@
 	],
 	"rowsBeforeDelete": {
 		"project": [
-			"P1 rev=8"
+			"P1 rev=6"
 		],
 		"space": [
-			"SP1 rev=8"
+			"SP1 rev=6"
 		],
 		"session": [
-			"S1 rev=18"
+			"S1 rev=16"
 		],
 		"thread": [
-			"T1 rev=23",
-			"T2 rev=23"
+			"T1 rev=20",
+			"T2 rev=20"
 		],
 		"entry": [
-			"E1 rev=9",
-			"E2 rev=10",
-			"E3 rev=15",
-			"E4 rev=19"
+			"E1 rev=7",
+			"E2 rev=8",
+			"E3 rev=13",
+			"E4 rev=17"
 		],
 		"inbox": [
-			"E1 rev=9"
+			"E1 rev=7"
 		]
 	},
 	"rowsAfterDelete": {
 		"project": [
-			"P1 rev=8"
+			"P1 rev=6"
 		],
 		"space": [
-			"SP1 rev=8"
+			"SP1 rev=6"
 		],
 		"session": [],
 		"thread": [],
@@ -276,7 +254,7 @@
 		"inbox": []
 	},
 	"removed": [
-		"session S1 rev=24"
+		"session S1 rev=21"
 	],
 	"rejected": {
 		"staleRev": "rev is not the current revision",
diff --git a/packages/harness/test/__artifacts__/thread.lifecycle.json b/packages/harness/test/__artifacts__/thread.lifecycle.json
index 2060ee4d..0eb22025 100644
--- a/packages/harness/test/__artifacts__/thread.lifecycle.json
+++ b/packages/harness/test/__artifacts__/thread.lifecycle.json
@@ -11,9 +11,7 @@
 		"19 session.execution.started.1 T1 {\"resumed\":true}",
 		"20 session.llm.started.1 T1",
 		"24 session.llm.started.1 T1",
-		"27 session.execution.succeeded.1 T1",
-		"29 session.execution.started.1 T2 {\"resumed\":false}",
-		"30 session.execution.interrupted.1 T2 {\"reason\":\"shutdown\"}"
+		"27 session.execution.succeeded.1 T1"
 	],
 	"states": [
 		{
@@ -25,7 +23,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": null
+			"head": 0
 		},
 		{
 			"step": "succeeded",
@@ -36,7 +34,7 @@
 			"endedAt": "9 session.execution.succeeded.1",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
+			"head": 0
 		},
 		{
 			"step": "in flight",
@@ -47,7 +45,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 0
 		},
 		{
 			"step": "stopped",
@@ -61,7 +59,7 @@
 				"_tag": "interrupted",
 				"reason": "user"
 			},
-			"execution": null
+			"head": 15
 		},
 		{
 			"step": "died",
@@ -72,7 +70,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 15
 		},
 		{
 			"step": "swept",
@@ -86,7 +84,7 @@
 				"_tag": "interrupted",
 				"reason": "crash"
 			},
-			"execution": "running"
+			"head": 15
 		},
 		{
 			"step": "resumed",
@@ -97,7 +95,7 @@
 			"endedAt": null,
 			"outcome": null,
 			"error": null,
-			"execution": "running"
+			"head": 15
 		},
 		{
 			"step": "finished",
@@ -108,32 +106,7 @@
 			"endedAt": "27 session.execution.succeeded.1",
 			"outcome": "succeeded",
 			"error": null,
-			"execution": null
-		},
-		{
-			"step": "swept after shutdown",
-			"thread": "T1",
-			"state": "idle",
-			"stateAt": "27 session.execution.succeeded.1",
-			"startedAt": "19 session.execution.started.1",
-			"endedAt": "27 session.execution.succeeded.1",
-			"outcome": "succeeded",
-			"error": null,
-			"execution": null
-		},
-		{
-			"step": "swept after shutdown",
-			"thread": "T2",
-			"state": "idle",
-			"stateAt": "30 session.execution.interrupted.1",
-			"startedAt": "29 session.execution.started.1",
-			"endedAt": "30 session.execution.interrupted.1",
-			"outcome": "interrupted",
-			"error": {
-				"_tag": "interrupted",
-				"reason": "shutdown"
-			},
-			"execution": "closed"
+			"head": 15
 		}
 	]
 }
diff --git a/packages/harness/test/__artifacts__/thread.recovery.json b/packages/harness/test/__artifacts__/thread.recovery.json
index 5d83c547..d1596ca9 100644
--- a/packages/harness/test/__artifacts__/thread.recovery.json
+++ b/packages/harness/test/__artifacts__/thread.recovery.json
@@ -11,15 +11,17 @@
 		"9 session.execution.succeeded.1 T1",
 		"10 session.thread.forked.1 T2",
 		"11 session.prompt.admitted.1 T2",
-		"12 session.prompt.promoted.1 T2",
-		"13 session.llm.started.1 T2",
-		"14 session.execution.started.1 T2",
-		"15 session.llm.failed.1 T2",
-		"16 session.thread.system.changed.1 T2",
-		"17 session.llm.started.1 T2",
-		"18 session.llm.ended.1 T2",
-		"19 session.turn.ended.1 T2",
-		"20 session.execution.succeeded.1 T2"
+		"12 session.execution.started.1 T2",
+		"13 session.prompt.promoted.1 T2",
+		"14 session.llm.started.1 T2",
+		"15 session.execution.interrupted.1 T2",
+		"16 session.execution.started.1 T2",
+		"17 session.llm.failed.1 T2",
+		"18 session.thread.system.changed.1 T2",
+		"19 session.llm.started.1 T2",
+		"20 session.llm.ended.1 T2",
+		"21 session.turn.ended.1 T2",
+		"22 session.execution.succeeded.1 T2"
 	],
 	"threads": [
 		{
@@ -39,10 +41,10 @@
 		"E1 T1 user seq=4 committed=4 committed",
 		"E2 T1 system seq=5 committed=5 committed",
 		"E3 T1 assistant seq=6 committed=8 committed",
-		"E4 T2 user seq=12 committed=12 committed",
-		"E5 T2 assistant seq=13 committed=15 aborted",
-		"E6 T2 system seq=16 committed=16 committed",
-		"E7 T2 assistant seq=17 committed=19 committed"
+		"E4 T2 user seq=13 committed=13 committed",
+		"E5 T2 assistant seq=14 committed=17 aborted",
+		"E6 T2 system seq=18 committed=18 committed",
+		"E7 T2 assistant seq=19 committed=21 committed"
 	],
 	"documents": [
 		{
diff --git a/packages/harness/test/control.prompt.test.ts b/packages/harness/test/control.prompt.test.ts
index 09da03b5..7c2872aa 100644
--- a/packages/harness/test/control.prompt.test.ts
+++ b/packages/harness/test/control.prompt.test.ts
@@ -1,4 +1,4 @@
-import { Cause, Effect, Exit, Layer, Option, Schema } from "effect";
+import { Cause, DateTime, Effect, Exit, Layer, Option, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import * as TestClock from "effect/testing/TestClock";
 import { describe, expect } from "vite-plus/test";
@@ -658,55 +658,59 @@ describe("Control queue races", () => {
 });
 
 describe("Control unfinished runs", () => {
-	const executionOf = (threadId: string) =>
+	const unfinished = (threadId: string) =>
 		Effect.gen(function* () {
-			const sql = yield* SqlClient.SqlClient;
-			const [row] = yield* sql<{ execution: string | null }>`SELECT execution FROM thread WHERE id = ${threadId}`;
-			return row?.execution;
+			const threads = yield* Thread.Service;
+			return (yield* threads.unfinished).some((row) => row.id === threadId);
 		});
-
-	// Marked before the wake: a crash between accepting the prompt and its run starting must not lose it.
-	it("marks a thread running as soon as a prompt is accepted", () =>
+	const end = (
+		event: typeof EventList.RunFailed | typeof EventList.ExecutionInterrupted,
+		ids: {
+			readonly sessionId: SessionSchema.ID;
+			readonly threadId: ThreadSchema.ID;
+		},
+	) =>
 		Effect.gen(function* () {
-			const { control, sessionId, threadId } = yield* setup;
-			expect(yield* executionOf(threadId)).toBeNull();
-
-			yield* control.prompt({ sessionId, prompt: prompt(text) });
-
-			expect(yield* executionOf(threadId)).toBe("running");
-		}));
+			const events = yield* Event.Service;
+			const timestamp = yield* DateTime.now;
+			if (event === EventList.RunFailed)
+				return yield* events.publish(EventList.RunFailed, {
+					...ids,
+					timestamp,
+					reason: "truncated",
+					message: "cut",
+				});
+			return yield* events.publish(EventList.ExecutionInterrupted, { ...ids, timestamp, reason: "user" });
+		});
 
-	it("keeps a finished run marked while accepted prompts are still pending", () =>
+	// The admission itself records what makes the prompt run: a crash right after accepting it must not lose it.
+	it("leaves an accepted prompt runnable, and unfinished, from its admission", () =>
 		Effect.gen(function* () {
 			const { threads, control, sessionId, threadId } = yield* setup;
-			const admitted = yield* control.prompt({ sessionId, prompt: prompt(text) });
+			expect(yield* threads.runnable(threadId)).toBe(false);
 
-			yield* threads.endExecution(threadId, "finished");
-			expect(yield* executionOf(threadId)).toBe("running");
+			yield* control.prompt({ sessionId, prompt: prompt(text) });
 
-			// Cancelling leaves the mark alone; the run that next ends with nothing pending clears it.
-			yield* control.cancel(threadId, admitted.id);
-			expect(yield* executionOf(threadId)).toBe("running");
-			yield* threads.endExecution(threadId, "finished");
-			expect(yield* executionOf(threadId)).toBeNull();
+			expect(yield* threads.runnable(threadId)).toBe(true);
+			expect(yield* unfinished(threadId)).toBe(true);
 		}));
 
-	it("keeps a closed run, and clears a stopped one unless a prompt came after the stop", () =>
+	it("parks what an unanswered end leaves queued; a later prompt or a move to steer wakes it", () =>
 		Effect.gen(function* () {
 			const { threads, control, sessionId, threadId } = yield* setup;
-			const events = yield* Event.Service;
-			yield* control.prompt({ sessionId, prompt: prompt("Parked by the stop") });
+			const queued = yield* control.prompt({ sessionId, prompt: prompt("Queued"), delivery: "followUp" });
 
