diff --git a/Cargo.lock b/Cargo.lock
index 863148b2..b656a475 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6114,6 +6114,7 @@ dependencies = [
  "connector-slack",
  "connector-telegram",
  "figment",
+ "futures-util",
  "garde",
  "hex",
  "hmac",
diff --git a/apps/springtale-cli/src/cli.rs b/apps/springtale-cli/src/cli.rs
index 5627c5c1..d939f066 100644
--- a/apps/springtale-cli/src/cli.rs
+++ b/apps/springtale-cli/src/cli.rs
@@ -71,23 +71,10 @@ pub enum Command {
     /// Initialize Springtale (create data directory, vault, config).
     /// After setup, optionally links a chat platform and starts the daemon.
     ///
-    /// With a `<template>` argument, scaffolds that starter first then
-    /// runs the vault/DB setup — matches plan §16.4's success-criterion
-    /// command line: `springtale init cli-runner && springtale run`.
-    Init {
-        /// Optional template name — if given, equivalent to running
-        /// `springtale new <template>` then the interactive init.
-        template: Option<String>,
-    },
-    /// Create a new project from a starter template.
-    New {
-        /// Template name. Run `springtale new --help` for the full list, or see
-        /// `docs/guide/templates.md`. 14 starters ship: telegram-bot,
-        /// github-monitor, cron-runner, llm-assistant, blank-bot, cli-runner,
-        /// llm-swarm, discord-bot, matrix-bot, webhook-receiver, file-watcher,
-        /// research-assistant, code-review-swarm, meeting-summarizer.
-        template: String,
-    },
+    /// This is the one way to start: `springtale init && springtale run`.
+    /// Anything beyond the bare project comes from a recipe — browse them
+    /// in the colony UI or with `springtale recipes`.
+    Init,
     /// Log in to springtaled: prompts for the vault passphrase, exchanges
     /// it for a long-lived API token, and saves it (mode 0600).
     Login,
@@ -198,6 +185,11 @@ pub enum Command {
         #[command(subcommand)]
         action: SafetyAction,
     },
+    /// Model Context Protocol — bridge an MCP client onto the daemon.
+    Mcp {
+        #[command(subcommand)]
+        action: McpAction,
+    },
     /// Colony canvas — trees, agents, formations as the UI sees them.
     Canvas {
         /// Follow live canvas updates instead of printing a snapshot.
@@ -533,6 +525,15 @@ pub enum RuleAction {
     },
 }
 
+#[derive(Subcommand, Debug)]
+pub enum McpAction {
+    /// Speak the MCP stdio transport on stdin/stdout, forwarding every
+    /// message to the running daemon's `/mcp` endpoint. For editors that
+    /// can only launch a subprocess. Set `SPRINGTALE_API_TOKEN` so the
+    /// bridge never has to prompt for a token.
+    Serve,
+}
+
 #[derive(Subcommand, Debug)]
 pub enum ServerAction {
     /// Start springtaled inline.
diff --git a/apps/springtale-cli/src/client.rs b/apps/springtale-cli/src/client.rs
index 51c15f6e..37691456 100644
--- a/apps/springtale-cli/src/client.rs
+++ b/apps/springtale-cli/src/client.rs
@@ -106,6 +106,18 @@ impl Client {
         Ok(resp)
     }
 
