Returns a specification to start this module under a supervisor.

See Supervisor.

Settles an exact admission after host effects, before any Runtime admission.

The owner must observe executor DOWN, confirm command/helper/pipe cleanup and atomically fence the exact token/generation against admission and future work. The closed attestation uses effects: %{kind: :host_pre_runtime, records: [...], result: actual_host_result, cleanup: :confirmed}. Each ordered record contains only a unique nonempty UTF-8 effect_id, nonempty UTF-8 kind and JSON-compatible result. Supply 1–128 records and at most 1 MiB of encoded effects, without secrets or live capabilities. Cleanup does not undo externally visible effects.

Reasons are :host_stopped, :superseded and :cancelled. Only cancellation durably defers automatic continuation. :host_stopped preserves Goal policy, budgets, usage and failure audit. Return values and persistence/binding fences match settle_unstarted_admission/4. Exact historical retries acknowledge the saved result; changed effects, reason or identity conflict. Keep the host seal on storage errors and across restart. Missing Runtime state is not evidence.

This call never releases work, replays effects or manufactures Runtime history. The host owns any later ordinary idle decision, after real user work completes.

Durably settles an exact released admission whose executor ended before Runtime admission.

Only the owner may attest to the closed evidence map containing the exact admission, executor: :confirmed_down, runtime_admission: :never_started, future_start: :fenced and effects: :none_dispatched. The host must correlate actual executor termination and permanently seal that token/generation at the same boundary as admission, including startup children and queued work. Missing Runtime state alone is not evidence. Keep the seal on storage errors.

Reasons are :preparation_failed, :superseded and :cancelled; only cancellation also durably defers continuation. Returns {:ok, {:settled, reason}} after an exact Store acknowledgement, including historical retries, or {:ok, {:not_settled, :stale | :bound | :started | :execution_observed}}. Persistence errors do not confirm settlement. This API never starts a turn.

Withdraws an exact admission after its owner atomically prevents its release.

Pass the admission returned by idle/2, including :host_generation and the runtime-minted :reservation_token. :superseded clears only that reservation; :cancelled also durably defers automatic continuation without pausing the Goal.

Returns {:ok, {:withdrawn, reason}} or {:ok, {:not_withdrawn, :stale | :started}}. A matching committed start for the admitted run/incarnation prevents withdrawal even when the host's logical turn ID differs from the Runtime's minted turn ID. Once host release wins, ordinary Runtime cancellation is required, even before Goal sees that receipt, except for the explicitly host-attested no-start path in settle_unstarted_admission/4.

This owner-only call cannot fence the host's execution queue. Before calling, the host must atomically invalidate the exact token/generation against release and must never execute a successfully withdrawn reservation. Unknown storage acknowledgement is not withdrawal confirmation; reconcile before proceeding.