-			yield* threads.endExecution(threadId, "closed");
-			expect(yield* executionOf(threadId)).toBe("closed");
+			yield* end(EventList.RunFailed, { sessionId, threadId });
+			expect(yield* threads.runnable(threadId)).toBe(false);
+			expect(yield* unfinished(threadId)).toBe(false);
 
-			// Sent while the stop was being cleaned up: its wake survives, so the mark must too.
-			const stop = yield* events.latestSequence(sessionId);
-			yield* control.prompt({ sessionId, prompt: prompt("Sent after the stop") });
-			yield* threads.endExecution(threadId, "stopped", stop);
-			expect(yield* executionOf(threadId)).toBe("running");
+			yield* control.update(threadId, queued.id, { delivery: "steer" });
+			expect(yield* threads.runnable(threadId)).toBe(true);
 
-			yield* threads.endExecution(threadId, "stopped", yield* events.latestSequence(sessionId));
-			expect(yield* executionOf(threadId)).toBeNull();
+			// A user stop parks the same way, and a prompt sent after it is runnable again.
+			yield* end(EventList.ExecutionInterrupted, { sessionId, threadId });
+			expect(yield* threads.runnable(threadId)).toBe(false);
+			yield* control.prompt({ sessionId, prompt: prompt("After the stop") });
+			expect(yield* threads.runnable(threadId)).toBe(true);
 		}));
 });
diff --git a/packages/harness/test/runner.coordinator.test.ts b/packages/harness/test/runner.coordinator.test.ts
index 47dda1be..d6d171c4 100644
--- a/packages/harness/test/runner.coordinator.test.ts
+++ b/packages/harness/test/runner.coordinator.test.ts
@@ -158,12 +158,11 @@ describe("RunCoordinator", () => {
 	);
 
 	it.effect(
-		"lifecycle hooks run once across coalesced drains in one busy period",
+		"the settled hook runs once across coalesced drains in one busy period",
 		Effect.gen(function* () {
 			const started = yield* Deferred.make<void>();
 			const gate = yield* Deferred.make<void>();
 			let drains = 0;
-			let starts = 0;
 			const exits: Exit.Exit<void, never>[] = [];
 			const coordinator = yield* RunCoordinator.make<string, never>({
 				drain: () => {
@@ -172,7 +171,6 @@ describe("RunCoordinator", () => {
 						? Deferred.succeed(started, undefined).pipe(Effect.andThen(Deferred.await(gate)))
 						: Effect.void;
 				},
-				started: () => Effect.sync(() => void starts++),
 				settled: (_key, exit) => Effect.sync(() => void exits.push(exit)),
 			});
 
@@ -183,7 +181,6 @@ describe("RunCoordinator", () => {
 			yield* coordinator.awaitIdle("thread");
 
 			expect(drains).toBe(2);
-			expect(starts).toBe(1);
 			expect(exits).toHaveLength(1);
 			expect(Exit.isSuccess(exits[0]!)).toBe(true);
 		}),
diff --git a/packages/harness/test/runner.loop.test.ts b/packages/harness/test/runner.loop.test.ts
index 7db39b2c..a8d0974c 100644
--- a/packages/harness/test/runner.loop.test.ts
+++ b/packages/harness/test/runner.loop.test.ts
@@ -398,8 +398,9 @@ describe("runner loop — crash healing", () => {
 		}),
 	);
 
+	// The doorbell is only a hint: with nothing past the head there is no run, so nothing is touched.
 	it(
-		"heals a dangling draft before eligibility, then idles without capturing state",
+		"runs nothing for a wake with no prompt past the head",
 		Effect.gen(function* () {
 			contexts.length = 0;
 			snapshots = 0;
@@ -427,9 +428,7 @@ describe("runner loop — crash healing", () => {
 			while ((yield* execution.active).has(threadId)) yield* Effect.yieldNow;
 
 			const path = yield* threads.line(threadId);
-			expect(path).toHaveLength(1);
-			expect(path[0]!.entry.state).toBe("aborted");
-			expect(path[0]!.parts).toEqual([]);
+			expect(path.map((entry) => entry.entry.state)).toEqual(["draft"]);
 			expect(contexts).toEqual([]);
 			expect(snapshots).toBe(0);
 		}),
@@ -1042,9 +1041,10 @@ describe("runner loop — queued input", () => {
 		}),
 	);
 
-	// A prompt's wake survives the failure, so what was sent while the run failed goes out after it.
+	// A failed run does not start the next one: what was sent while it failed is parked, and the next
+	// prompt places it, steers with that prompt and follow-ups after.
 	it(
-		"runs prompts sent while a run fails right after it, steers first",
+		"keeps prompts sent while a run fails queued until the next prompt places them",
 		Effect.gen(function* () {
 			yield* reset;
 			const seen = yield* outcomes;
@@ -1060,8 +1060,17 @@ describe("runner loop — queued input", () => {
 			yield* send(threadId, "A");
 			yield* settle(threadId);
 
+			expect(seen).toEqual(["failed"]);
+			expect(contexts.map(texts)).toEqual([["A"]]);
+
+			yield* send(threadId, "N");
+			yield* settle(threadId);
+
 			expect(seen).toEqual(["failed", "succeeded"]);
-			expect(contexts.map(texts)).toEqual([["A"], ["A", "S1"], ["A", "S1", "F1"]]);
+			expect(contexts.map(texts).slice(1)).toEqual([
+				["A", "S1", "N"],
+				["A", "S1", "N", "F1"],
+			]);
 		}),
 	);
 
@@ -1114,21 +1123,20 @@ describe("runner loop — resume after restart", () => {
 	const { contexts, script } = provider;
 	const { effect: it } = testEffect(runtime({ open: provider.open }));
 
+	/** Whether the next server start would resume the thread, and its restart count. */
 	const stateOf = (threadId: ThreadSchema.ID) =>
 		Effect.gen(function* () {
-			const sql = yield* SqlClient.SqlClient;
-			const [row] = yield* sql<{ execution: string | null; restarts: number }>`
-				SELECT execution, restarts FROM thread WHERE id = ${threadId}
-			`;
-			return row;
+			const threads = yield* Thread.Service;
+			const row = Option.getOrThrow(yield* threads.get(threadId));
+			return { unfinished: yield* threads.resumable(threadId), restarts: row.restarts };
 		});
 
 	/** The thread's state each time a run starts, as it starts. */
 	const atEachStart = (threadId: ThreadSchema.ID) =>
 		Effect.gen(function* () {
 			const events = yield* Event.Service;
-			const sql = yield* SqlClient.SqlClient;
-			const seen: Array<{ execution: string | null; restarts: number } | undefined> = [];
+			const threads = yield* Thread.Service;
+			const seen: Array<{ unfinished: boolean; restarts: number }> = [];
 			yield* events.listen((event) =>
 				Schema.is(EventList.ExecutionStarted)(event) && event.data.threadId === threadId
 					? stateOf(threadId).pipe(
@@ -1136,7 +1144,7 @@ describe("runner loop — resume after restart", () => {
 								seen.push(state);
 							}),
 							Effect.orDie,
-							Effect.provideService(SqlClient.SqlClient, sql),
+							Effect.provideService(Thread.Service, threads),
 						)
 					: Effect.void,
 			);
@@ -1156,12 +1164,11 @@ describe("runner loop — resume after restart", () => {
 	});
 
 	/**
-	 * What a process that died mid-reply leaves: the prompt in the conversation, the reply it was
-	 * streaming still a draft, and the run still marked running.
+	 * What a process that died mid-reply leaves, once the next start swept it: the prompt in the
+	 * conversation, the reply it was streaming still a draft, and the run interrupted by a crash.
 	 */
 	const crashedMidReply = Effect.fnUntraced(function* (threadId: ThreadSchema.ID, id: string) {
 		const events = yield* Event.Service;
-		const threads = yield* Thread.Service;
 		const inputs = yield* Inbox.make;
 		yield* admit({ id, threadId, delivery: "steer" });
 		yield* inputs.promoteSteers(threadId, Number.MAX_SAFE_INTEGER);
@@ -1180,7 +1187,12 @@ describe("runner loop — resume after restart", () => {
 			messageId: SessionMessageSchema.ID.from(draft.messageId),
 			message: draft,
 		});
-		yield* threads.markRunning(threadId);
+		yield* events.publish(EventList.ExecutionInterrupted, {
+			timestamp: DateTime.makeUnsafe(2),
+			sessionId: yield* sessionOf(threadId),
+			threadId,
+			reason: "crash",
+		});
 	});
 
 	it(
@@ -1199,8 +1211,8 @@ describe("runner loop — resume after restart", () => {
 			yield* execution.interrupt(threadId, "user", { awaitSettlement: true });
 			yield* settle(threadId);
 
-			// The stop is the user's: what was queued behind it stays queued, unmarked.
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			// The stop is the user's: what was queued behind it stays parked, not resumed.
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 			yield* control.resumeUnfinished;
 
 			expect(seen).toEqual(["interrupted"]);
@@ -1230,17 +1242,18 @@ describe("runner loop — resume after restart", () => {
 			yield* execution.interrupt(threadId, "shutdown", { awaitSettlement: true });
 			yield* settle(threadId);
 
-			expect(yield* stateOf(threadId)).toEqual({ execution: "closed", restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: true, restarts: 0 });
 			const atStart = yield* atEachStart(threadId);
 			yield* control.resumeUnfinished;
 
-			expect(atStart).toEqual([{ execution: "running", restarts: 0 }]);
+			// S1 and F1 are still queued as the resumed run starts.
+			expect(atStart).toEqual([{ unfinished: true, restarts: 0 }]);
 			expect(seen).toEqual(["interrupted", "succeeded"]);
 			expect(contexts.map(texts).slice(1)).toEqual([
 				["A", "S1"],
 				["A", "S1", "F1"],
 			]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 		}),
 	);
 
@@ -1278,7 +1291,7 @@ describe("runner loop — resume after restart", () => {
 
 			yield* control.resumeUnfinished;
 