+    /// Start a request against `path` with the bearer header already
+    /// applied, for callers that need the raw `reqwest` response rather
+    /// than a decoded JSON body. The MCP stdio bridge uses it: it needs
+    /// the response headers (`Mcp-Session-Id`) and an SSE body, and it
+    /// must not hold a second copy of the API token.
+    pub fn request(&self, method: reqwest::Method, path: &str) -> reqwest::RequestBuilder {
+        // SECURITY: expose needed to set the bearer header.
+        self.http
+            .request(method, self.url(path))
+            .bearer_auth(self.token.expose_secret())
+    }
+
     fn url(&self, p: &str) -> String {
         format!("{}{p}", self.base)
     }
diff --git a/apps/springtale-cli/src/commands/mcp/bridge.rs b/apps/springtale-cli/src/commands/mcp/bridge.rs
new file mode 100644
index 00000000..e2ba4e37
--- /dev/null
+++ b/apps/springtale-cli/src/commands/mcp/bridge.rs
@@ -0,0 +1,154 @@
+//! The stdin → daemon → stdout loop.
+//!
+//! MCP's stdio transport is newline-delimited JSON-RPC: "messages are
+//! delimited by newlines, and MUST NOT contain embedded newlines". This
+//! loop reads one, hands it to a [`McpTransport`], and writes back at
+//! most one line. Nothing here knows what a tool is.
+
+use std::future::Future;
+
+use anyhow::Result;
+use serde_json::Value;
+use tokio::io::{AsyncBufRead, AsyncBufReadExt, AsyncWrite, AsyncWriteExt};
+
+/// JSON-RPC "Parse error" — the message was not valid JSON.
+const PARSE_ERROR: i64 = -32700;
+/// JSON-RPC "Internal error" — the daemon could not be reached, or
+/// answered with something that is not a message.
+const INTERNAL_ERROR: i64 = -32603;
+
+/// Where a stdio message goes. One implementation talks HTTP to
+/// springtaled ([`super::DaemonTransport`]); the test uses a stub.
+pub trait McpTransport {
+    /// Forward `message` verbatim and return the daemon's reply body,
+    /// or `None` when the daemon accepted it without one (its answer to
+    /// a notification).
+    fn send(&self, message: String) -> impl Future<Output = Result<Option<String>>> + Send;
+}
+
+/// Pump `reader` into `transport` and its replies into `writer` until
+/// the reader hits EOF (the client closed the pipe, which is how the
+/// stdio transport says "shut down").
+pub async fn bridge<R, W, T>(reader: R, mut writer: W, transport: &T) -> Result<()>
+where
+    R: AsyncBufRead + Unpin,
+    W: AsyncWrite + Unpin,
+    T: McpTransport,
+{
+    let mut lines = reader.lines();
+    while let Some(line) = lines.next_line().await? {
+        let message = line.trim();
+        if message.is_empty() {
+            continue;
+        }
+
+        // The only inspection this bridge performs: a message with an
+        // `id` is a request and is owed exactly one reply; one without
+        // is a notification and gets none. That is stdio framing, not
+        // protocol knowledge.
+        let id = match serde_json::from_str::<Value>(message) {
+            Ok(value) => value.get("id").cloned(),
+            Err(err) => {
+                // Unparseable input has no id to echo, so `null` — the
+                // JSON-RPC 2.0 rule for a parse error.
+                let body = error_response(&Value::Null, PARSE_ERROR, &err.to_string());
+                write_line(&mut writer, &body).await?;
+                continue;
+            }
+        };
+
+        let reply = transport.send(message.to_owned()).await;
+        let Some(id) = id else {
+            // Notification: never write a response. A failure has
+            // nowhere to go but stderr, which the client treats as logs.
+            if let Err(err) = reply {
+                eprintln!("springtale mcp: notification not delivered: {err:#}");
+            }
+            continue;
+        };
+
+        let body = match reply {
+            Ok(Some(body)) => single_line(&body),
+            Ok(None) => error_response(
+                &id,
+                INTERNAL_ERROR,
+                "daemon accepted the request without a response",
+            ),
+            Err(err) => error_response(&id, INTERNAL_ERROR, &format!("{err:#}")),
+        };
+        write_line(&mut writer, &body).await?;
+    }
+    Ok(())
+}
+
+/// Collapse a response body onto one line.
+///
+/// Raw newlines in JSON are whitespace between tokens — a newline
+/// *inside* a string must be escaped as `\n` — so dropping them cannot
+/// change the message, and the stdio framing requires it.
+fn single_line(body: &str) -> String {
+    body.replace(['\n', '\r'], "")
+}
+
+/// Build a JSON-RPC error response carrying the original request id.
+fn error_response(id: &Value, code: i64, message: &str) -> String {
+    let body = serde_json::json!({
+        "jsonrpc": "2.0",
+        "id": id,
+        "error": { "code": code, "message": message },
+    });
+    // A `serde_json::Value` built from owned data cannot fail to
+    // serialize, but the CLI still never unwraps.
+    serde_json::to_string(&body).unwrap_or_else(|_| {
+        format!(r#"{{"jsonrpc":"2.0","id":null,"error":{{"code":{INTERNAL_ERROR},"message":"serialization failed"}}}}"#)
+    })
+}
+
+/// Write one message and flush — the client is waiting on this byte.
+async fn write_line<W: AsyncWrite + Unpin>(writer: &mut W, body: &str) -> Result<()> {
+    writer.write_all(body.as_bytes()).await?;
+    writer.write_all(b"\n").await?;
+    writer.flush().await?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Stub daemon: records what it was handed, answers with `reply`.
+    struct StubTransport {
+        reply: &'static str,
+        seen: std::sync::Mutex<Vec<String>>,
+    }
+
+    impl McpTransport for StubTransport {
+        async fn send(&self, message: String) -> Result<Option<String>> {
+            if let Ok(mut seen) = self.seen.lock() {
+                seen.push(message);
+            }
+            Ok(Some(self.reply.to_owned()))
+        }
+    }
+
+    #[tokio::test]
+    async fn test_bridge_request_forwards_body_and_writes_daemon_response() {
+        let transport = StubTransport {
+            reply: r#"{"jsonrpc":"2.0","id":1,"result":{"tools":[]}}"#,
+            seen: std::sync::Mutex::new(Vec::new()),
+        };
+        let request = "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}\n";
+        let mut out: Vec<u8> = Vec::new();
+
+        bridge(request.as_bytes(), &mut out, &transport)
+            .await
+            .expect("bridge runs to EOF");
+
+        let forwarded = transport.seen.lock().expect("stub lock");
+        assert_eq!(forwarded.as_slice(), [request.trim().to_owned()]);
+        assert_eq!(
+            String::from_utf8(out).expect("utf-8 stdout"),
+            format!("{}\n", transport.reply)
+        );
+    }
+}
diff --git a/apps/springtale-cli/src/commands/mcp/mod.rs b/apps/springtale-cli/src/commands/mcp/mod.rs
new file mode 100644
index 00000000..9b15de62
--- /dev/null
+++ b/apps/springtale-cli/src/commands/mcp/mod.rs
@@ -0,0 +1,18 @@
+//! `springtale mcp serve` — an MCP stdio bridge onto the daemon.
+//!
+//! The MCP server itself lives in `springtaled` behind the bearer check
+//! (`apps/springtaled/src/api/mcp.rs`). Editors that can only launch a
+//! subprocess speak the stdio transport, so this subcommand is the
+//! adapter: newline-delimited JSON-RPC on its own stdin/stdout, HTTP to
+//! the daemon in between.
+//!
+//! It holds no protocol logic — no tool list, no method dispatch, no
+//! schema. Every message is forwarded verbatim; the only thing read out
+//! of a message is whether it carries an `id`, which is framing (does a
+//! reply get written?), not protocol.
+
+pub mod bridge;
+pub mod run;
+pub mod transport;
+
+pub use run::serve;
diff --git a/apps/springtale-cli/src/commands/mcp/run.rs b/apps/springtale-cli/src/commands/mcp/run.rs
new file mode 100644
index 00000000..7cb824a8
--- /dev/null
+++ b/apps/springtale-cli/src/commands/mcp/run.rs
@@ -0,0 +1,24 @@
+//! `springtale mcp serve` entry point.
+
+use anyhow::Result;
+use tokio::io::BufReader;
+
+use super::bridge::bridge;
+use super::transport::DaemonTransport;
+use crate::client::Client;
+
+/// Speak the MCP stdio transport on this process's stdin/stdout,
+/// forwarding every message to the running daemon.
+///
+/// Runs until stdin reaches EOF. Nothing is written to stdout except
+/// JSON-RPC messages — stdout *is* the transport — so diagnostics go to
+/// stderr, which the MCP stdio spec reserves for logging.
+pub async fn serve() -> Result<()> {
+    let transport = DaemonTransport::new(Client::from_config()?);
+    bridge(
+        BufReader::new(tokio::io::stdin()),
+        tokio::io::stdout(),
+        &transport,
+    )
+    .await
+}
diff --git a/apps/springtale-cli/src/commands/mcp/transport.rs b/apps/springtale-cli/src/commands/mcp/transport.rs
new file mode 100644
index 00000000..5910bf8a
--- /dev/null
+++ b/apps/springtale-cli/src/commands/mcp/transport.rs
@@ -0,0 +1,120 @@
+//! HTTP framing for the daemon's Streamable HTTP MCP endpoint.
+//!
+//! The daemon answers a request with an SSE stream and a notification
+//! with `202 Accepted`, and stamps `Mcp-Session-Id` on the response to
+//! `initialize`. All three are transport concerns, so they are handled
+//! here rather than leaking into the stdio loop. The session id is a
+//! correlator the spec forbids treating as authentication — the bearer
+//! token goes on every request regardless.
+
+use anyhow::{Context, Result, anyhow};
+use reqwest::Method;
+use tokio::sync::Mutex;
+
+use super::bridge::McpTransport;
+use crate::client::Client;
+
+/// The daemon's MCP endpoint path (mounted at the router root).
+const MCP_PATH: &str = "/mcp";
+
+/// Header the Streamable HTTP transport uses to correlate a session.
+const SESSION_HEADER: &str = "mcp-session-id";
+
+/// Both media types are mandatory on a POST — the server answers `406`
+/// unless it can pick either.
+const ACCEPT: &str = "application/json, text/event-stream";
+
+/// Forwards stdio messages to springtaled over HTTP.
+pub struct DaemonTransport {
+    client: Client,
+    session: Mutex<Option<String>>,
+}
+
+impl DaemonTransport {
+    /// Wrap an authenticated management-API client. The base URL and API
+    /// token are whatever every other subcommand resolved.
+    pub fn new(client: Client) -> Self {
+        Self {
+            client,
+            session: Mutex::new(None),
+        }
+    }
+}
+
+impl McpTransport for DaemonTransport {
+    async fn send(&self, message: String) -> Result<Option<String>> {
+        let mut request = self
+            .client
+            .request(Method::POST, MCP_PATH)
+            .header(reqwest::header::ACCEPT, ACCEPT)
+            .header(reqwest::header::CONTENT_TYPE, "application/json")
+            .body(message);
+        if let Some(session) = self.session.lock().await.as_deref() {
+            request = request.header(SESSION_HEADER, session);
+        }
+
+        let response = request.send().await.context(crate::client::UNREACHABLE)?;
+
+        // A session id only appears on the reply to `initialize`; keep
+        // it for every later request.
+        if let Some(session) = response
+            .headers()
+            .get(SESSION_HEADER)
+            .and_then(|value| value.to_str().ok())
+        {
+            *self.session.lock().await = Some(session.to_owned());
+        }
+
+        let status = response.status();
+        if !status.is_success() {
+            // The daemon's error bodies carry no credentials, but keep
+            // the surface small anyway: status plus a short reason.
+            return Err(anyhow!("daemon returned {status} for the MCP endpoint"));
+        }
+        if status == reqwest::StatusCode::ACCEPTED {
+            // The answer to a notification: no body, no reply owed.
+            return Ok(None);
+        }
+
+        let is_sse = response
+            .headers()
+            .get(reqwest::header::CONTENT_TYPE)
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.starts_with("text/event-stream"));
+        let body = response.text().await.context("reading MCP response body")?;
+
+        if is_sse {
+            Ok(first_sse_data(&body))
+        } else if body.trim().is_empty() {
+            Ok(None)
+        } else {
+            Ok(Some(body))
+        }
+    }
+}
+
+/// Pull the payload of the first SSE event out of a stream body.
+///
+/// An event ends at a blank line; its data is the `data:` field lines
+/// joined with a newline. Keep-alive comments (`:` lines) and the
+/// `event:`/`id:` fields are not payload.
+fn first_sse_data(body: &str) -> Option<String> {
+    let mut data: Vec<&str> = Vec::new();
+    for line in body.lines() {
+        let line = line.trim_end_matches('\r');
+        if line.is_empty() {
+            if !data.is_empty() {
+                break;
+            }
+            continue;
+        }
+        if let Some(rest) = line.strip_prefix("data:") {
+            data.push(rest.strip_prefix(' ').unwrap_or(rest));
+        }
+    }
+    if data.is_empty() {
+        None
+    } else {
+        Some(data.join("\n"))
+    }
+}
diff --git a/apps/springtale-cli/src/commands/mod.rs b/apps/springtale-cli/src/commands/mod.rs
index e5fdfe60..9efb62b2 100644
--- a/apps/springtale-cli/src/commands/mod.rs
+++ b/apps/springtale-cli/src/commands/mod.rs
@@ -16,8 +16,8 @@ pub mod formation;
 pub mod healthcheck;
 pub mod init;
 pub mod login;
+pub mod mcp;
 pub mod memory;
-pub mod new;
 pub mod panic;
 pub mod recipe;
 pub mod rule;
diff --git a/apps/springtale-cli/src/commands/new.rs b/apps/springtale-cli/src/commands/new.rs
deleted file mode 100644
index f1f4f785..00000000
--- a/apps/springtale-cli/src/commands/new.rs
+++ /dev/null
@@ -1,49 +0,0 @@
-//! `springtale new` — thin CLI wrapper around the template operations.
-//!
-//! Template content and write logic live in
-//! `springtale_runtime::operations::templates`. The daemon picks the
-//! destination directory to prevent path traversal.
-
-use anyhow::{Context, Result};
-
-use springtale_runtime::operations::templates::{self, TemplateError};
-
-use crate::output;
-
-pub fn run(template: &str, json_out: bool) -> Result<()> {
-    match templates::write_to(template) {
-        Ok(report) => output::emit(json_out, &report, |r| {
-            let mut out = format!("Creating {} project in {}\n", r.template, r.dir.display());
-            for path in &r.created {
-                out.push_str(&format!("  Created {}\n", path.display()));
-            }
-            out.push_str("\nDone! Next steps:\n");
-            out.push_str("  1. Store any API tokens: springtale vault set <name>\n");
-            out.push_str("  2. Run: springtale init\n");
-            out.push_str("  3. Run: springtale server start");
-            out
-        }),
-        Err(TemplateError::Unknown(_)) => {
-            // The listing is the useful part of the failure, so it is
-            // emitted (JSON or text) before the non-zero exit.
-            let available = templates::list();
-            let body = serde_json::json!({
-                "unknown_template": template,
-                "available": available,
-            });
-            output::emit(json_out, &body, |_| {
-                render_template_list(template, available)
-            })?;
-            anyhow::bail!("use one of the template names listed above")
-        }
-        Err(e) => Err(e).context("failed to create project"),
-    }
-}
-
-fn render_template_list(requested: &str, available: &[templates::Template]) -> String {
-    let mut out = format!("Unknown template: {requested}\n\nAvailable templates:\n");
-    for t in available {
-        out.push_str(&format!("  {:20} — {}\n", t.name, t.description));
-    }
-    out.trim_end_matches('\n').to_owned()
-}
diff --git a/apps/springtale-cli/src/main.rs b/apps/springtale-cli/src/main.rs
index cb21e617..f7c65bd0 100644
--- a/apps/springtale-cli/src/main.rs
+++ b/apps/springtale-cli/src/main.rs
@@ -8,8 +8,8 @@ use anyhow::Result;
 use clap::Parser;
 
 use cli::{
-    BotAction, Cli, Command, CooperationAction, CryptoAction, ServerAction, TravelAction,
-    VaultAction,
+    BotAction, Cli, Command, CooperationAction, CryptoAction, McpAction, ServerAction,
+    TravelAction, VaultAction,
 };
 
 #[tokio::main]
@@ -29,17 +29,9 @@ async fn main() -> Result<()> {
     };
 
     match cli.command {
-        Command::Init { template } => {
-            if let Some(tpl) = template.as_deref() {
-                // Plan §16.4: `springtale init cli-runner && springtale run`.
-                // Scaffold first, then run the vault/DB wizard.
-                commands::new::run(tpl, cli.json)?;
-            }
+        Command::Init => {
             commands::init::run().await?;
         }
-        Command::New { template } => {
-            commands::new::run(&template, cli.json)?;
-        }
         Command::Login => {
             commands::login::login(cli.json).await?;
         }
@@ -171,6 +163,11 @@ async fn main() -> Result<()> {
         Command::Safety { action } => {
             commands::safety::run(action, cli.json).await?;
         }
+        Command::Mcp { action } => match action {
+            McpAction::Serve => {
+                commands::mcp::serve().await?;
+            }
+        },
         Command::Canvas { stream } => {
             commands::canvas::run(stream, cli.json).await?;
         }
diff --git a/apps/springtaled/Cargo.toml b/apps/springtaled/Cargo.toml
index 9c87f2ad..b2f6573a 100644
--- a/apps/springtaled/Cargo.toml
+++ b/apps/springtaled/Cargo.toml
@@ -10,11 +10,14 @@ default = []
 # Test-only fixture (`src/test_harness`), shared by the springtaled and
 # springtale-cli test suites. Never in `default`: a normal build must not
 # compile an in-memory AppState builder into the daemon.
-test-harness = ["dep:arc-swap"]
+test-harness = []
 
