Single authoritative owner of a bounded embedded conversation.

Drives lazy provider streams and sequential authorized tools without a second ExecutionController. All effect intents use Execution.commit/5. Queued inputs, messages, interaction state and turn outcomes use kernel checkpoints before acknowledgement. Incremental events are transient; terminal events follow commit. Subscribers receive {:agent_runtime, run_id, event}.

One root run can contain a prompt and queued follow-up turns. It shares one finite work budget and deadline policy. Hosts can explicitly disable the root deadline with run_timeout: :infinity; effect, commit and cleanup limits remain finite. Once settled, the host starts a new run with its canonical messages. Host sessions and Protocol V1 remain outside this process. :run restores a committed record for inspection only: any nonterminal restored run enters recovery_required and dispatches nothing. The host must reconcile uncertain effects and fence the previous incarnation before admitting replacement work. See PERSISTENCE.md and EMBEDDING.md.