-			expect(atStart).toEqual([{ execution: "running", restarts: 1 }]);
+			expect(atStart).toEqual([{ unfinished: false, restarts: 1 }]);
 			expect(contexts.map(texts)).toEqual([["A"]]);
 			const path = yield* threads.line(threadId);
 			expect(path.map((entry) => [entry.entry.type, entry.entry.state])).toEqual([
@@ -1287,26 +1300,31 @@ describe("runner loop — resume after restart", () => {
 				["system", "committed"],
 				["assistant", "committed"],
 			]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 		}),
 	);
 
-	// Recovery chose the session, then the user ran and stopped it: the stop cleared the mark, and the
+	// Recovery chose the session, then the user ran and stopped it: the stop ended the run, and the
 	// recovered run must find nothing to resume rather than force another turn.
 	it(
 		"runs nothing when a session recovery chose was stopped before its run began",
 		Effect.gen(function* () {
 			yield* provider.reset;
-			const threads = yield* Thread.Service;
+			const events = yield* Event.Service;
 			const execution = yield* RunnerExecution.Service;
 			const { threadId } = yield* seedSession();
 			yield* crashedMidReply(threadId, "A");
-			yield* threads.endExecution(threadId, "stopped");
+			yield* events.publish(EventList.ExecutionInterrupted, {
+				timestamp: yield* DateTime.now,
+				sessionId: yield* sessionOf(threadId),
+				threadId,
+				reason: "user",
+			});
 
 			yield* execution.recover(threadId);
 
 			expect(contexts).toEqual([]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 		}),
 	);
 
@@ -1333,7 +1351,7 @@ describe("runner loop — resume after restart", () => {
 			yield* control.resumeUnfinished;
 
 			expect(contexts).toEqual([]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 			expect(failures.map((failure) => [failure.reason, failure.message])).toEqual([
 				["crashloop", `The run was interrupted ${Control.RESTART_LIMIT} times in a row; it is not resumed again`],
 			]);
@@ -1345,7 +1363,63 @@ describe("runner loop — resume after restart", () => {
 			yield* settle(threadId);
 
 			expect(contexts.map(texts)).toEqual([["A", "B"]]);
-			expect(yield* stateOf(threadId)).toEqual({ execution: null, restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+		}),
+	);
+
+	// The run's own terminal is its end: a stop that lands while `run.failed` commits must not end it twice
+	// as interrupted, which would make the thread resumable and run its parked queue on the next start.
+	it(
+		"ends a run once when a stop lands while its run.failed commits",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const control = yield* Control.Service;
+			const events = yield* Event.Service;
+			const execution = yield* RunnerExecution.Service;
+			const sql = yield* SqlClient.SqlClient;
+			const { threadId } = yield* seedSession();
+			const terminals: Array<string> = [];
+			yield* events.listen((event) =>
+				event.type === EventList.RunFailed.type
+					? execution
+							.interrupt(threadId, "user")
+							.pipe(Effect.andThen(Effect.sync(() => terminals.push(event.type))))
+					: event.type.startsWith("session.execution.") && event.type !== EventList.ExecutionStarted.type
+						? Effect.sync(() => terminals.push(event.type))
+						: Effect.void,
+			);
+			yield* crashedMidReply(threadId, "A");
+			yield* admit({ id: "Q", threadId, delivery: "followUp" });
+			yield* sql`UPDATE thread SET restarts = ${Control.RESTART_LIMIT - 1}, rev = (SELECT rev FROM store) WHERE id = ${threadId}`;
+
+			// The stop interrupts the recovery it joined.
+			yield* Effect.exit(control.resumeUnfinished);
+			yield* settle(threadId);
+
+			// The sweep's crash, then the abandoned run's own end, and nothing after it.
+			expect(terminals).toEqual(["session.execution.interrupted", "session.run.failed"]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+		}),
+	);
+
+	// The stop is accepted before the drain opened its run: it is still the user's, so what woke the drain
+	// is parked rather than left to run on the next start.
+	it(
+		"parks a prompt whose drain a stop interrupted before its run opened",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const execution = yield* RunnerExecution.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+
+			yield* send(threadId, "A");
+			expect(yield* execution.interrupt(threadId, "user")).toBe(true);
+			yield* settle(threadId);
+
+			expect(contexts).toEqual([]);
+			expect(seen).toEqual(["interrupted"]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+			expect((yield* delivered(threadId)).map((row) => [row.id, row.promotedSeq])).toEqual([["A", null]]);
 		}),
 	);
 
@@ -1366,7 +1440,7 @@ describe("runner loop — resume after restart", () => {
 			yield* send(threadId, "A");
 			yield* streaming;
 
-			expect(yield* stateOf(threadId)).toEqual({ execution: "running", restarts: 0 });
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
 			yield* execution.interrupt(threadId, "user", { awaitSettlement: true });
 		}),
 	);
@@ -1377,15 +1451,15 @@ describe("runner loop — cancel and unfinished replies", () => {
 	const { effect: it } = testEffect(runtime({ open: provider.open }));
 
 	// A shutdown cut off the reply to A while B waited. Cancelling B must not drop A's unfinished
-	// reply: the session stays marked for the next start.
+	// reply: the next start still resumes the thread.
 	it(
-		"keeps a session marked when cancelling the last queued prompt leaves a reply cut off",
+		"keeps a thread unfinished when cancelling the last queued prompt leaves a reply cut off",
 		Effect.gen(function* () {
 			yield* provider.reset;
 			const control = yield* Control.Service;
 			const execution = yield* RunnerExecution.Service;
 			const events = yield* Event.Service;
-			const sql = yield* SqlClient.SqlClient;
+			const threads = yield* Thread.Service;
 			const { threadId } = yield* seedSession();
 			const streaming = yield* Deferred.make<void>();
 			yield* events.listen((event) =>
@@ -1402,8 +1476,7 @@ describe("runner loop — cancel and unfinished replies", () => {
 
 			yield* control.cancel(threadId, SessionMessageSchema.ID.make("B"));
 
-			const [row] = yield* sql<{ execution: string | null }>`SELECT execution FROM thread WHERE id = ${threadId}`;
-			expect(row?.execution).toBe("closed");
+			expect(yield* threads.resumable(threadId)).toBe(true);
 		}),
 	);
 });
diff --git a/packages/harness/test/thread.test.ts b/packages/harness/test/thread.test.ts
index e002ec2a..a8043af5 100644
--- a/packages/harness/test/thread.test.ts
+++ b/packages/harness/test/thread.test.ts
@@ -510,12 +510,13 @@ describe("threads", () => {
 			const [first] = yield* threads.line(main);
 			const t2 = ThreadSchema.ID.make((yield* threads.fork({ threadId: main, entryId: first!.entry.id })).thread.id);
 
-			// What a process dying mid-turn leaves: a promoted prompt, an open draft, the run still marked.
+			// What a process dying mid-turn leaves: a promoted prompt, an open draft, its run never ended.
 			const timestamp = yield* DateTime.now;
 			const prompt = PromptSchema.Prompt.fromText("cut off");
 			const messageId = SessionMessageSchema.ID.make("prompt_cut");
 			const base = { timestamp, sessionId, threadId: t2, messageId, prompt, delivery: "followUp" as const };
 			yield* events.publish(EventList.PromptAdmitted, base);
+			yield* events.publish(EventList.ExecutionStarted, { timestamp, sessionId, threadId: t2, resumed: false });
 			yield* events.publish(EventList.Prompted, base);
 			yield* events.publish(EventList.LLMStarted, {
 				timestamp,
@@ -542,7 +543,8 @@ describe("threads", () => {
 					parts: [{ type: "text", text: "half a rep" }],
 				}),
 			});
-			yield* threads.markRunning(t2);
+			// The next start sweeps the open run as a crash.
+			yield* control.sweep;
 
 			script.set(t2, [{ _tag: "reply", text: "answered again" }]);
 			yield* control.resumeUnfinished;
@@ -552,7 +554,7 @@ describe("threads", () => {
 				.map(({ entry }) => `${entry.type} ${entry.state}`);
 			expect(own).toEqual(["user committed", "assistant aborted", "system committed", "assistant committed"]);
 			const thread = Option.getOrThrow(yield* threads.get(t2));
-			expect(Option.getOrUndefined(thread.execution)).toBeUndefined();
+			expect(yield* threads.resumable(t2)).toBe(false);
 			expect(thread.restarts).toBe(0);
 			// Only the thread that was cut off ran again, from its committed entries: the inherited
 			// prompt and its own, without the aborted draft.
@@ -685,7 +687,7 @@ describe("threads", () => {
 							endedAt: at(log, row.id, row.runEndedAt, terminals),
 							outcome: Option.getOrNull(row.runOutcome),
 							error: Option.getOrNull(row.runError),
-							execution: Option.getOrNull(row.execution),
+							head: row.head,
 						});
 					}
 				});
@@ -714,7 +716,7 @@ describe("threads", () => {
 			yield* control.interrupt(main, { awaitSettlement: true });
 			yield* record("stopped");
 
-			// What a process dying mid-run leaves: a follow-up admitted, its run started and marked, never ended.
+			// What a process dying mid-run leaves: a follow-up admitted, its run started, never ended.
 			const died = (threadId: ThreadSchema.ID) =>
 				Effect.gen(function* () {
 					yield* events.publish(EventList.ExecutionStarted, {
@@ -723,7 +725,6 @@ describe("threads", () => {
 						threadId,
 						resumed: false,
 					});
-					yield* threads.markRunning(threadId);
 				});
 			yield* inputs.admit({
 				id: SessionMessageSchema.ID.make("prompt_cut"),
@@ -755,21 +756,6 @@ describe("threads", () => {
 			yield* Fiber.join(resuming);
 			yield* record("finished");
 
-			// A shutdown that closed the run and died before publishing its end: the sweep says `shutdown`.
-			const [first] = yield* threads.line(main);
-			const fork = ThreadSchema.ID.make(
-				(yield* threads.fork({ threadId: main, entryId: first!.entry.id })).thread.id,
-			);
-			name("T", fork);
-			yield* died(fork);
-			yield* threads.endExecution(fork, "closed");
-			yield* control.sweep;
-			yield* record("swept after shutdown");
-			expect(Option.getOrUndefined(Option.getOrThrow(yield* threads.get(fork)).runError)).toEqual({
-				_tag: "interrupted",
-				reason: "shutdown",
-			});
-
 			const log = yield* journal;
 			const resumed = log.filter((event) => event.type === lifecycle[0] && event.data["resumed"] === true);
 			expect(resumed.map((event) => event.data["threadId"])).toEqual([main]);

From 6bce08baab38d0892754adec86e69ff9e608fa96 Mon Sep 17 00:00:00 2001
From: Sanchit Rk <0xsanchit@gmail.com>
Date: Sun, 8 Nov 2026 11:53:06 +0530
Subject: [PATCH 3/7] fix(harness): park a prompt when a stop lands after its
 run ended

A user stop that landed after a run published its own terminal, but
before its drain returned, recorded nothing: head stayed put, while the
stop cleared the pending wake. A prompt sent as the run ended was left
runnable but not run, and started on its own at the next server start.