 [dependencies]
 tokio = { workspace = true }
 tokio-stream = { workspace = true }
+# `take_until` — tokio-stream has no equivalent, and the SSE streams must
+# end on lock (plan 6.10). Already a workspace dependency.
+futures-util = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 anyhow = { workspace = true }
@@ -63,7 +66,7 @@ twilight-model = { workspace = true }
 irc = { workspace = true }
 secrecy = { workspace = true }
 rand = { workspace = true }
-arc-swap = { workspace = true, optional = true }
+arc-swap = { workspace = true }
 nostr-sdk = { workspace = true }
 
 [dev-dependencies]
@@ -72,7 +75,6 @@ nostr-sdk = { workspace = true }
 springtaled = { path = ".", features = ["test-harness"] }
 tokio = { workspace = true, features = ["test-util"] }
 http-body-util = "0.1"
-arc-swap = { workspace = true }
 # event_recipe_e2e: exercises a real connector's normalize_event against
 # recorded provider payloads + the real recipe dispatch chain.
 connector-github = { workspace = true }
diff --git a/apps/springtaled/src/api/chat.rs b/apps/springtaled/src/api/chat.rs
index 69cd685e..25048e9d 100644
--- a/apps/springtaled/src/api/chat.rs
+++ b/apps/springtaled/src/api/chat.rs
@@ -85,5 +85,7 @@ pub async fn stream(
             }
             Err(_) => None, // lagged subscriber — skip
         });
-    Sse::new(stream).keep_alive(KeepAlive::default())
+    // Ends on lock so the connection releases its `AppState` clone.
+    Sse::new(futures_util::StreamExt::take_until(stream, state.locked()))
+        .keep_alive(KeepAlive::default())
 }
diff --git a/apps/springtaled/src/api/health.rs b/apps/springtaled/src/api/health.rs
index ba3c8122..1ad3aeaa 100644
--- a/apps/springtaled/src/api/health.rs
+++ b/apps/springtaled/src/api/health.rs
@@ -35,7 +35,7 @@ pub async fn ready(State(state): State<AppState>) -> impl IntoResponse {
     if !state.is_ready() {
         return (
             StatusCode::SERVICE_UNAVAILABLE,
-            Json(serde_json::json!({ "status": "booting" })),
+            Json(serde_json::json!({ "status": "booting", "locked": false })),
         );
     }
 