With no run open, a user stop is now recorded whenever a prompt would
otherwise still run, so it parks like any other stop. A stop after
run.failed with nothing new queued still adds no second terminal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/harness/src/runner/execute.ts    |  7 +++-
 packages/harness/test/runner.loop.test.ts | 46 +++++++++++++++++++++++
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/packages/harness/src/runner/execute.ts b/packages/harness/src/runner/execute.ts
index aa832019..bd54f179 100644
--- a/packages/harness/src/runner/execute.ts
+++ b/packages/harness/src/runner/execute.ts
@@ -90,8 +90,11 @@ export const layer = Layer.effect(
 						const interrupted = Cause.hasInterruptsOnly(exit.cause);
 						const thread = yield* threads.get(threadId);
 						if (Option.isNone(thread)) return;
-						// A user stop is recorded even before its run opened: it parks what woke the drain.
-						if (ran ? thread.value.runState === "idle" : !(interrupted && reason === "user")) return;
+						// With no run open, before it opened or after it ended, a user stop is recorded only to park a
+						// prompt that would otherwise still run.
+						const open = ran && thread.value.runState !== "idle";
+						const stop = interrupted && reason === "user";
+						if (!open && !(stop && (yield* threads.runnable(threadId)))) return;
 						yield* publishLifecycle(threadId, (base) =>
 							interrupted
 								? // Nobody named a reason, so the process took the decision itself.
diff --git a/packages/harness/test/runner.loop.test.ts b/packages/harness/test/runner.loop.test.ts
index a8d0974c..69a4c2f2 100644
--- a/packages/harness/test/runner.loop.test.ts
+++ b/packages/harness/test/runner.loop.test.ts
@@ -1402,6 +1402,52 @@ describe("runner loop — resume after restart", () => {
 		}),
 	);
 
+	// The stop lands after the run's success but before its drain returns: it is still the user's, so a prompt
+	// sent as the run ended is parked rather than left to run on the next start.
+	it(
+		"parks a prompt sent as its run succeeds when a stop lands before the drain returns",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const control = yield* Control.Service;
+			const events = yield* Event.Service;
+			const execution = yield* RunnerExecution.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			const sessionId = yield* sessionOf(threadId);
+			let stopped = false;
+			yield* events.listen((event) =>
+				event.type === EventList.ExecutionSucceeded.type && !stopped
+					? Effect.sync(() => (stopped = true)).pipe(
+							Effect.andThen(
+								control.prompt({
+									sessionId,
+									threadId,
+									id: SessionMessageSchema.ID.make("Q"),
+									prompt: PromptSchema.Prompt.fromText("Q"),
+									delivery: "followUp",
+								}),
+							),
+							Effect.andThen(execution.interrupt(threadId, "user")),
+							Effect.orDie,
+							Effect.asVoid,
+						)
+					: Effect.void,
+			);
+
+			yield* send(threadId, "A");
+			yield* settle(threadId);
+			yield* control.resumeUnfinished;
+
+			expect(seen).toEqual(["succeeded", "interrupted"]);
+			expect(contexts.map(texts)).toEqual([["A"]]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+			expect((yield* delivered(threadId)).map((row) => [row.id, row.promotedSeq])).toEqual([
+				["A", expect.any(Number)],
+				["Q", null],
+			]);
+		}),
+	);
+
 	// The stop is accepted before the drain opened its run: it is still the user's, so what woke the drain
 	// is parked rather than left to run on the next start.
 	it(

From f2ec8fe2a6b6c833a01207c2d1259edb5b10ee82 Mon Sep 17 00:00:00 2001
From: Sanchit Rk <0xsanchit@gmail.com>
Date: Sun, 8 Nov 2026 18:43:56 +0530
Subject: [PATCH 4/7] fix(harness): wake parked steers and resume runnable-only
 threads as a wake

Asking for the steer lane on a prompt already in it recorded nothing, so
its tail never moved and the wake was rejected: "send now" on a parked
steer did nothing, even across a restart. The request is now recorded
as an update, which moves the tail.

On startup, a thread listed only for a runnable prompt went through
forced recovery, which treated the failed run's unanswered reply as cut
off and asked for another answer before placing the parked queue. Such
a thread now gets a plain wake, as a live prompt would; forced recovery
stays for runs a crash or shutdown cut off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/harness/src/control.ts              |  5 ++
 packages/harness/src/inbox/inbox.ts          |  5 +-
 packages/harness/src/thread/thread.ts        |  4 ++
 packages/harness/test/control.prompt.test.ts |  7 +--
 packages/harness/test/runner.loop.test.ts    | 50 ++++++++++++++++++++
 5 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/packages/harness/src/control.ts b/packages/harness/src/control.ts
index 0640f15a..54820869 100644
--- a/packages/harness/src/control.ts
+++ b/packages/harness/src/control.ts
@@ -277,6 +277,11 @@ export const layer = Layer.effect(
 				Effect.fnUntraced(function* (row) {
 					const threadId = ThreadSchema.ID.make(row.id);
 					if ((yield* execution.active).has(threadId)) return;
+					// No run was cut off, only a prompt woken past the head: it runs as its wake would have.
+					if (!(yield* threads.cutOff(threadId))) {
+						yield* execution.wake(threadId);
+						return yield* execution.awaitIdle(threadId);
+					}
 					// Claimed again here, not from the list: a stop since then cleared it, and must stand.
 					// Counted before resuming, so a crash inside the resumed run is counted too.
 					const restarts = yield* threads.claimRestart(threadId);
diff --git a/packages/harness/src/inbox/inbox.ts b/packages/harness/src/inbox/inbox.ts
index 69f3ab55..d8298180 100644
--- a/packages/harness/src/inbox/inbox.ts
+++ b/packages/harness/src/inbox/inbox.ts
@@ -489,8 +489,11 @@ export const make = Effect.gen(function* () {
 		if (Option.isNone(stored)) return Option.none<Admitted>();
 		const prompt =
 			patch.prompt === undefined || Prompt.equivalence(patch.prompt, stored.value.prompt) ? undefined : patch.prompt;
+		// Asking for the steer lane is recorded even for a steer: it wakes the prompt, so a parked one runs now.
 		const delivery =
-			patch.delivery === undefined || patch.delivery === stored.value.delivery ? undefined : patch.delivery;
+			patch.delivery === undefined || (patch.delivery === stored.value.delivery && patch.delivery !== "steer")
+				? undefined
+				: patch.delivery;
 		if (prompt === undefined && delivery === undefined) return stored;
 		const timestamp = yield* DateTime.now;
 		return yield* events
diff --git a/packages/harness/src/thread/thread.ts b/packages/harness/src/thread/thread.ts
index 15234ab2..4593b5ee 100644
--- a/packages/harness/src/thread/thread.ts
+++ b/packages/harness/src/thread/thread.ts
@@ -230,6 +230,8 @@ export interface Interface {
 	readonly runnable: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
 	/** Whether the thread is among {@link unfinished}: still owed a resume, say not stopped since. */
 	readonly resumable: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
+	/** Whether the thread's last run was cut off by the host, a crash or a shutdown: a run to resume. */
+	readonly cutOff: (threadId: ThreadSchema.ID) => Effect.Effect<boolean>;
 	/**
 	 * Root threads with a run left to resume, oldest first: their last run was interrupted by a crash or
 	 * a shutdown, or a pending prompt is runnable. Read after the startup sweep has closed open runs.
@@ -998,6 +1000,7 @@ export const layer = Layer.effect(
 			}, Effect.orDie);
 		const runnable = holds("Thread.runnable", runnableOf);
 		const resumable = holds("Thread.resumable", unfinishedOf);
+		const cutOff = holds("Thread.cutOff", interruptedOf(["crash", "shutdown"]));
 
 		const findUnfinished = SqlSchema.findAll({
 			Request: Schema.Void,
@@ -1099,6 +1102,7 @@ export const layer = Layer.effect(
 			setAttempt,
 			runnable,
 			resumable,
+			cutOff,
 			unfinished,
 			projectRun,
 			open,
diff --git a/packages/harness/test/control.prompt.test.ts b/packages/harness/test/control.prompt.test.ts
index 7c2872aa..adf67179 100644
--- a/packages/harness/test/control.prompt.test.ts
+++ b/packages/harness/test/control.prompt.test.ts
@@ -435,8 +435,9 @@ describe("Control.update", () => {
 		}),
 	);
 
-	// "Send now" on a steer left waiting by a stop: nothing to change, but the session must wake.
-	itWatched("wakes for a steer already in the steer lane without recording a change", () =>
+	// "Send now" on a steer left waiting by a stop: the lane is unchanged, but the move is recorded, since
+	// that is what makes the parked prompt run, now or after a crash.
+	itWatched("records and wakes a move to the steer lane for a steer already in it", () =>
 		Effect.gen(function* () {
 			const { control, sessionId, threadId } = yield* setup;
 			const steer = yield* control.prompt({ sessionId, prompt: prompt("Parked") });
@@ -445,7 +446,7 @@ describe("Control.update", () => {
 			expect(yield* control.update(threadId, steer.id, { delivery: "steer" })).toBe(true);
 
 			expect(wakes).toEqual([threadId]);
-			expect(yield* eventCount("session.prompt.updated.1")).toBe(0);
+			expect(yield* eventCount("session.prompt.updated.1")).toBe(1);
 		}),
 	);
 
diff --git a/packages/harness/test/runner.loop.test.ts b/packages/harness/test/runner.loop.test.ts
index 69a4c2f2..516a989f 100644
--- a/packages/harness/test/runner.loop.test.ts
+++ b/packages/harness/test/runner.loop.test.ts
@@ -1074,6 +1074,56 @@ describe("runner loop — queued input", () => {
 		}),
 	);
 
+	// Asking for the steer lane wakes a parked prompt even when it already is a steer: "send now" runs it.
+	it(
+		"runs a parked steer asked for the steer lane again",
+		Effect.gen(function* () {
+			yield* reset;
+			const control = yield* Control.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			const services = yield* Effect.context<Control.Service | Thread.Service>();
+			script.push("fail");
+			during.run = send(threadId, "S1").pipe(Effect.asVoid, Effect.orDie, Effect.provideContext(services));
+
+			yield* send(threadId, "A");
+			yield* settle(threadId);
+			expect(yield* control.update(threadId, SessionMessageSchema.ID.make("S1"), { delivery: "steer" })).toBe(true);
+			yield* settle(threadId);
+
+			expect(seen).toEqual(["failed", "succeeded"]);
+			expect(contexts.map(texts)).toEqual([["A"], ["A", "S1"]]);
+		}),
+	);
+
+	// A prompt accepted after a failure, whose host died before running it, runs on the next start as its
+	// wake would have: the parked follow-up first, not another answer to the failed reply.
+	it(
+		"runs a prompt accepted after a failure on the next start as its wake would have",
+		Effect.gen(function* () {
+			yield* reset;
+			const control = yield* Control.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			const services = yield* Effect.context<Control.Service | Thread.Service>();
+			script.push("fail");
+			during.run = send(threadId, "F1", "followUp").pipe(
+				Effect.asVoid,
+				Effect.orDie,
+				Effect.provideContext(services),
+			);
+
+			yield* send(threadId, "A");
+			yield* settle(threadId);
+			// Accepted, with no wake: the host died before its run.
+			yield* admit({ id: "C", threadId, delivery: "followUp" });
+			yield* control.resumeUnfinished;
+
+			expect(seen).toEqual(["failed", "succeeded"]);
+			expect(contexts.map(texts)).toEqual([["A"], ["A", "F1"], ["A", "F1", "C"]]);
+		}),
+	);
+
 	// A stop claims the wakes of what was sent during the run: it stays queued, and the next prompt
 	// places it, steers with that prompt and follow-ups after.
 	it(

From c09f6f8d8b2be0c4077538a45d53b9bd978a5783 Mon Sep 17 00:00:00 2001
From: Sanchit Rk <0xsanchit@gmail.com>
Date: Sun, 8 Nov 2026 18:58:48 +0530
Subject: [PATCH 5/7] fix(harness): keep a stop on a crash-cut-off thread
 before its run opens

A user stop that landed before a drain opened its run was recorded only
when a prompt was runnable. On a thread a crash had cut off, with
nothing runnable, the stop left no trace: the thread stayed cut off and
the next server start resumed the run the user had stopped.

Such a stop is now recorded whenever the thread is resumable, cut off
or runnable, so it stands across a restart. A stop after run.failed
still adds no second terminal: nothing is resumable then.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/harness/src/runner/execute.ts    |  6 +++---
 packages/harness/test/runner.loop.test.ts | 23 +++++++++++++++++++++++
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/packages/harness/src/runner/execute.ts b/packages/harness/src/runner/execute.ts
index bd54f179..b3a593ec 100644
--- a/packages/harness/src/runner/execute.ts
+++ b/packages/harness/src/runner/execute.ts
@@ -90,11 +90,11 @@ export const layer = Layer.effect(
 						const interrupted = Cause.hasInterruptsOnly(exit.cause);
 						const thread = yield* threads.get(threadId);
 						if (Option.isNone(thread)) return;
-						// With no run open, before it opened or after it ended, a user stop is recorded only to park a
-						// prompt that would otherwise still run.
+						// With no run open, before it opened or after it ended, a user stop is recorded only when
+						// something would otherwise still run, now or on the next start.
 						const open = ran && thread.value.runState !== "idle";
 						const stop = interrupted && reason === "user";
-						if (!open && !(stop && (yield* threads.runnable(threadId)))) return;
+						if (!open && !(stop && (yield* threads.resumable(threadId)))) return;
 						yield* publishLifecycle(threadId, (base) =>
 							interrupted
 								? // Nobody named a reason, so the process took the decision itself.
diff --git a/packages/harness/test/runner.loop.test.ts b/packages/harness/test/runner.loop.test.ts
index 516a989f..85f02e1f 100644
--- a/packages/harness/test/runner.loop.test.ts
+++ b/packages/harness/test/runner.loop.test.ts
@@ -1498,6 +1498,29 @@ describe("runner loop — resume after restart", () => {
 		}),
 	);
 
+	// A thread a crash cut off, stopped before a drain opened a run: nothing is runnable, but the stop must
+	// still stand, or the next start resumes the run the user stopped.
+	it(
+		"keeps a stop that lands before the run opened on a thread a crash cut off",
+		Effect.gen(function* () {
+			yield* provider.reset;
+			const control = yield* Control.Service;
+			const execution = yield* RunnerExecution.Service;
+			const seen = yield* outcomes;
+			const { threadId } = yield* seedSession();
+			yield* crashedMidReply(threadId, "A");
+
+			yield* execution.wake(threadId);
+			expect(yield* execution.interrupt(threadId, "user")).toBe(true);
+			yield* settle(threadId);
+			yield* control.resumeUnfinished;
+
+			expect(contexts).toEqual([]);
+			expect(seen).toEqual(["interrupted", "interrupted"]);
+			expect(yield* stateOf(threadId)).toEqual({ unfinished: false, restarts: 0 });
+		}),
+	);
+
 	// The stop is accepted before the drain opened its run: it is still the user's, so what woke the drain
 	// is parked rather than left to run on the next start.
 	it(

From 1bb78eff8aa7ab46a166bdacd9f3fae5b1c4d1ae Mon Sep 17 00:00:00 2001
From: Sanchit Rk <0xsanchit@gmail.com>
Date: Sun, 8 Nov 2026 19:21:50 +0530
Subject: [PATCH 6/7] fix(harness): move updated_at with any change to a thread
 or session

A session's updated_at now moves with any write to it or anything under
it, and a thread's with any write to it or anything under it: entries,
parts, queued prompts and documents. Before, only conversation writes
moved them, and every one also bumped the session.

The rule lives in one place, Store.write: rows a write touches carry its
revision, so before commit it moves threads stamped with that revision
or owning rows stamped with it, then their sessions, and stamps the
moves so sync sends them. The hand-written bumps in thread writes are
gone. entry and inbox get rev indexes for the lookup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../__artifacts__/server.cli-threads.json     |  2 +-
 .../test/__artifacts__/sync.index.json        | 52 +++++-----
 .../test/__artifacts__/sync.updated.json      | 24 +++++
 packages/codework/test/sync.test.ts           | 95 +++++++++++++++++++
 packages/harness/src/db/migrations.ts         |  3 +
 packages/harness/src/db/store.ts              | 29 +++++-
 packages/harness/src/thread/thread.ts         | 29 +++---
 .../test/__artifacts__/store.revision.json    | 65 +++++++++----
 8 files changed, 232 insertions(+), 67 deletions(-)
 create mode 100644 packages/codework/test/__artifacts__/sync.updated.json

diff --git a/packages/codework/test/__artifacts__/server.cli-threads.json b/packages/codework/test/__artifacts__/server.cli-threads.json
index ec493d82..38a6af0d 100644
--- a/packages/codework/test/__artifacts__/server.cli-threads.json
+++ b/packages/codework/test/__artifacts__/server.cli-threads.json
@@ -13,7 +13,7 @@
 	},
 	"list": {
 		"status": 0,
-		"stdout": "<before>  fork of <main>  openai/gpt-6-luna  0 tok $0.0000  (untitled)\n<at>  fork of <main>  openai/gpt-6-luna  2 tok $0.0000  branch\n<main>  main                                              openai/gpt-6-luna  2 tok $0.0000  hello\n"
+		"stdout": "<at>  fork of <main>  openai/gpt-6-luna  2 tok $0.0000  branch\n<before>  fork of <main>  openai/gpt-6-luna  0 tok $0.0000  (untitled)\n<main>  main                                              openai/gpt-6-luna  2 tok $0.0000  hello\n"
 	},
 	"listJson": [
 		{
diff --git a/packages/codework/test/__artifacts__/sync.index.json b/packages/codework/test/__artifacts__/sync.index.json
index b4ad102f..addaed73 100644
--- a/packages/codework/test/__artifacts__/sync.index.json
+++ b/packages/codework/test/__artifacts__/sync.index.json
@@ -34,23 +34,6 @@
 		"rev": "<rev>"
 	},
 	"snapshot": [
-		{
-			"_tag": "Session",
-			"session": {
-				"id": "<session>",
-				"spaceId": "<space>",
-				"slug": "<slug>",
-				"directory": "<home>",
-				"project": {
-					"id": "<project>",
-					"name": "Beta"
-				},
-				"createdAt": "<time>",
-				"updatedAt": "<time>",
-				"mainThreadId": "<main>"
-			},
-			"rev": "<rev 0>"
-		},
 		{
 			"_tag": "Thread",
 			"thread": {
@@ -80,6 +63,23 @@
 				"createdAt": "<time>",
 				"sessionId": "<session>"
 			},
+			"rev": "<rev 0>"
+		},
+		{
+			"_tag": "Session",
+			"session": {
+				"id": "<session>",
+				"spaceId": "<space>",
+				"slug": "<slug>",
+				"directory": "<home>",
+				"project": {
+					"id": "<project>",
+					"name": "Beta"
+				},
+				"createdAt": "<time>",
+				"updatedAt": "<time>",
+				"mainThreadId": "<main>"
+			},
 			"rev": "<rev 1>"
 		},
 		{
@@ -107,7 +107,7 @@
 				"createdAt": "<time>",
 				"sessionId": "<session>"
 			},
-			"rev": "<rev 2>"
+			"rev": "<rev 1>"
 		},
 		{
 			"_tag": "Project",
@@ -118,7 +118,7 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Space",
@@ -131,18 +131,18 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Removed",
 			"kind": "session",
 			"id": "<doomed>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		},
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		}
 	],
 	"resumed": [
@@ -155,7 +155,7 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Space",
@@ -168,18 +168,18 @@
 				"createdAt": "<time>",
 				"updatedAt": "<time>"
 			},
-			"rev": "<rev 3>"
+			"rev": "<rev 2>"
 		},
 		{
 			"_tag": "Removed",
 			"kind": "session",
 			"id": "<doomed>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		},
 		{
 			"_tag": "Synced",
 			"storeId": "<store>",
-			"rev": "<rev 4>"
+			"rev": "<rev 3>"
 		}
 	]
 }
diff --git a/packages/codework/test/__artifacts__/sync.updated.json b/packages/codework/test/__artifacts__/sync.updated.json
new file mode 100644
index 00000000..b2c9e332
--- /dev/null
+++ b/packages/codework/test/__artifacts__/sync.updated.json
@@ -0,0 +1,24 @@
+[
+	{
+		"step": "configure the main thread",
+		"session": true,
+		"main": true
+	},
+	{
+		"step": "prompt the main thread",
+		"session": true,
+		"main": true
+	},
+	{
+		"step": "fork the main thread",
+		"session": true,
+		"main": false,
+		"fork": "new"
+	},
+	{
+		"step": "prompt the fork",
+		"session": true,
+		"main": false,
+		"fork": true
+	}
+]
diff --git a/packages/codework/test/sync.test.ts b/packages/codework/test/sync.test.ts
index 266a228b..417d2c6a 100644
--- a/packages/codework/test/sync.test.ts
+++ b/packages/codework/test/sync.test.ts
@@ -138,6 +138,101 @@ it("index.sync sends the index, resumes from a revision, and follows configure,
 	}
 }, 40_000);
 