@@ -48,6 +48,10 @@ pub async fn ready(State(state): State<AppState>) -> impl IntoResponse {
             Json(serde_json::json!({
                 "status": "ready",
                 "store": "ok",
+                // Reaching this handler at all means the daemon is
+                // unlocked — the outer lock router answers `/ready`
+                // itself while the vault is closed (plan 6.10).
+                "locked": false,
             })),
         )
     } else {
@@ -56,6 +60,7 @@ pub async fn ready(State(state): State<AppState>) -> impl IntoResponse {
             Json(serde_json::json!({
                 "status": "degraded",
                 "store": "error",
+                "locked": false,
             })),
         )
     }
diff --git a/apps/springtaled/src/api/lock.rs b/apps/springtaled/src/api/lock.rs
new file mode 100644
index 00000000..7f95a6fb
--- /dev/null
+++ b/apps/springtaled/src/api/lock.rs
@@ -0,0 +1,585 @@
+//! The daemon locks (plan 6.10, finding 113).
+//!
+//! Before this, the only way to protect the vault was to kill
+//! `springtaled`. The precedent is the other way round: the Secret
+//! Service daemon keeps running with its collections locked, and
+//! ssh-agent "should suspend processing of sensitive operations ...
+//! until it has been unlocked". Springtale follows Secret Service and
+//! *drops the key* rather than fencing it, because the threat model
+//! includes memory capture — a boolean that gates handlers while the
+//! runtime stays live protects nothing from anyone who can read the
+//! process.
+//!
+//! So locking is not a flag. [`RuntimeGuard`] holds the entire live
+//! world — the built inner [`Router`], its [`AppState`], the vault and
+//! every background task — behind an [`ArcSwapOption`]. Locking ends
+//! the tasks and stores `None`, which drops the last `AppState` clone
+//! and with it the `RuntimeState`: the SQLite handle closes, the
+//! database key and the vault key zeroize, the flock is released.
+//!
+//! While locked the router answers exactly three routes — `GET /health`,
+//! `GET /ready` and `POST /vault/unlock` — and refuses everything else
+//! with `503`. Unlocking re-runs the crypto and runtime initialisation
+//! with the supplied passphrase and swaps a freshly built world back in.
+
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::time::Duration;
+
+use arc_swap::ArcSwapOption;
+use axum::Json;
+use axum::extract::{DefaultBodyLimit, Request, State};
+use axum::http::{HeaderMap, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::routing::{get, post};
+use axum::{Router, middleware};
+use secrecy::{ExposeSecret, SecretString};
+use serde::{Deserialize, Deserializer};
+use tower::ServiceBuilder;
+use tower::ServiceExt;
+use tower::buffer::BufferLayer;
+use tower::limit::RateLimitLayer;
+use tower_http::limit::RequestBodyLimitLayer;
+use tower_http::trace::TraceLayer;
+
+use springtale_crypto::vault::store::Vault;
+
+use super::state::AppState;
+
+/// How often the auto-lock timer checks the idle clock.
+const AUTO_LOCK_POLL: Duration = Duration::from_secs(5);
+
+/// Unlock attempts allowed per minute. Excess attempts queue behind the
+/// rate limiter and time out rather than reaching the KDF.
+const UNLOCK_ATTEMPTS_PER_MINUTE: u64 = 5;
+
+/// Body cap for `POST /vault/unlock`. A passphrase is not a payload.
+const UNLOCK_BODY_LIMIT: usize = 4096;
+
+/// How long [`RuntimeGuard::lock`] waits for in-flight requests to let
+/// go of the runtime before giving up and letting them drop it.
+const DRAIN_TIMEOUT: Duration = Duration::from_secs(2);
+
+/// One poll of the drain wait.
+const DRAIN_POLL: Duration = Duration::from_millis(20);
+
+/// Cooperative yields to spend waiting for the store handle to close
+/// before falling back to timed polling.
+const YIELDS_AFTER_DROP: usize = 32;
+
+/// Everything an unlocked daemon owns.
+///
+/// Held behind a single `Arc` inside [`RuntimeGuard`], so replacing that
+/// `Arc` with `None` is what "locked" means. Nothing here is reachable
+/// while locked, and nothing here survives a lock.
+pub struct Live {
+    /// The real management API, already built over `state`.
+    router: Router,
+    /// The same state `router` was built over. Locking reads the
+    /// scheduler, the chat wiring and the token hash out of it.
+    state: AppState,
+    /// Daemon-side background tasks (bot event loop, response
+    /// dispatcher, notification forwarder, retention purge). The
+    /// runtime's own tasks live on `state.runtime.tasks`.
+    daemon_tasks: springtale_runtime::TaskHandles,
+    /// The open vault. `None` once locked — [`Vault::lock`] zeroizes
+    /// the key material, and the drop that follows releases the file.
+    vault: std::sync::Mutex<Option<Vault>>,
+    /// Bound transport (Unix socket / mTLS HTTP). Held only so it is
+    /// dropped with everything else. `None` when the caller bound none
+    /// — the in-memory test fixture, which has no socket to own.
+    _transport: Option<Arc<dyn springtale_transport::Transport>>,
+}
+
+impl Live {
+    /// Build the inner router over `state` and take ownership of
+    /// everything a lock has to tear down.
+    pub fn new(
+        state: AppState,
+        daemon_tasks: springtale_runtime::TaskHandles,
+        vault: Vault,
+        transport: Option<Arc<dyn springtale_transport::Transport>>,
+    ) -> Self {
+        Self {
+            router: super::build_router(state.clone()),
+            state,
+            daemon_tasks,
+            vault: std::sync::Mutex::new(Some(vault)),
+            _transport: transport,
+        }
+    }
+
+    /// The state the inner router was built over.
+    pub fn state(&self) -> &AppState {
+        &self.state
+    }
+
+    /// Take the vault out so it can be locked and dropped.
+    fn take_vault(&self) -> Option<Vault> {
+        match self.vault.lock() {
+            Ok(mut slot) => slot.take(),
+            Err(poisoned) => poisoned.into_inner().take(),
+        }
+    }
+}
+
+/// What [`Rebuild`] returns: a fresh [`Live`], or the reason it could
+/// not be built (a wrong passphrase, most often).
+pub type RebuildFuture = Pin<Box<dyn Future<Output = anyhow::Result<Live>> + Send>>;
+
+/// Re-runs the boot pipeline with a caller-supplied passphrase.
+///
+/// The daemon's implementation is
+/// `crate::runtime::boot::pipeline::build_live`; tests substitute their
+/// own so the lock/unlock cycle can be exercised without a vault file.
+pub type Rebuild = Arc<dyn Fn(SecretString) -> RebuildFuture + Send + Sync>;
+
+/// The lock. Holds the live world, or nothing at all.
+#[derive(Clone)]
+pub struct RuntimeGuard {
+    live: Arc<ArcSwapOption<Live>>,
+    rebuild: Rebuild,
+    /// Serializes lock against unlock, so two `POST /vault/unlock`
+    /// racing each other cannot build two runtimes over one database.
+    gate: Arc<tokio::sync::Mutex<()>>,
+}
+
+impl RuntimeGuard {
+    /// Wrap a freshly booted world.
+    pub fn new(live: Live, rebuild: Rebuild) -> Self {
+        Self {
+            live: Arc::new(ArcSwapOption::from(Some(Arc::new(live)))),
+            rebuild,
+            gate: Arc::new(tokio::sync::Mutex::new(())),
+        }
+    }
+
+    /// The live world, or `None` while locked.
+    pub fn live(&self) -> Option<Arc<Live>> {
+        self.live.load_full()
+    }
+
+    /// Whether the daemon is locked.
+    pub fn is_locked(&self) -> bool {
+        self.live.load().is_none()
+    }
+
+    /// Lock: end everything, then drop the runtime.
+    ///
+    /// Returns `false` if it was already locked. The order matters —
+    /// each step releases a different holder of the `RuntimeState`, and
+    /// the drop at the end only frees the key if none are left:
+    ///
+    /// 1. signal the SSE streams, which hold `AppState` per connection
+    /// 2. unwire every connector chat loop
+    /// 3. pause the scheduler and stop the heartbeat
+    /// 4. clear the session map (one-time stream tickets)
+    /// 5. abort and *join* every background task
+    /// 6. zeroize the vault key
+    /// 7. drop the last `Live`
+    pub async fn lock(&self) -> bool {
+        let _serialized = self.gate.lock().await;
+        let Some(live) = self.live.swap(None) else {
+            return false;
+        };
+
+        // 1 — SSE first: a subscribed browser tab would otherwise hold
+        // an `AppState` clone for as long as it stayed open.
+        let _ = live.state.lock_signal.send(true);
+
+        // 2 — every connector's chat receive loop drains and exits.
+        springtale_runtime::operations::connectors::unwire_all_chat(&live.state.runtime);
+
+        // 3 — no rule fires while the vault is closed.
+        live.state.scheduler.pause().await;
+        live.state.heartbeat_monitor.lock().await.stop();
+
+        // 4 — sessions: the login session map and the one-time SSE
+        // tickets both die here, so a token issued before the lock
+        // cannot be replayed after it. The stored per-user/per-channel
+        // bot sessions go with the database handle that closes in step 7.
+        live.state.sessions.lock().await.clear();
+        live.state.stream_tickets.lock().await.clear();
+
+        // The one observable proof that the lock worked: when the last
+        // `Arc` to the store is gone, SQLite is closed and the database
+        // key is zeroized. Taken before anything is dropped.
+        let store = Arc::downgrade(&live.state.runtime.store);
+
+        // 5 — `shutdown` aborts AND awaits, which is the only way to
+        // know the tasks released their `Arc` clones of the store.
+        let runtime_tasks = live.state.runtime.tasks.clone();
+        let runtime_aborted = runtime_tasks.shutdown().await;
+        let daemon_aborted = live.daemon_tasks.shutdown().await;
+
+        // 6 — zeroize the vault key even if step 7 has to wait.
+        if let Some(mut vault) = live.take_vault() {
+            springtale_runtime::operations::vault::lock_vault(&mut vault);
+            drop(vault);
+        }
+
+        // 7 — the drop that closes SQLite and zeroizes the database key.
+        let drained = drop_live(live).await;
+
+        // 8 — and wait for it to actually happen. Dropping the router
+        // does not release its `AppState` synchronously: `tower`'s
+        // `Buffer` — the layer fronting the rate limiter — runs a
+        // worker task that owns the service, and a chain of such tasks
+        // only lets go as each is polled once more. Waiting on the
+        // store's `Weak` is the difference between reporting "locked"
+        // and being locked.
+        let store_released = await_store_release(&store).await;
+
+        tracing::info!(
+            runtime_tasks_aborted = runtime_aborted,
+            daemon_tasks_aborted = daemon_aborted,
+            drained,
+            store_released,
+            "daemon locked — runtime dropped, vault key zeroized"
+        );
+        true
+    }
+
+    /// Unlock: rebuild the world from `passphrase`.
+    ///
+    /// Runs the same pipeline boot runs — vault open, key derivation,
+    /// `springtale_runtime::init`, scheduler, bot, router — so an
+    /// unlocked daemon is indistinguishable from a freshly booted one.
+    pub async fn unlock(&self, passphrase: SecretString) -> anyhow::Result<()> {
+        let _serialized = self.gate.lock().await;
+        if self.live.load().is_some() {
+            anyhow::bail!("already unlocked");
+        }
+        let live = (self.rebuild)(passphrase).await?;
+        self.live.store(Some(Arc::new(live)));
+        tracing::info!("daemon unlocked — runtime rebuilt");
+        Ok(())
+    }
+
+    /// Spawn the idle auto-lock timer.
+    ///
+    /// The interval is `bot:settings.auto_lock_secs` (default 300, `0`
+    /// disables), read on every tick so a settings change takes effect
+    /// without a restart. "Idle" is `RuntimeState::activity`: no
+    /// authenticated request and no inbound chat message.
+    pub fn spawn_auto_lock(&self) -> tokio::task::JoinHandle<()> {
+        let guard = self.clone();
+        tokio::spawn(async move {
+            let mut ticker = tokio::time::interval(AUTO_LOCK_POLL);
+            ticker.tick().await; // the immediate first tick
+            loop {
+                ticker.tick().await;
+                let Some((timeout_secs, idle_secs)) = guard.live().map(|live| {
+                    (
+                        live.state.runtime.bot_settings.load().auto_lock_secs,
+                        live.state.runtime.activity.idle_secs(),
+                    )
+                }) else {
+                    continue; // already locked
+                };
+                if timeout_secs == 0 || idle_secs < timeout_secs {
+                    continue;
+                }
+                tracing::info!(
+                    idle_secs,
+                    auto_lock_secs = timeout_secs,
+                    "auto-lock: idle timeout reached"
+                );
+                guard.lock().await;
+            }
+        })
+    }
+}
+
+/// Drop the last `Live`, waiting briefly for in-flight requests.
+///
+/// Returns whether this call was the one that dropped it. A request
+/// still executing inside the inner router holds an `Arc<Live>`; the
+/// wait gives it a moment to finish, because the very next thing an
+/// unlock does is take an exclusive lock on the same database.
+async fn drop_live(live: Arc<Live>) -> bool {
+    let mut live = live;
+    let deadline = tokio::time::Instant::now() + DRAIN_TIMEOUT;
+    loop {
+        match Arc::try_unwrap(live) {
+            Ok(owned) => {
+                drop(owned);
+                return true;
+            }
+            Err(still_shared) => {
+                if tokio::time::Instant::now() >= deadline {
+                    tracing::warn!(
+                        holders = Arc::strong_count(&still_shared),
+                        "locked with requests still in flight — the runtime drops when they finish"
+                    );
+                    return false;
+                }
+                live = still_shared;
+                tokio::time::sleep(DRAIN_POLL).await;
+            }
+        }
+    }
+}
+
+/// Wait until the last `Arc` to the store is gone.
+///
+/// Returns whether it closed within [`DRAIN_TIMEOUT`]. A `false` is
+/// worth shouting about: it means something still holds the database
+/// open — and therefore its key — after a lock.
+async fn await_store_release(
+    store: &std::sync::Weak<dyn springtale_store::StorageBackend>,
+) -> bool {
+    let deadline = tokio::time::Instant::now() + DRAIN_TIMEOUT;
+    let mut spins = 0usize;
+    loop {
+        if store.strong_count() == 0 {
+            return true;
+        }
+        if tokio::time::Instant::now() >= deadline {
+            tracing::error!(
+                holders = store.strong_count(),
+                "vault locked but the store handle is still open — key not released"
+            );
+            return false;
+        }
+        // Yield first: the holders are usually tasks waiting to be
+        // polled once, and yielding runs them immediately.
+        if spins < YIELDS_AFTER_DROP {
+            tokio::task::yield_now().await;
+        } else {
+            tokio::time::sleep(DRAIN_POLL).await;
+        }
+        spins += 1;
+    }
+}
+
+/// Build the outer router: three routes that always answer, and a
+/// fallback that forwards to the live router or refuses.
+pub fn build_outer_router(guard: RuntimeGuard) -> Router {
+    // `GET /health` is the same liveness probe either way — the process
+    // is up. `GET /ready` reports the lock state, and forwards to the
+    // real readiness check (which touches the store) when unlocked.
+    let always_on = Router::new()
+        .route("/health", get(super::health::health))
+        .route("/ready", get(ready));
+
+    // Rate-limited so the Argon2id KDF cannot be driven by a flood of
+    // guesses. `BufferLayer` fronts it because `tower::limit::RateLimit`
+    // is not `Clone`; the same pairing the main router uses.
+    let unlock_route = Router::new().route("/vault/unlock", post(unlock)).layer(
+        ServiceBuilder::new()
+            .layer(axum::error_handling::HandleErrorLayer::new(
+                |_err: tower::BoxError| async move { StatusCode::TOO_MANY_REQUESTS },
+            ))
+            .layer(BufferLayer::new(16))
+            .layer(RateLimitLayer::new(
+                UNLOCK_ATTEMPTS_PER_MINUTE,
+                Duration::from_secs(60),
+            )),
+    );
+
+    let vault_routes = Router::new()
+        .route("/vault/lock", post(lock))
+        .merge(unlock_route)
+        .layer(DefaultBodyLimit::max(UNLOCK_BODY_LIMIT))
+        .layer(RequestBodyLimitLayer::new(UNLOCK_BODY_LIMIT))
+        .layer(middleware::from_fn(super::auth::require_csrf_protection));
+
+    let router = Router::new()
+        .merge(always_on)
+        .merge(vault_routes)
+        .fallback(forward);
+
+    super::security_headers(router)
+        .layer(TraceLayer::new_for_http())
+        .with_state(guard)
+}
+
+/// Everything that is not one of the always-available routes.
+///
+/// Unlocked: hand the request to the real router. Locked: `503`.
+async fn forward(State(guard): State<RuntimeGuard>, request: Request) -> Response {
+    let Some(live) = guard.live() else {
+        return locked_refusal();
+    };
+    let credentialed = is_credentialed(request.headers(), request.uri().query());
+    // Clone the router and let go of the `Live` before awaiting, so a
+    // concurrent lock is not blocked by this request's `Arc`.
+    let router = live.router.clone();
+    let activity = live.state.runtime.activity.clone();
+    drop(live);
+    let response = match router.oneshot(request).await {
+        Ok(response) => response,
+        // `Router`'s `Service` error type is `Infallible`.
+        Err(never) => match never {},
+    };
+    if credentialed && was_accepted(response.status()) {
+        activity.touch();
+    }
+    response
+}
+
+/// Whether a request even claims a credential.
+///
+/// A bearer token or a stream ticket both mean a person (or their
+/// dashboard) is driving the daemon. An unauthenticated probe — a
+/// health check, a scan — does not keep the vault open.
+fn is_credentialed(headers: &HeaderMap, query: Option<&str>) -> bool {
+    if headers.contains_key("authorization") {
+        return true;
+    }
+    query.is_some_and(|q| q.split('&').any(|p| p.starts_with("ticket=")))
+}
+
+/// Whether the auth middleware let the request through.
+///
+/// Checked *after* the fact so a garbage `Authorization` header cannot
+/// hold the vault open: anyone on loopback could otherwise defeat
+/// auto-lock by spamming rejected requests.
+fn was_accepted(status: StatusCode) -> bool {
+    status != StatusCode::UNAUTHORIZED && status != StatusCode::FORBIDDEN
+}
+
+/// The refusal every non-exempt route gets while locked.
+fn locked_refusal() -> Response {
+    (
+        StatusCode::SERVICE_UNAVAILABLE,
+        Json(serde_json::json!({
+            "error": "vault is locked",
+            "locked": true,
+        })),
+    )
+        .into_response()
+}
+
+/// GET /ready — the lock state, and the real readiness check under it.
+async fn ready(State(guard): State<RuntimeGuard>, request: Request) -> Response {
+    let Some(live) = guard.live() else {
+        return (
+            StatusCode::OK,
+            Json(serde_json::json!({ "status": "locked", "locked": true })),
+        )
+            .into_response();
+    };
+    let router = live.router.clone();
+    drop(live);
+    match router.oneshot(request).await {
+        Ok(response) => response,
+        Err(never) => match never {},
+    }
+}
+
+/// POST /vault/lock — authenticated.
+///
+/// Idempotent: locking a locked daemon is a `200`, not an error, so a
+/// panic-button UI never has to reason about the current state.
+async fn lock(State(guard): State<RuntimeGuard>, headers: HeaderMap) -> Response {
+    let Some(live) = guard.live() else {
+        return (StatusCode::OK, Json(serde_json::json!({ "locked": true }))).into_response();
+    };
+    // Same session check `api::auth::require_auth` makes, run by hand:
+    // `POST /vault/lock` is served by the outer router, which has no
+    // `AppState` for that middleware to sit over. A passphrase-derived
+    // hash is the login verifier, never a bearer (plan 6.6), so the
+    // presented token has to be looked up in the live session map.
+    let Some(token) = super::login::bearer(&headers) else {
+        return StatusCode::UNAUTHORIZED.into_response();
+    };
+    if super::login::authenticate(&live.state, token)
+        .await
+        .is_none()
+    {
+        return StatusCode::UNAUTHORIZED.into_response();
+    }
+    // Release before locking — `lock` waits for exactly this `Arc`.
+    drop(live);
+
+    guard.lock().await;
+    (StatusCode::OK, Json(serde_json::json!({ "locked": true }))).into_response()
+}
+
+/// Body of `POST /vault/unlock`.
+#[derive(Deserialize)]
+pub struct UnlockRequest {
+    /// The vault passphrase. Never logged, never echoed.
+    #[serde(deserialize_with = "deserialize_passphrase")]
+    passphrase: SecretString,
+}
+
+/// Wrap the deserialized passphrase in `SecretString` immediately, so
+/// it is zeroized on drop and redacted in any `Debug` output.
+fn deserialize_passphrase<'de, D>(deserializer: D) -> Result<SecretString, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let raw = String::deserialize(deserializer)?;
+    Ok(SecretString::new(raw.into_boxed_str()))
+}
+
+/// POST /vault/unlock — public, rate-limited.
+///
+/// Deliberately unauthenticated: the API token is derived from the
+/// passphrase, so there is no credential to present while locked. The
+/// passphrase itself is the credential, and `Vault::open` is the check
+/// — Argon2id over the wrong passphrase fails at AEAD decryption, with
+/// no comparison this code could shortcut.
+async fn unlock(State(guard): State<RuntimeGuard>, Json(body): Json<UnlockRequest>) -> Response {
+    if !guard.is_locked() {
+        return (
+            StatusCode::CONFLICT,
+            Json(serde_json::json!({ "error": "already unlocked", "locked": false })),
+        )
+            .into_response();
+    }
+    match guard.unlock(body.passphrase).await {
+        Ok(()) => (StatusCode::OK, Json(serde_json::json!({ "locked": false }))).into_response(),
+        Err(e) => {
+            // The error text describes the failure mode (wrong
+            // passphrase, unreadable vault) and never carries the
+            // passphrase itself.
+            tracing::warn!(error = %e, "vault unlock refused");
+            (
+                StatusCode::UNAUTHORIZED,
+                Json(serde_json::json!({ "error": "unlock failed", "locked": true })),
+            )
+                .into_response()
+        }
+    }
+}
+
+/// The passphrase bytes, for the one call site that needs them.
+///
+/// SECURITY: expose needed to hand the passphrase to Argon2id in
+/// `Vault::open` and to the two HMAC key derivations. The borrow does
+/// not outlive the call, and the `SecretString` zeroizes on drop.
+pub fn expose_passphrase(passphrase: &SecretString) -> &[u8] {
+    passphrase.expose_secret().as_bytes()
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod tests {
+    use super::*;
+    use axum::http::HeaderValue;
+
+    #[test]
+    fn test_is_credentialed_counts_tokens_and_tickets_only() {
+        let mut bearer = HeaderMap::new();
+        bearer.insert("authorization", HeaderValue::from_static("Bearer abcd"));
+        assert!(is_credentialed(&bearer, None));
+        assert!(is_credentialed(&HeaderMap::new(), Some("ticket=abcd")));
+        assert!(is_credentialed(&HeaderMap::new(), Some("x=1&ticket=ab")));
+
+        assert!(!is_credentialed(&HeaderMap::new(), None));
+        assert!(!is_credentialed(&HeaderMap::new(), Some("noticket=ab")));
+    }
+
+    #[test]
+    fn test_rejected_requests_do_not_count_as_activity() {
+        assert!(!was_accepted(StatusCode::UNAUTHORIZED));
+        assert!(!was_accepted(StatusCode::FORBIDDEN));
+        assert!(was_accepted(StatusCode::OK));
+        assert!(was_accepted(StatusCode::NOT_FOUND));
+    }
+}
diff --git a/apps/springtaled/src/api/mod.rs b/apps/springtaled/src/api/mod.rs
index a03aa8a6..07e168b7 100644
--- a/apps/springtaled/src/api/mod.rs
+++ b/apps/springtaled/src/api/mod.rs
@@ -17,6 +17,7 @@ pub mod extractors;
 pub mod fixes;
 pub mod formations;
 pub mod health;
+pub mod lock;
 pub mod login;
 pub mod mcp;
 pub mod memory;
@@ -29,7 +30,6 @@ pub mod send;
 pub mod sessions;
 pub mod state;
 pub mod stream;
-pub mod templates;
 pub mod utterances;
 pub mod webhooks;
 pub mod workspaces;
@@ -69,6 +69,50 @@ use tower_http::trace::TraceLayer;
 
 use state::AppState;
 
+/// Content-Security-Policy for every API response.
+const CSP: &str = "default-src 'self'; script-src 'self'; \
+                   style-src 'self' 'unsafe-inline'; \
+                   connect-src 'self' http://127.0.0.1:*; \
+                   img-src 'self' data:; \
+                   frame-ancestors 'none'";
+
+/// Features the dashboard never needs, denied for every response.
+const PERMISSIONS_POLICY: &str =
+    "camera=(), microphone=(), geolocation=(), accelerometer=(), gyroscope=()";
+
+/// Apply the response security headers (ARCHITECTURE.md §9 dashboard
+/// security audit).
+///
+/// Generic over the router's state so the same stack covers both the
+/// management API and the outer lock router, which is stateful in
+/// `RuntimeGuard` and answers while the vault is closed.
+pub(crate) fn security_headers<S>(router: Router<S>) -> Router<S>
+where
+    S: Clone + Send + Sync + 'static,
+{
+    router
+        .layer(SetResponseHeaderLayer::overriding(
+            header::X_FRAME_OPTIONS,
+            header::HeaderValue::from_static("DENY"),
+        ))
+        .layer(SetResponseHeaderLayer::overriding(
+            header::HeaderName::from_static("content-security-policy"),
+            header::HeaderValue::from_static(CSP),
+        ))
+        .layer(SetResponseHeaderLayer::overriding(
+            header::HeaderName::from_static("x-content-type-options"),
+            header::HeaderValue::from_static("nosniff"),
+        ))
+        .layer(SetResponseHeaderLayer::overriding(
+            header::HeaderName::from_static("referrer-policy"),
+            header::HeaderValue::from_static("no-referrer"),
+        ))
+        .layer(SetResponseHeaderLayer::overriding(
+            header::HeaderName::from_static("permissions-policy"),
+            header::HeaderValue::from_static(PERMISSIONS_POLICY),
+        ))
+}
+
 /// Build the complete axum router for the management API.
 ///
 /// Route groups:
@@ -169,8 +213,6 @@ pub fn build_router(state: AppState) -> Router {
         .route("/diagnostics", get(diagnostics::list))
         .route("/onboarding/platforms", get(onboarding::list))
         .route("/onboarding/{platform}", post(onboarding::apply))
-        .route("/templates", get(templates::list))
-        .route("/templates/{name}", post(templates::write))
         .route("/fixes", get(fixes::list))
         .route("/fixes/{id}", get(fixes::get))
         .route("/fixes/{id}/apply", post(fixes::apply))
@@ -374,41 +416,12 @@ pub fn build_router(state: AppState) -> Router {
         .merge(mcp_endpoint)
         .layer(RequestBodyLimitLayer::new(1024 * 1024));
 
-    Router::new()
-        .merge(limited)
-        .merge(install_wasm)
+    let hardened = security_headers(Router::new().merge(limited).merge(install_wasm));
+
+    hardened
         .layer(
             ServiceBuilder::new()
                 .layer(TraceLayer::new_for_http())
-                // Security headers (ARCHITECTURE.md §9 dashboard security audit)
-                .layer(SetResponseHeaderLayer::overriding(
-                    header::X_FRAME_OPTIONS,
-                    header::HeaderValue::from_static("DENY"),
-                ))
-                .layer(SetResponseHeaderLayer::overriding(
-                    header::HeaderName::from_static("content-security-policy"),
-                    header::HeaderValue::from_static(
-                        "default-src 'self'; script-src 'self'; \
-                         style-src 'self' 'unsafe-inline'; \
-                         connect-src 'self' http://127.0.0.1:*; \
-                         img-src 'self' data:; \
-                         frame-ancestors 'none'",
-                    ),
-                ))
-                .layer(SetResponseHeaderLayer::overriding(
-                    header::HeaderName::from_static("x-content-type-options"),
-                    header::HeaderValue::from_static("nosniff"),
-                ))
-                .layer(SetResponseHeaderLayer::overriding(
-                    header::HeaderName::from_static("referrer-policy"),
-                    header::HeaderValue::from_static("no-referrer"),
-                ))
-                .layer(SetResponseHeaderLayer::overriding(
-                    header::HeaderName::from_static("permissions-policy"),
-                    header::HeaderValue::from_static(
-                        "camera=(), microphone=(), geolocation=(), accelerometer=(), gyroscope=()",
-                    ),
-                ))
                 // NOTE: HSTS (Strict-Transport-Security) deliberately omitted.
                 // RFC 6797 §8.1: HSTS MUST NOT be sent over plain HTTP.
                 // springtaled binds 127.0.0.1 without TLS by default.
diff --git a/apps/springtaled/src/api/openapi.rs b/apps/springtaled/src/api/openapi.rs
index 6470c966..b455ffec 100644
--- a/apps/springtaled/src/api/openapi.rs
+++ b/apps/springtaled/src/api/openapi.rs
@@ -147,8 +147,6 @@ use super::*;
         send::send,
         sessions::list,
         stream::stream,
-        templates::list,
-        templates::write,
         utterances::recent,
         utterances::utterance_defs,
         webhooks::receive,
@@ -234,9 +232,6 @@ use super::*;
         springtale_runtime::operations::recipes::types::RuleStep,
         springtale_runtime::operations::recipes::types::SelectOption,
         springtale_runtime::operations::rules::CreateConnectorRuleRequest,
-        springtale_runtime::operations::templates::Template,
-        springtale_runtime::operations::templates::TemplateFile,
-        springtale_runtime::operations::templates::WriteReport,
         springtale_runtime::operations::test_step::TestStepOutput,
         springtale_runtime::operations::test_step::TestStepReport,
         springtale_runtime::operations::workspaces::query::WorkspaceInfo,
@@ -273,7 +268,6 @@ use super::*;
         (name = "send"),
         (name = "sessions"),
         (name = "stream"),
-        (name = "templates"),
         (name = "utterances"),
         (name = "webhooks"),
         (name = "workspaces")
diff --git a/apps/springtaled/src/api/state.rs b/apps/springtaled/src/api/state.rs
index 59c67b9f..2dba25ce 100644
--- a/apps/springtaled/src/api/state.rs
+++ b/apps/springtaled/src/api/state.rs
@@ -55,6 +55,15 @@ pub struct AppState {
     /// auth, consumed by `require_stream_ticket`. Keeps bearer tokens out
     /// of URLs (EventSource cannot send headers; plan 0.7).
     pub stream_tickets: Arc<Mutex<HashMap<String, crate::api::login::StreamTicket>>>,
+    /// Flipped to `true` exactly once, when the daemon locks (plan
+    /// 6.10). Every SSE handler ends its stream on it.
+    ///
+    /// Without this a live `GET /stream` would hold an `AppState` clone
+    /// — and therefore the store handle and the database key — for as
+    /// long as the browser tab stayed open, which would make "locked"
+    /// a lie. Closing the streams is also what tells the canvas to
+    /// render the locked state (plan 3.6).
+    pub lock_signal: tokio::sync::watch::Sender<bool>,
 }
 