+it("updatedAt moves a thread with any change to it or below it, and its session with any change in it", async () => {
+	const home = realpathSync(mkdtempSync(join(tmpdir(), "codework-sync-updated-")));
+	try {
+		const artifact = await Effect.gen(function* () {
+			const listener = yield* HttpServer.HttpServer;
+			if (listener.address._tag === "UnixPathAddress") return yield* Effect.die("Expected TCP listener");
+			const context = yield* Layer.build(Client.layer(`ws://127.0.0.1:${listener.address.port}/rpc/v1`));
+			const rpc = yield* Client.make.pipe(Effect.provideContext(context));
+
+			/** Every session's and thread's `updatedAt`, by id, as the index sends them. */
+			const times = Effect.gen(function* () {
+				const items = yield* rpc["index.sync"]({ after: 0 }).pipe(
+					Stream.takeUntil((item) => item._tag === "Synced"),
+					Stream.runCollect,
+				);
+				const at = new Map<string, number>();
+				for (const item of items) {
+					if (item._tag === "Session") at.set(item.session.id, item.session.updatedAt);
+					if (item._tag === "Thread") at.set(item.thread.id, item.thread.updatedAt);
+				}
+				return at;
+			});
+
+			const created = yield* rpc["session.create"]({ directory: home });
+			const sessionId = created.session.id;
+			const rows: Record<string, string> = { session: sessionId, main: created.id };
+			const steps: Array<Record<string, unknown>> = [];
+			let before = yield* times;
+			/** Runs `change` a clock tick after the last one, then records which rows it moved. */
+			const step = <A, E>(name: string, change: Effect.Effect<A, E>) =>
+				Effect.gen(function* () {
+					yield* Effect.sleep("5 millis");
+					const result = yield* change;
+					const after = yield* times;
+					const moved = Object.fromEntries(
+						Object.entries(rows).map(([row, id]) => {
+							const was = before.get(id);
+							return [row, was === undefined ? "new" : after.get(id)! > was];
+						}),
+					);
+					steps.push({ step: name, ...moved });
+					before = after;
+					return result;
+				});
+
+			yield* step(
+				"configure the main thread",
+				rpc["thread.configure"]({ sessionId, runtime: { thinkingLevel: "high" } }),
+			);
+			yield* step(
+				"prompt the main thread",
+				rpc["thread.prompt"]({ sessionId, text: "Main prompt" }).pipe(
+					Effect.andThen(rpc["thread.wait"]({ sessionId })),
+				),
+			);
+			const reply = (yield* rpc["thread.history"]({ sessionId })).entries.at(-1);
+			if (reply === undefined) return yield* Effect.die("main thread has no reply");
+			const fork = yield* rpc["thread.fork"]({ sessionId, entryId: reply.id }).pipe(
+				Effect.tap((forked) => Effect.sync(() => (rows["fork"] = forked.thread.id))),
+				(forking) => step("fork the main thread", forking),
+			);
+			yield* step(
+				"prompt the fork",
+				rpc["thread.prompt"]({ sessionId, threadId: fork.thread.id, text: "Fork prompt" }).pipe(
+					Effect.andThen(rpc["thread.wait"]({ sessionId, threadId: fork.thread.id })),
+				),
+			);
+
+			expect(steps).toEqual([
+				{ step: "configure the main thread", session: true, main: true },
+				{ step: "prompt the main thread", session: true, main: true },
+				{ step: "fork the main thread", session: true, main: false, fork: "new" },
+				{ step: "prompt the fork", session: true, main: false, fork: true },
+			]);
+			return steps;
+		}).pipe(
+			Effect.scoped,
+			Effect.provide(
+				Server.layer({
+					host: "127.0.0.1",
+					port: 0,
+					harness: { home, hostCwd: home, plugins: [], llm: immediateOpen() },
+				}),
+			),
+			Effect.timeout("30 seconds"),
+			Effect.runPromise,
+		);
+		await expect(`${JSON.stringify(artifact, null, "\t")}\n`).toMatchFileSnapshot(
+			"./__artifacts__/sync.updated.json",
+		);
+	} finally {
+		rmSync(home, { recursive: true, force: true });
+	}
+}, 40_000);
+
 interface Reply {
 	readonly thinking?: ReadonlyArray<string>;
 	readonly text: ReadonlyArray<string>;
diff --git a/packages/harness/src/db/migrations.ts b/packages/harness/src/db/migrations.ts
index 1ee2aaa4..e3081317 100644
--- a/packages/harness/src/db/migrations.ts
+++ b/packages/harness/src/db/migrations.ts
@@ -298,6 +298,9 @@ export const migrations = {
 		yield* sql`CREATE INDEX thread_rev_idx ON thread (rev)`;
 		yield* sql`CREATE INDEX entry_thread_rev_idx ON entry (thread_id, rev)`;
 		yield* sql`CREATE INDEX inbox_thread_rev_idx ON inbox (thread_id, rev)`;
+		// What a write touched, for the threads it moves (db/store.ts).
+		yield* sql`CREATE INDEX entry_rev_idx ON entry (rev)`;
+		yield* sql`CREATE INDEX inbox_rev_idx ON inbox (rev)`;
 		// Every insert and update carries the current transaction's revision, so a write path that
 		// forgets fails loudly. A row written twice in one transaction keeps its rev, which this allows.
 		for (const table of ["project", "space", "session", "thread", "entry", "inbox"]) {
diff --git a/packages/harness/src/db/store.ts b/packages/harness/src/db/store.ts
index b950f13f..409060c4 100644
--- a/packages/harness/src/db/store.ts
+++ b/packages/harness/src/db/store.ts
@@ -1,4 +1,4 @@
-import { Context, Effect, Layer, PubSub, type Scope } from "effect";
+import { Clock, Context, Effect, Layer, PubSub, type Scope } from "effect";
 import { SqlClient, type SqlError } from "effect/sql";
 
 /** The store's identity and its last revision taken. */
@@ -10,8 +10,9 @@ export interface Head {
 export interface Interface {
 	/**
 	 * Runs `effect` as one write transaction, or inside the enclosing one. Every write to project,
-	 * space, session, thread, entry or inbox goes through it. After a commit that took a revision,
-	 * the doorbell rings.
+	 * space, session, thread, entry or inbox goes through it. Before a commit that took a revision, it
+	 * moves `updated_at` of every thread written in it or below it, then of every session written in it
+	 * or below it; after the commit, the doorbell rings.
 	 */
 	readonly write: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError.SqlError, R>;
 	/** The enclosing write's revision, taken on first use; every row the write touches is stamped with it. */
@@ -39,12 +40,32 @@ export const layer = Layer.effect(
 
 		const ring = Effect.forEach(wakes, (wake) => PubSub.publish(wake, undefined), { discard: true });
 
+		// Rows a write touches carry its revision, so they say what changed: a thread or session moves with
+		// any change to itself or below it, and the move is stamped too, so sync sends it.
+		const touch = (rev: number) =>
+			Effect.gen(function* () {
+				const now = yield* Clock.currentTimeMillis;
+				yield* sql`
+					UPDATE thread SET updated_at = ${now}, rev = ${rev}
+					WHERE rev = ${rev}
+						OR id IN (SELECT thread_id FROM entry WHERE rev = ${rev} UNION SELECT thread_id FROM inbox WHERE rev = ${rev})
+				`;
+				yield* sql`
+					UPDATE session SET updated_at = ${now}, rev = ${rev}
+					WHERE rev = ${rev} OR id IN (SELECT session_id FROM thread WHERE rev = ${rev})
+				`;
+			});
+
 		const write = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E | SqlError.SqlError, R> =>
 			Effect.uninterruptibleMask((restore) =>
 				Effect.gen(function* () {
 					if ((yield* Taken) !== undefined) return yield* restore(effect);
 					const taken: { rev: number | undefined } = { rev: undefined };
-					const result = yield* sql.withTransaction(restore(Effect.provideService(effect, Taken, taken)));
+					const result = yield* sql.withTransaction(
+						restore(Effect.provideService(effect, Taken, taken)).pipe(
+							Effect.tap(() => (taken.rev === undefined ? Effect.void : touch(taken.rev))),
+						),
+					);
 					if (taken.rev !== undefined) yield* ring;
 					return result;
 				}),
diff --git a/packages/harness/src/thread/thread.ts b/packages/harness/src/thread/thread.ts
index 4593b5ee..2c1b632e 100644
--- a/packages/harness/src/thread/thread.ts
+++ b/packages/harness/src/thread/thread.ts
@@ -548,26 +548,22 @@ export const layer = Layer.effect(
 			for (const [partIndex, part] of parts.entries()) yield* writePart(entryId, threadId, partIndex, part);
 		});
 
-		// Usage lives on the thread and moves with the envelope stored; the session's last activity
-		// moves with it.
-		const touch = Effect.fnUntraced(function* (
+		// Usage lives on the thread and moves with the envelope stored.
+		const addUsage = Effect.fnUntraced(function* (
 			thread: ThreadRow,
 			delta?: { cost: number; input: number; output: number; cacheRead: number; cacheWrite: number },
 		) {
-			const now = yield* epochNow;
-			const rev = yield* store.rev;
+			if (delta === undefined) return;
 			yield* sql`
 				UPDATE thread SET
-					rev = ${rev},
-					updated_at = ${now},
-					cost = cost + ${delta?.cost ?? 0},
-					tokens_input = tokens_input + ${delta?.input ?? 0},
-					tokens_output = tokens_output + ${delta?.output ?? 0},
-					tokens_cache_read = tokens_cache_read + ${delta?.cacheRead ?? 0},
-					tokens_cache_write = tokens_cache_write + ${delta?.cacheWrite ?? 0}
+					rev = ${yield* store.rev},
+					cost = cost + ${delta.cost},
+					tokens_input = tokens_input + ${delta.input},
+					tokens_output = tokens_output + ${delta.output},
+					tokens_cache_read = tokens_cache_read + ${delta.cacheRead},
+					tokens_cache_write = tokens_cache_write + ${delta.cacheWrite}
 				WHERE id = ${thread.id}
 			`;
-			yield* sql`UPDATE session SET updated_at = ${now}, rev = ${rev} WHERE id = ${thread.sessionId}`;
 		});
 
 		type AppendTxResult =
@@ -659,7 +655,7 @@ export const layer = Layer.effect(
 							} as const;
 						}
 						yield* writeParts(input.id, input.threadId, parts);
-						yield* touch(
+						yield* addUsage(
 							thread.value,
 							usage === undefined
 								? undefined
@@ -730,7 +726,7 @@ export const layer = Layer.effect(
 						UPDATE entry SET data = ${input.data}, updated_at = ${now}, rev = ${yield* store.rev}
 						WHERE id = ${input.id} AND state = 'draft'
 					`;
-					yield* touch(thread, delta);
+					yield* addUsage(thread, delta);
 				}),
 			);
 		}, Effect.orDie);
@@ -809,7 +805,6 @@ export const layer = Layer.effect(
 				RETURNING id
 			`;
 				if (rows.length !== 1) return yield* Effect.die(`commit requires a fully-settled draft ${input.id}`);
-				yield* sql`UPDATE thread SET updated_at = ${now}, rev = ${yield* store.rev} WHERE id = ${input.threadId}`;
 			},
 			store.write,
 			Effect.orDie,
@@ -829,7 +824,7 @@ export const layer = Layer.effect(
 							rev = ${yield* store.rev}
 						WHERE id = ${input.id} AND state = 'draft'
 					`;
-					yield* touch(thread, delta);
+					yield* addUsage(thread, delta);
 				}),
 			);
 		}, Effect.orDie);
diff --git a/packages/harness/test/__artifacts__/store.revision.json b/packages/harness/test/__artifacts__/store.revision.json
index 6f353e4c..c4df6f4d 100644
--- a/packages/harness/test/__artifacts__/store.revision.json
+++ b/packages/harness/test/__artifacts__/store.revision.json
@@ -55,28 +55,36 @@
 			"writes": [
 				"session S1 insert",
 				"thread T1 insert",
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
 			"rev": 3,
 			"by": "session.thread.configured",
 			"writes": [
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
 			"rev": 4,
 			"by": "session.prompt.admitted",
 			"writes": [
-				"inbox E1 insert"
+				"inbox E1 insert",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
 			"rev": 5,
 			"by": "session.execution.started",
 			"writes": [
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -94,8 +102,8 @@
 				"inbox E1 update",
 				"entry E1 insert",
 				"thread T1 update",
-				"session S1 update",
-				"thread T1 update"
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -111,7 +119,9 @@
 			"rev": 9,
 			"by": "plain write",
 			"writes": [
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -121,6 +131,7 @@
 				"thread T1 update",
 				"entry E3 insert",
 				"thread T1 update",
+				"thread T1 update",
 				"session S1 update"
 			]
 		},
@@ -130,15 +141,18 @@
 			"writes": [
 				"entry E3 update",
 				"thread T1 update",
-				"session S1 update",
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
 			"rev": 12,
 			"by": "session.tool.settled",
 			"writes": [
-				"entry E3 update"
+				"entry E3 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -147,14 +161,17 @@
 			"writes": [
 				"entry E3 update",
 				"thread T1 update",
-				"thread T1 update"
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
 			"rev": 14,
 			"by": "plain write",
 			"writes": [
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -164,6 +181,7 @@
 				"thread T1 update",
 				"entry E4 insert",
 				"thread T1 update",
+				"thread T1 update",
 				"session S1 update"
 			]
 		},
@@ -173,8 +191,9 @@
 			"writes": [
 				"entry E4 update",
 				"thread T1 update",
-				"session S1 update",
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -183,14 +202,17 @@
 			"writes": [
 				"entry E4 update",
 				"thread T1 update",
-				"thread T1 update"
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
 			"rev": 18,
 			"by": "session.execution.succeeded",
 			"writes": [
-				"thread T1 update"
+				"thread T1 update",
+				"thread T1 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -198,7 +220,9 @@
 			"by": "session.thread.forked",
 			"writes": [
 				"thread T2 insert",
-				"thread T2 update"
+				"thread T2 update",
+				"thread T2 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -206,7 +230,10 @@
 			"by": "plain write",
 			"writes": [
 				"thread T1 update",
-				"thread T2 update"
+				"thread T2 update",
+				"thread T1 update",
+				"thread T2 update",
+				"session S1 update"
 			]
 		},
 		{
@@ -225,7 +252,7 @@
 			"SP1 rev=6"
 		],
 		"session": [
-			"S1 rev=16"
+			"S1 rev=20"
 		],
 		"thread": [
 			"T1 rev=20",

From 5aba4b277298f0efa031b230883cea61cc167515 Mon Sep 17 00:00:00 2001
From: Sanchit Rk <0xsanchit@gmail.com>
Date: Sun, 8 Nov 2026 22:42:42 +0530
Subject: [PATCH 7/7] fix(harness): move a session's updated_at only with its
 own row or a new thread

Rolling every thread, entry and inbox write up into the session rewrote
and re-synced the session row on every message. A session's activity is
its newest thread's, so read it at query time instead.

- Store.write moves a session only when its own row carries the
  transaction's rev; threads still move with any change to them or
  below them.
- Creating a thread stamps its session, so a new thread or fork moves it.
- Session lists order by their newest thread's updated_at, with a
  thread (session_id, updated_at) index; link and relink drop their
  hand-written updated_at.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../test/__artifacts__/sync.updated.json      | 11 ++--
 packages/codework/test/sync.test.ts           | 11 ++--
 packages/harness/src/db/migrations.ts         |  2 +
 packages/harness/src/db/store.ts              | 12 ++---
 packages/harness/src/session/session.ts       | 18 +++----
 packages/harness/src/thread/thread.ts         |  2 +
 .../test/__artifacts__/store.revision.json    | 52 +++++++------------
 7 files changed, 52 insertions(+), 56 deletions(-)

diff --git a/packages/codework/test/__artifacts__/sync.updated.json b/packages/codework/test/__artifacts__/sync.updated.json
index b2c9e332..218b670e 100644
--- a/packages/codework/test/__artifacts__/sync.updated.json
+++ b/packages/codework/test/__artifacts__/sync.updated.json
@@ -1,12 +1,17 @@
 [
 	{
-		"step": "configure the main thread",
+		"step": "link the session",
 		"session": true,
+		"main": false
+	},
+	{
+		"step": "configure the main thread",
+		"session": false,
 		"main": true
 	},
 	{
 		"step": "prompt the main thread",
-		"session": true,
+		"session": false,
 		"main": true
 	},
 	{
@@ -17,7 +22,7 @@
 	},
 	{
 		"step": "prompt the fork",
-		"session": true,
+		"session": false,
 		"main": false,
 		"fork": true
 	}
diff --git a/packages/codework/test/sync.test.ts b/packages/codework/test/sync.test.ts
index 417d2c6a..b037b660 100644
--- a/packages/codework/test/sync.test.ts
+++ b/packages/codework/test/sync.test.ts
@@ -1,6 +1,7 @@
 /* @effect-diagnostics nodeBuiltinImport:off -- starts the real server in a temporary home. */
 import { createAssistantMessageEventStream, type Message } from "@codeworksh/aikit";
 import { Effect, Layer, Queue, Stream } from "effect";
+import { Session } from "@codeworksh/harness/effect";
 import { HttpServer } from "effect/http";
 import { mkdtempSync, realpathSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -138,7 +139,7 @@ it("index.sync sends the index, resumes from a revision, and follows configure,
 	}
 }, 40_000);
 
-it("updatedAt moves a thread with any change to it or below it, and its session with any change in it", async () => {
+it("updatedAt moves a thread with any change to it or below it, and its session with its own row or a new thread", async () => {
 	const home = realpathSync(mkdtempSync(join(tmpdir(), "codework-sync-updated-")));
 	try {
 		const artifact = await Effect.gen(function* () {
@@ -183,6 +184,7 @@ it("updatedAt moves a thread with any change to it or below it, and its session
 					return result;
 				});
 