 impl AppState {
@@ -62,4 +71,20 @@ impl AppState {
     pub fn is_ready(&self) -> bool {
         self.ready.load(Ordering::Acquire)
     }
+
+    /// A future that resolves when the daemon locks.
+    ///
+    /// SSE handlers pass it to `StreamExt::take_until` so their stream
+    /// ends — and releases its `AppState` clone — on lock.
+    /// `use<>` — the future owns a `watch::Receiver` and captures
+    /// nothing from `self`, so an SSE body may outlive this borrow.
+    pub fn locked(&self) -> impl std::future::Future<Output = ()> + Send + use<> {
+        let mut rx = self.lock_signal.subscribe();
+        async move {
+            // `wait_for` returns immediately when the value is already
+            // true, and `Err` only when every sender is gone — which
+            // itself means the state is being torn down.
+            let _ = rx.wait_for(|locked| *locked).await;
+        }
+    }
 }
diff --git a/apps/springtaled/src/api/stream.rs b/apps/springtaled/src/api/stream.rs
index 9f66d0fb..8a5811c4 100644
--- a/apps/springtaled/src/api/stream.rs
+++ b/apps/springtaled/src/api/stream.rs
@@ -80,5 +80,13 @@ pub async fn stream(
             Err(_) => None,
         });
 
-    Sse::new(events.merge(canvas).merge(cooperation)).keep_alive(KeepAlive::default())
+    // The stream ends when the daemon locks, so this connection stops
+    // holding an `AppState` clone (plan 6.10).
+    // Fully qualified: `tokio_stream::StreamExt` is also in scope here
+    // and has no `take_until` of its own.
+    Sse::new(futures_util::StreamExt::take_until(
+        events.merge(canvas).merge(cooperation),
+        state.locked(),
+    ))
+    .keep_alive(KeepAlive::default())
 }
diff --git a/apps/springtaled/src/api/templates.rs b/apps/springtaled/src/api/templates.rs
deleted file mode 100644
index 2c5735c3..00000000
--- a/apps/springtaled/src/api/templates.rs
+++ /dev/null
@@ -1,49 +0,0 @@
-//! `GET /templates` + `POST /templates/{name}` — expose
-//! `operations::templates`.
-//!
-//! The daemon picks the destination directory (under `$DATA_DIR/projects/`)
-//! to prevent path traversal. The caller never supplies a path.
-
-use axum::Json;
-use axum::extract::Path as AxumPath;
-use axum::http::StatusCode;
-
-use springtale_runtime::operations::templates::{self, Template, TemplateError, WriteReport};
-
-/// GET /templates — every available starter.
-#[utoipa::path(
-    get, operation_id = "templates_list",
-    path = "/templates",
-    tag = "templates",
-    responses((status = 200, description = "Scaffolding templates", body = Vec<Object>))
-)]
-pub async fn list() -> Json<Vec<&'static Template>> {
-    Json(templates::list().iter().collect())
-}
-
-/// POST /templates/{name} — write the named template.
-///
-/// The daemon picks the destination directory and returns the path in
-/// the response. No `dir` field accepted — the caller cannot influence
-/// where files land (OWASP ASVS §12.3).
-#[utoipa::path(
-    post, operation_id = "templates_write",
-    path = "/templates/{name}",
-    tag = "templates",
-    params(("name" = String, Path, description = "Template name")),
-    responses((status = 200, description = "Files written", body = WriteReport))
-)]
-pub async fn write(
-    AxumPath(name): AxumPath<String>,
-) -> Result<Json<WriteReport>, (StatusCode, String)> {
-    match templates::write_to(&name) {
-        Ok(report) => Ok(Json(report)),
-        Err(TemplateError::Unknown(_)) => {
-            Err((StatusCode::NOT_FOUND, format!("unknown template: {name}")))
-        }
-        Err(TemplateError::DestinationNotEmpty(_)) | Err(TemplateError::WouldOverwrite(_)) => {
-            Err((StatusCode::CONFLICT, "destination is not empty".into()))
-        }
-        Err(e) => Err((StatusCode::INTERNAL_SERVER_ERROR, e.to_string())),
-    }
-}
diff --git a/apps/springtaled/src/api/webhooks.rs b/apps/springtaled/src/api/webhooks.rs
index 64661af3..42b6e12b 100644
--- a/apps/springtaled/src/api/webhooks.rs
+++ b/apps/springtaled/src/api/webhooks.rs
@@ -71,7 +71,11 @@ pub async fn receive(
         .filter_map(|(k, v)| v.to_str().ok().map(|v| (k.to_string(), v.to_owned())))
         .collect();
 
-    if let Err(e) = entry.host.verify_webhook(&header_map, &body).await {
+    // Clone the host handle: the registry lock is dropped below, but the
+    // connector still answers "what does this payload mean?" afterwards.
+    let host = entry.host.clone();
+
+    if let Err(e) = host.verify_webhook(&header_map, &body).await {
         tracing::warn!(
             connector = %connector_name,
             error = %e,
@@ -98,22 +102,49 @@ pub async fn receive(
     // Drop the registry lock before sending to the channel
     drop(registry);
 
-    // For chat connectors delivering user messages via webhook, also route
-    // to the bot runtime so handlers (`/help`, command dispatch, AI fallback)
-    // can respond. Without this, webhook-mode chat is receive-only.
+    // Ask the connector what this verified payload means. The daemon
+    // owns the transport (route, signature, event log); the connector
+    // owns the protocol. This used to be a `match` on one connector
+    // name here, so webhook chat worked for exactly that connector and
+    // no other — Kick, whose chat only ever arrives by webhook, could
+    // not reach the bot at all.
     //
-    // Polling-mode gateways handle this via their own dispatcher (see
-    // runtime/connectors/telegram.rs). This branch covers webhook mode.
-    if matches!(
-        trigger_name.as_str(),
-        "message_received" | "command_received" | "callback_query_received"
-    ) && let Some(incoming) = extract_bot_message(&connector_name, &payload)
-        && let Err(e) = state.bot_msg_tx.try_send(incoming)
-    {
-        tracing::warn!(
-            error = %e,
-            "failed to forward webhook message to bot — may be dropped"
-        );
+    // Polling-mode gateways reach the same bot channel through their own
+    // ChatSource loop (see runtime operations/connectors/chat.rs).
+    let ingest = host
+        .ingest_webhook(&trigger_name, &header_map, &payload)
+        .await;
+
+    for msg in ingest.messages {
+        if !msg.deliver_to_bot {
+            continue;
+        }
+        if let Err(e) = state.bot_msg_tx.try_send(msg) {
+            tracing::warn!(
+                connector = %connector_name,
+                error = %e,
+                "failed to forward webhook message to bot — may be dropped"
+            );
+        }
+    }
+
+    // Extra rule events the same request implies. The route's own
+    // ConnectorEvent is dispatched below, so connectors return only
+    // additional ones here.
+    for extra in ingest.events {
+        let evt = TriggerEvent {
+            trigger_type: "ConnectorEvent".to_owned(),
+            connector: Some(connector_name.clone()),
+            event: Some(extra.event),
+            payload: extra.payload,
+        };
+        if let Err(e) = state.trigger_tx.try_send(evt) {
+            tracing::warn!(
+                connector = %connector_name,
+                error = %e,
+                "failed to dispatch webhook-derived event"
+            );
+        }
     }
 
     // Acknowledge callback_query via answerCallbackQuery so the user's
@@ -181,83 +212,6 @@ pub async fn receive(
     ))
 }
 
-/// Extract a ChatMessage from a webhook payload for chat connectors.
-///
-/// Matches the field extraction performed by the polling gateway dispatchers
-/// so webhook-delivered messages flow through the same bot runtime path.
-fn extract_bot_message(
-    connector_name: &str,
-    payload: &serde_json::Value,
-) -> Option<springtale_connector::chat::ChatMessage> {
-    match connector_name {
-        "connector-telegram" => extract_telegram_message(payload),
-        // Discord and Slack normally use gateway/socket mode, not webhooks,
-        // but future webhook support can extract their fields here.
-        _ => None,
-    }
-}
-
-fn extract_telegram_message(
-    payload: &serde_json::Value,
-) -> Option<springtale_connector::chat::ChatMessage> {
-    // Regular message or command
-    if let Some(message) = payload.get("message") {
-        let user_id = message
-            .get("from")
-            .and_then(|f| f.get("id"))
-            .and_then(|i| i.as_i64())?
-            .to_string();
-        let channel_id = message
-            .get("chat")
-            .and_then(|c| c.get("id"))
-            .and_then(|i| i.as_i64())?
-            .to_string();
-        let text = message
-            .get("text")
-            .and_then(|t| t.as_str())
-            .unwrap_or("")
-            .to_owned();
-
-        return Some(springtale_connector::chat::ChatMessage::chat(
-            "connector-telegram",
-            channel_id,
-            user_id,
-            text,
-            payload.clone(),
-        ));
-    }
-
-    // Inline keyboard button press (callback_query)
-    if let Some(callback) = payload.get("callback_query") {
-        let user_id = callback
-            .get("from")
-            .and_then(|f| f.get("id"))
-            .and_then(|i| i.as_i64())?
-            .to_string();
-        let channel_id = callback
-            .get("message")
-            .and_then(|m| m.get("chat"))
-            .and_then(|c| c.get("id"))
-            .and_then(|i| i.as_i64())?
-            .to_string();
-        let text = callback
-            .get("data")
-            .and_then(|d| d.as_str())
-            .unwrap_or("")
-            .to_owned();
-
-        return Some(springtale_connector::chat::ChatMessage::chat(
-            "connector-telegram",
-            channel_id,
-            user_id,
-            text,
-            payload.clone(),
-        ));
-    }
-
-    None
-}
-
 /// Calculate the maximum nesting depth of a JSON value.
 /// Uses iterative stack to avoid stack overflow on deeply nested input.
 fn json_depth(value: &serde_json::Value) -> usize {
diff --git a/apps/springtaled/src/runtime/boot/bot.rs b/apps/springtaled/src/runtime/boot/bot.rs
index d8894661..079eb793 100644
--- a/apps/springtaled/src/runtime/boot/bot.rs
+++ b/apps/springtaled/src/runtime/boot/bot.rs
@@ -83,8 +83,11 @@ pub(super) struct BotChannels {
 
 /// Initialize the bot runtime.
 ///
-/// Spawns the bot event loop and the response dispatcher. Connector chat
-/// loops are NOT started here — they follow the registry, wired by
+/// Spawns the bot event loop, the response dispatcher and the delivery
+/// forwarder, all registered on `tasks` so a lock (plan 6.10) can end
+/// them — each holds a `RuntimeState` clone, which would otherwise keep
+/// the database open and the key in memory. Connector chat loops are
+/// NOT started here: they follow the registry, wired by
 /// `springtale_runtime::operations::connectors::wire_chat` (plan 6.4).
 pub(super) async fn init_bot(
     runtime: &springtale_runtime::RuntimeState,
@@ -95,7 +98,8 @@ pub(super) async fn init_bot(
         springtale_cooperation::command::FormationCommand,
     >,
     formations_handle: Arc<RwLock<Vec<Formation>>>,
-) -> Result<tokio::task::JoinHandle<()>> {
+    tasks: &springtale_runtime::TaskHandles,
+) -> Result<()> {
     let BotChannels {
         bot_msg_rx,
         chat_tx,
@@ -143,7 +147,7 @@ pub(super) async fn init_bot(
         .context("failed to initialize bot runtime")?;
 
     // Spawn bot event loop
-    let bot_handle = tokio::spawn(async move {
+    tasks.spawn(async move {
         bot.start().await;
     });
 
@@ -153,7 +157,7 @@ pub(super) async fn init_bot(
     // synthetic and has no `send_message`, so it MUST branch here.
     let response_runtime = runtime.clone();
     let response_chat_tx = chat_tx.clone();
-    let _response_handle = tokio::spawn(async move {
+    tasks.spawn(async move {
         while let Some(response) = bot_response_rx.recv().await {
             if response.connector == crate::api::chat::IN_APP_CONNECTOR {
                 // Broadcast to in-app chat clients. A send error just means
@@ -211,7 +215,7 @@ pub(super) async fn init_bot(
     // the user's chat panel instead of vanishing into a log line.
     let notif_chat_tx = chat_tx.clone();
     let mut notif_rx = runtime.notification_tx.subscribe();
-    let _notif_handle = tokio::spawn(async move {
+    tasks.spawn(async move {
         loop {
             match notif_rx.recv().await {
                 Ok(event) => {
@@ -236,5 +240,5 @@ pub(super) async fn init_bot(
 
     tracing::info!("bot runtime started");
 
-    Ok(bot_handle)
+    Ok(())
 }
diff --git a/apps/springtaled/src/runtime/boot/crypto.rs b/apps/springtaled/src/runtime/boot/crypto.rs
index 3e2e4b52..dfa78c88 100644
--- a/apps/springtaled/src/runtime/boot/crypto.rs
+++ b/apps/springtaled/src/runtime/boot/crypto.rs
@@ -1,18 +1,39 @@
 use anyhow::{Context, Result};
+use zeroize::Zeroizing;
 
 use springtale_crypto::identity::keypair::Keypair;
 use springtale_crypto::vault::store::Vault;
 
+/// What [`init_crypto`] produces: the open vault, this node's identity,
+/// and the two values derived from the passphrase.
+pub(super) struct CryptoBoot {
+    pub(super) vault: Vault,
+    pub(super) keypair: Keypair,
+    pub(super) api_token_hash: [u8; 32],
+    pub(super) db_key_hex: String,
+}
+
+/// Read the vault passphrase the way boot does — stdin, Docker secret
+/// file, environment, or an interactive prompt.
+///
+/// Split out from [`init_crypto`] because `POST /vault/unlock` supplies
+/// the passphrase from the request body instead: there is no terminal
+/// to prompt at, and the daemon has been running for hours.
+pub(super) fn read_passphrase(passphrase_stdin: bool) -> Result<Zeroizing<Vec<u8>>> {
+    get_passphrase(passphrase_stdin).map(Zeroizing::new)
+}
+
 /// Initialize crypto vault, load identity keypair, derive API token hash.
-/// Returns (vault, keypair, api_token_hash, db_encryption_key_hex).
+///
+/// Takes the passphrase rather than reading it, so boot and unlock run
+/// exactly the same code over a passphrase from different sources.
 pub(super) fn init_crypto(
     ephemeral: bool,
     crypto_config: &crate::config::CryptoConfig,
-    passphrase_stdin: bool,
-) -> Result<(Vault, Keypair, [u8; 32], String)> {
-    let passphrase = get_passphrase(passphrase_stdin)?;
+    passphrase: &[u8],
+) -> Result<CryptoBoot> {
     let (vault, keypair) = if ephemeral {
-        let mut vault = springtale_crypto::vault::store::Vault::create_ephemeral(&passphrase)
+        let mut vault = springtale_crypto::vault::store::Vault::create_ephemeral(passphrase)
             .context("failed to create ephemeral vault")?;
         let keypair = springtale_crypto::identity::keypair::Keypair::generate()
             .context("failed to generate ephemeral keypair")?;
@@ -28,7 +49,7 @@ pub(super) fn init_crypto(
                 format!("failed to create vault directory: {}", parent.display())
             })?;
         }
-        open_or_create_vault(&crypto_config.vault_path, &passphrase)?
+        open_or_create_vault(&crypto_config.vault_path, passphrase)?
     };
     let node_id = keypair.node_id();
     tracing::info!(node_id = %hex::encode(node_id.as_bytes()), "identity loaded");
@@ -44,10 +65,15 @@ pub(super) fn init_crypto(
     // Both live in springtale-crypto::token so init.rs and the daemon
     // agree on the exact derivation (historical bug: trace.rs had its
     // own copy with key/msg swapped).
-    let api_token_hash = springtale_crypto::token::derive_api_token_hash(&passphrase);
-    let db_key_hex = springtale_crypto::token::derive_db_encryption_key_hex(&passphrase);
+    let api_token_hash = springtale_crypto::token::derive_api_token_hash(passphrase);
+    let db_key_hex = springtale_crypto::token::derive_db_encryption_key_hex(passphrase);
 
-    Ok((vault, keypair, api_token_hash, db_key_hex))
+    Ok(CryptoBoot {
+        vault,
+        keypair,
+        api_token_hash,
+        db_key_hex,
+    })
 }
 
 /// Get the vault passphrase from Docker secret file, environment, or interactive prompt.
diff --git a/apps/springtaled/src/runtime/boot/mod.rs b/apps/springtaled/src/runtime/boot/mod.rs
index dd0a8fe9..e0b6a2a2 100644
--- a/apps/springtaled/src/runtime/boot/mod.rs
+++ b/apps/springtaled/src/runtime/boot/mod.rs
@@ -2,20 +2,27 @@ mod bot;
 mod crypto;
 mod formations;
 pub mod options;
+pub mod pipeline;
 mod sentinel;
 mod transport;
 
 use std::sync::Arc;
 
 use anyhow::{Context, Result};
+use secrecy::SecretString;
 
 use crate::api;
+use crate::api::lock::{Live, RebuildFuture, RuntimeGuard};
 use crate::config::SpringtaleConfig;
 
 /// Boot the springtaled daemon.
 ///
 /// Executes the ordered startup sequence from the architecture doc (§8.1).
 /// Each step must succeed before the next. Errors are fatal.
+///
+/// Steps 2 through 8 live in [`pipeline::build_live`] rather than here,
+/// because `POST /vault/unlock` runs exactly the same sequence after a
+/// lock has dropped the previous one (plan 6.10).
 pub async fn boot(
     config: SpringtaleConfig,
     connector_configs: std::collections::HashMap<String, serde_json::Value>,
@@ -42,186 +49,43 @@ pub async fn boot(
     // are moved into RuntimeConfig, the rest stays available by name).
     let SpringtaleConfig {
         ephemeral,
-        store: store_config,
+        store,
         crypto: crypto_config,
-        transport: transport_config,
+        transport,
         api: api_config,
         heartbeat_interval_secs,
         sentinel,
     } = config;
 