+			yield* step("link the session", rpc["session.link"]({ sessionId, hostDir: Session.AbsolutePath.make(home) }));
 			yield* step(
 				"configure the main thread",
 				rpc["thread.configure"]({ sessionId, runtime: { thinkingLevel: "high" } }),
@@ -207,10 +209,11 @@ it("updatedAt moves a thread with any change to it or below it, and its session
 			);
 
 			expect(steps).toEqual([
-				{ step: "configure the main thread", session: true, main: true },
-				{ step: "prompt the main thread", session: true, main: true },
+				{ step: "link the session", session: true, main: false },
+				{ step: "configure the main thread", session: false, main: true },
+				{ step: "prompt the main thread", session: false, main: true },
 				{ step: "fork the main thread", session: true, main: false, fork: "new" },
-				{ step: "prompt the fork", session: true, main: false, fork: true },
+				{ step: "prompt the fork", session: false, main: false, fork: true },
 			]);
 			return steps;
 		}).pipe(
diff --git a/packages/harness/src/db/migrations.ts b/packages/harness/src/db/migrations.ts
index e3081317..176d11e8 100644
--- a/packages/harness/src/db/migrations.ts
+++ b/packages/harness/src/db/migrations.ts
@@ -182,6 +182,8 @@ export const migrations = {
 		`;
 		yield* sql`CREATE UNIQUE INDEX thread_main_idx ON thread (session_id) WHERE origin_kind = 'main'`;
 		yield* sql`CREATE INDEX thread_origin_idx ON thread (origin_thread_id) WHERE origin_thread_id IS NOT NULL`;
+		// A session's threads by activity, which also orders sessions (session/session.ts).
+		yield* sql`CREATE INDEX thread_session_idx ON thread (session_id, updated_at)`;
 		// Call ids are unique per entry, not globally: one subagent per call of a thread.
 		yield* sql`
 			CREATE UNIQUE INDEX thread_call_idx ON thread (origin_thread_id, origin_call_id)
diff --git a/packages/harness/src/db/store.ts b/packages/harness/src/db/store.ts
index 409060c4..bda9462b 100644
--- a/packages/harness/src/db/store.ts
+++ b/packages/harness/src/db/store.ts
@@ -11,8 +11,8 @@ export interface Interface {
 	/**
 	 * Runs `effect` as one write transaction, or inside the enclosing one. Every write to project,
 	 * space, session, thread, entry or inbox goes through it. Before a commit that took a revision, it
-	 * moves `updated_at` of every thread written in it or below it, then of every session written in it
-	 * or below it; after the commit, the doorbell rings.
+	 * moves `updated_at` of every thread written in it or below it, and of every session row written in
+	 * it; after the commit, the doorbell rings.
 	 */
 	readonly write: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError.SqlError, R>;
 	/** The enclosing write's revision, taken on first use; every row the write touches is stamped with it. */
@@ -40,8 +40,9 @@ export const layer = Layer.effect(
 
 		const ring = Effect.forEach(wakes, (wake) => PubSub.publish(wake, undefined), { discard: true });
 
-		// Rows a write touches carry its revision, so they say what changed: a thread or session moves with
-		// any change to itself or below it, and the move is stamped too, so sync sends it.
+		// Rows a write touches carry its revision, so they say what changed: a thread moves with any change
+		// to itself or below it, and the move is stamped too, so sync sends it. A session moves only with its
+		// own row: its activity is its newest thread's, read at query time.
 		const touch = (rev: number) =>
 			Effect.gen(function* () {
 				const now = yield* Clock.currentTimeMillis;
@@ -51,8 +52,7 @@ export const layer = Layer.effect(
 						OR id IN (SELECT thread_id FROM entry WHERE rev = ${rev} UNION SELECT thread_id FROM inbox WHERE rev = ${rev})
 				`;
 				yield* sql`
-					UPDATE session SET updated_at = ${now}, rev = ${rev}
-					WHERE rev = ${rev} OR id IN (SELECT session_id FROM thread WHERE rev = ${rev})
+					UPDATE session SET updated_at = ${now} WHERE rev = ${rev}
 				`;
 			});
 
diff --git a/packages/harness/src/session/session.ts b/packages/harness/src/session/session.ts
index b0e3a51c..6ffc6ff2 100644
--- a/packages/harness/src/session/session.ts
+++ b/packages/harness/src/session/session.ts
@@ -240,6 +240,9 @@ export const layer = Layer.effect(
 			execute: (id) => sql`SELECT * FROM space WHERE id = ${id}`,
 		});
 
+		// A session's activity is its newest thread's: its own `updated_at` moves only with its row.
+		const activity = sql`(SELECT MAX(t.updated_at) FROM thread t WHERE t.session_id = s.id)`;
+
 		const selectByProject = SqlSchema.findAll({
 			Request: Schema.String,
 			Result: SessionRow,
@@ -247,20 +250,20 @@ export const layer = Layer.effect(
 				SELECT s.* FROM session s
 				JOIN space p ON p.id = s.space_id
 				WHERE p.project_id = ${projectId}
-				ORDER BY s.updated_at DESC
+				ORDER BY ${activity} DESC
 			`,
 		});
 
 		const selectBySpace = SqlSchema.findAll({
 			Request: Schema.String,
 			Result: SessionRow,
-			execute: (spaceId) => sql`SELECT * FROM session WHERE space_id = ${spaceId} ORDER BY updated_at DESC`,
+			execute: (spaceId) => sql`SELECT s.* FROM session s WHERE s.space_id = ${spaceId} ORDER BY ${activity} DESC`,
 		});
 
 		const selectAll = SqlSchema.findAll({
 			Request: Schema.Void,
 			Result: SessionRow,
-			execute: () => sql`SELECT * FROM session ORDER BY updated_at DESC`,
+			execute: () => sql`SELECT s.* FROM session s ORDER BY ${activity} DESC`,
 		});
 
 		const insertSession = SqlSchema.void({
@@ -268,8 +271,6 @@ export const layer = Layer.effect(
 			execute: (row) => sql`INSERT INTO session ${sql.insert(row)}`,
 		});
 
-		const epochNow = Effect.map(DateTime.now, DateTime.toEpochMillis);
-
 		const projectCreated = Effect.fn("Session.projectCreated")(
 			function* (data: EventList.SessionCreated["data"], seq: number) {
 				const row = yield* SessionRow.insert.makeEffect({
@@ -388,10 +389,9 @@ export const layer = Layer.effect(
 		}) {
 			const session = yield* findSession(input.sessionId).pipe(Effect.orDie);
 			if (Option.isNone(session)) return yield* new SessionNotFoundError({ sessionId: input.sessionId });
-			const now = yield* epochNow;
 			yield* Effect.gen(function* () {
 				yield* sql`
-					UPDATE session SET host_dir = ${input.hostDir}, updated_at = ${now}, rev = ${yield* store.rev}
+					UPDATE session SET host_dir = ${input.hostDir}, rev = ${yield* store.rev}
 					WHERE id = ${input.sessionId}
 				`;
 			}).pipe(store.write, Effect.orDie);
@@ -431,11 +431,9 @@ export const layer = Layer.effect(
 				);
 			if (!directoryWithin(target.value.location, directory)) return yield* reject("directory_outside_space");
 			if (input.threadId === undefined) {
-				const now = yield* epochNow;
 				yield* Effect.gen(function* () {
 					yield* sql`
-						UPDATE session SET space_id = ${input.spaceId}, directory = ${directory}, updated_at = ${now},
-							rev = ${yield* store.rev}
+						UPDATE session SET space_id = ${input.spaceId}, directory = ${directory}, rev = ${yield* store.rev}
 						WHERE id = ${input.sessionId}
 					`;
 				}).pipe(store.write, Effect.orDie);
diff --git a/packages/harness/src/thread/thread.ts b/packages/harness/src/thread/thread.ts
index 2c1b632e..688d3281 100644
--- a/packages/harness/src/thread/thread.ts
+++ b/packages/harness/src/thread/thread.ts
@@ -515,6 +515,8 @@ export const layer = Layer.effect(
 					rev: yield* store.rev,
 				});
 				yield* insertThread(row);
+				// A new thread changes its session.
+				yield* sql`UPDATE session SET rev = ${row.rev} WHERE id = ${input.sessionId}`;
 			},
 			store.write,
 			Effect.orDie,
diff --git a/packages/harness/test/__artifacts__/store.revision.json b/packages/harness/test/__artifacts__/store.revision.json
index c4df6f4d..e8c110d4 100644
--- a/packages/harness/test/__artifacts__/store.revision.json
+++ b/packages/harness/test/__artifacts__/store.revision.json
@@ -55,6 +55,7 @@
 			"writes": [
 				"session S1 insert",
 				"thread T1 insert",
+				"session S1 update",
 				"thread T1 update",
 				"thread T1 update",
 				"session S1 update"
@@ -65,8 +66,7 @@
 			"by": "session.thread.configured",
 			"writes": [
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -74,8 +74,7 @@
 			"by": "session.prompt.admitted",
 			"writes": [
 				"inbox E1 insert",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -83,8 +82,7 @@
 			"by": "session.execution.started",
 			"writes": [
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -102,8 +100,7 @@
 				"inbox E1 update",
 				"entry E1 insert",
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -111,8 +108,7 @@
 			"by": "session.thread.system.changed",
 			"writes": [
 				"entry E2 insert",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -120,8 +116,7 @@
 			"by": "plain write",
 			"writes": [
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -131,8 +126,7 @@
 				"thread T1 update",
 				"entry E3 insert",
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -142,8 +136,7 @@
 				"entry E3 update",
 				"thread T1 update",
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -151,8 +144,7 @@
 			"by": "session.tool.settled",
 			"writes": [
 				"entry E3 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -161,8 +153,7 @@
 			"writes": [
 				"entry E3 update",
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -170,8 +161,7 @@
 			"by": "plain write",
 			"writes": [
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -181,8 +171,7 @@
 				"thread T1 update",
 				"entry E4 insert",
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -192,8 +181,7 @@
 				"entry E4 update",
 				"thread T1 update",
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -202,8 +190,7 @@
 			"writes": [
 				"entry E4 update",
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -211,8 +198,7 @@
 			"by": "session.execution.succeeded",
 			"writes": [
 				"thread T1 update",
-				"thread T1 update",
-				"session S1 update"
+				"thread T1 update"
 			]
 		},
 		{
@@ -220,6 +206,7 @@
 			"by": "session.thread.forked",
 			"writes": [
 				"thread T2 insert",
+				"session S1 update",
 				"thread T2 update",
 				"thread T2 update",
 				"session S1 update"
@@ -232,8 +219,7 @@
 				"thread T1 update",
 				"thread T2 update",
 				"thread T1 update",
-				"thread T2 update",
-				"session S1 update"
+				"thread T2 update"
 			]
 		},
 		{
@@ -252,7 +238,7 @@
 			"SP1 rev=6"
 		],
 		"session": [
-			"S1 rev=20"
+			"S1 rev=19"
 		],
 		"thread": [
 			"T1 rev=20",