-    // ── Step 2: Initialize crypto vault (before runtime, no dependencies) ──
-    let (vault, keypair, api_token_hash, db_key_hex) =
-        crypto::init_crypto(ephemeral, &crypto_config, options.passphrase_stdin)?;
-
-    // ── Step 3: Initialize shared runtime (store + engine + registry + AI + sentinel + canvas) ──
-    let runtime_config = springtale_runtime::RuntimeConfig {
-        store: springtale_runtime::config::StoreConfig {
-            path: store_config.path.clone(),
-            ephemeral,
-            encryption_key_hex: if ephemeral { None } else { Some(db_key_hex) },
-            retention_days: store_config.retention_days,
-        },
+    let ctx = Arc::new(pipeline::BootContext {
+        ephemeral,
+        store,
+        crypto: crypto_config,
+        transport,
+        api: api_config,
+        heartbeat_interval_secs,
         sentinel,
         connector_configs,
-        // Default cooperation config is single-process in-memory gossip.
-        // Cross-process (chitchat) is opt-in via springtaled.toml:
-        //     [cooperation]
-        //     cross_process = true
-        //     chitchat_listen_addr = "127.0.0.1:18000"
-        //     chitchat_seeds = ["127.0.0.1:18001"]
-        cooperation: springtale_runtime::config::CooperationConfig::default(),
-    };
-    // Formation command channel: sender goes to runtime (operations send commands),
-    // receiver goes to bot (event loop materializes/removes formations).
-    let (formation_cmd_tx, formation_cmd_rx) =
-        tokio::sync::mpsc::channel::<springtale_cooperation::command::FormationCommand>(32);
-    // Kept for restoring persisted formations after `init_bot` spawns the
-    // event loop that owns `formation_cmd_rx` below (§6.11 / finding 119).
-    let formation_cmd_tx_for_restore = formation_cmd_tx.clone();
-
-    // Create the shared formations handle BEFORE runtime init.
-    // The BotBuilder will use this same Arc, and BotFormationReader reads from it.
-    let formations_handle = Arc::new(tokio::sync::RwLock::new(Vec::new()));
-    let live_reader: Option<Arc<dyn springtale_runtime::LiveFormationReader>> = Some(Arc::new(
-        bot::BotFormationReader::new(formations_handle.clone()),
-    ));
-
-    // springtaled is the headless daemon — no UI gate to prompt the
-    // user, so leave `approval_gate: None`. The sentinel falls back
-    // to `DefaultDenyApprovalGate` per W1.F design. The desktop wraps
-    // springtaled via Tauri and supplies its own `ChannelApprovalGate`.
-    let runtime = springtale_runtime::init(&runtime_config, formation_cmd_tx, live_reader, None)
-        .await
-        .context("failed to initialize runtime")?;
-
-    // ── Step 3b: Verify audit-log row-hash chain ──
-    // Tamper-evident audit trail (Phase-7 Finding B): walk every row
-    // in `audit_trail`, recompute the SHA-256 chain, and fail closed
-    // on any mismatch. The chain's genesis is bound to the vault
-    // identity — a different vault on the same SQLite or a tampered
-    // row both refuse to start.
-    sentinel::verify_audit_chain(&runtime.store, &keypair)
-        .await
-        .context("audit chain verification failed at startup")?;
-
-    // ── Step 4: Initialize transport ──
-    let _transport = transport::init_transport(&transport_config, &keypair).await?;
-
-    // ── Step 5/6: Start scheduler + job queue + trigger event loop ──
-    // Shared bootstrap with the desktop app (CLAUDE.md: "The desktop
-    // app IS springtaled with a GUI. Same runtime underneath."). Both
-    // surfaces now drive identical cron/fs_watcher/queue/event-loop
-    // wiring from `springtale_runtime::embedded::bootstrap`.
-    //
-    // The heartbeat interval is durable config: a `PUT /config/heartbeat`
-    // persists it, so boot reads the stored key back and only falls
-    // through to the config-file value when nothing was ever set.
-    let heartbeat_interval_secs = springtale_runtime::operations::heartbeat::boot_interval(
-        &*runtime.store,
-        heartbeat_interval_secs,
-    )
-    .await;
-    let springtale_runtime::EmbeddedBootHandle {
-        scheduler: embedded_scheduler,
-        heartbeat_monitor,
-    } = springtale_runtime::bootstrap_embedded(&runtime, heartbeat_interval_secs)
-        .await
-        .map_err(|e| anyhow::anyhow!("scheduler bootstrap failed: {e}"))?;
-    let trigger_tx = embedded_scheduler.trigger_tx.clone();
-
-    // ── Step 7: Initialize bot + connector gateways ──
-    // Chat ingress lives on the runtime (plan 6.4): connector chat loops
-    // are wired off the registry, so the daemon only takes the receiving
-    // end for the bot and clones the sender for webhook ingress.
-    let bot_msg_rx = runtime
-        .take_chat_rx()
-        .await
-        .context("runtime chat receiver already taken")?;
-    let api_bot_msg_tx = runtime.chat_tx.clone();
-    // W5 in-app chat broadcast — created here so both the bot response
-    // dispatcher (producer) and AppState's `GET /chat/stream` (consumers)
-    // share the same channel.
-    let (chat_tx, _chat_rx) = tokio::sync::broadcast::channel::<api::chat::ChatStreamMessage>(256);
-    let bot_handle = bot::init_bot(
-        &runtime,
-        embedded_scheduler.clone(),
-        bot::BotChannels {
-            bot_msg_rx,
-            chat_tx: chat_tx.clone(),
-        },
-        formation_cmd_rx,
-        formations_handle,
-    )
-    .await?;
-
-    // ── Step 7a2: Restore formations persisted from a previous run ──
-    // `init_bot` has already spawned the event loop that owns
-    // `formation_cmd_rx`, so these sends queue behind it rather than
-    // blocking boot (§6.11 / finding 119).
-    let formations_restored =
-        formations::restore_formations(&runtime.store, &formation_cmd_tx_for_restore).await?;
-    tracing::info!(
-        formations_restored,
-        "formation restore step complete at boot"
-    );
-
-    // ── Step 7b: ConnectorEvent handlers are wired inside
-    // `bootstrap_embedded` (shared with desktop), which publishes the
-    // registry on `RuntimeState`. Clone it for AppState so the rule CRUD
-    // handlers attach/detach through the same instance.
-    let trigger_registry = runtime.trigger_registry.get().cloned().unwrap_or_else(|| {
-        springtale_runtime::TriggerRegistry::new(trigger_tx.clone(), runtime.store.clone())
     });
 
-    // ── Step 7c: Start data retention purge (if configured) ──
-    if let Some(days) = store_config.retention_days {
-        let purge_store = runtime.store.clone();
-        tokio::spawn(async move {
-            let mut interval = tokio::time::interval(std::time::Duration::from_secs(3600));
-            loop {
-                interval.tick().await;
-                if let Err(e) =
-                    springtale_runtime::operations::data::purge_expired_data(&*purge_store, days)
-                        .await
-                {
-                    tracing::warn!(error = %e, "data retention purge failed");
-                }
-            }
-        });
-        tracing::info!(
-            retention_days = days,
-            "data retention purge started (hourly)"
-        );
-    }
-
-    // ── Step 8: Build and start API server ──
-
-    let ready_flag = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
-
-    // Plan 6.7 — the runtime owns the events broadcast so runtime-side
-    // announcers (approval gate) reach `GET /events/stream`.
-    let event_tx = runtime.event_tx.clone();
-
-    let state = api::state::AppState {
-        runtime: runtime.clone(),
-        api_token_hash,
-        sessions: std::sync::Arc::new(tokio::sync::Mutex::new(std::collections::HashMap::new())),
-        ready: ready_flag.clone(),
-        trigger_tx: trigger_tx.clone(),
-        scheduler: embedded_scheduler,
-        rate_limit_per_sec: u64::from(api_config.rate_limit_per_sec),
-        event_tx,
-        heartbeat_monitor,
-        trigger_registry,
-        bot_msg_tx: api_bot_msg_tx,
-        chat_tx,
-        stream_tickets: std::sync::Arc::new(tokio::sync::Mutex::new(
-            std::collections::HashMap::new(),
-        )),
+    // ── Steps 2–8: open the vault and build the world ──
+    // The passphrase is read once here and zeroized on drop; an unlock
+    // supplies its own from the request body.
+    let live = {
+        let passphrase = crypto::read_passphrase(options.passphrase_stdin)?;
+        pipeline::build_live(&ctx, &passphrase).await?
     };
 
-    let router = api::build_router(state);
+    // ── Step 8b: the lock ──
+    // The router served below is the OUTER one: `GET /health`,
+    // `GET /ready` and `POST /vault/unlock` always answer, everything
+    // else is forwarded to the live router or refused with 503. Locking
+    // drops `Live` — and with it the store handle and the vault key —
+    // without the process exiting.
+    let guard = RuntimeGuard::new(live, rebuild_from(ctx));
+    let auto_lock = guard.spawn_auto_lock();
+    let router = api::lock::build_outer_router(guard.clone());
+
     let listener = tokio::net::TcpListener::bind(&bind_addr)
         .await
         .with_context(|| format!("failed to bind API to {bind_addr}"))?;
@@ -233,7 +97,6 @@ pub async fn boot(
     tracing::info!(bind = %bound, "management API listening");
 
     // ── Step 9: Signal readiness ──
-    ready_flag.store(true, std::sync::atomic::Ordering::Release);
     // The desktop sidecar (plan 2.1) blocks on this exact line to learn
     // the port. Process supervisors that only matched the old bare
     // `READY` still match the prefix.
@@ -246,29 +109,39 @@ pub async fn boot(
 
     // ── Run: API server (cron + queue + event loop run inside the
     //         shared `bootstrap_embedded` from springtale-runtime) ──
-    let api_handle = tokio::spawn(async move {
-        if let Err(e) = axum::serve(listener, router)
-            .with_graceful_shutdown(crate::shutdown::shutdown_signal())
-            .await
-        {
-            tracing::error!(error = %e, "API server error");
-        }
-    });
-
-    // Wait for shutdown
-    tokio::select! {
-        _ = api_handle => tracing::info!("API server stopped"),
-        _ = bot_handle => tracing::info!("bot event loop stopped"),
+    //
+    // Only the shutdown signal ends this. The bot event loop stopping
+    // no longer takes the daemon down with it: after a lock there is no
+    // bot, and the daemon has to stay up to accept the unlock.
+    if let Err(e) = axum::serve(listener, router)
+        .with_graceful_shutdown(crate::shutdown::shutdown_signal())
+        .await
+    {
+        tracing::error!(error = %e, "API server error");
     }
+    tracing::info!("API server stopped");
+
+    auto_lock.abort();
 
-    // Signal every connector chat loop (Telegram polling, Discord, IRC,
-    // ...) to drain its in-flight work and exit. Without this, tasks that
-    // own persistent WebSocket/polling loops keep running until the
-    // runtime is dropped, which can leave outbound messages half-sent.
-    springtale_runtime::operations::connectors::unwire_all_chat(&runtime);
+    // Shutdown is a lock: it signals every connector chat loop
+    // (Telegram polling, Discord, IRC, ...) to drain its in-flight work
+    // and exit, stops the scheduler, ends the background tasks, and
+    // zeroizes the vault key — the same teardown `POST /vault/lock`
+    // performs, so the two paths cannot drift.
+    guard.lock().await;
 
-    // Cleanup
-    drop(vault);
     tracing::info!("springtaled shutdown complete");
     Ok(())
 }
+
+/// The unlock hook: re-run the pipeline over a caller-supplied passphrase.
+fn rebuild_from(ctx: Arc<pipeline::BootContext>) -> api::lock::Rebuild {
+    Arc::new(move |passphrase: SecretString| -> RebuildFuture {
+        let ctx = ctx.clone();
+        Box::pin(async move {
+            let bytes = api::lock::expose_passphrase(&passphrase);
+            let live: Live = pipeline::build_live(&ctx, bytes).await?;
+            Ok(live)
+        })
+    })
+}
diff --git a/apps/springtaled/src/runtime/boot/pipeline.rs b/apps/springtaled/src/runtime/boot/pipeline.rs
new file mode 100644
index 00000000..6fb1eb53
--- /dev/null
+++ b/apps/springtaled/src/runtime/boot/pipeline.rs
@@ -0,0 +1,239 @@
+//! The boot pipeline, as one reusable function.
+//!
+//! Cold boot and `POST /vault/unlock` build the same thing: an open
+//! vault, an initialized runtime, a scheduler, a bot, and a router over
+//! them. Before plan 6.10 that sequence only existed inline in
+//! [`super::boot`], which is why unlocking a locked daemon was not
+//! possible — there was nothing to call. [`build_live`] is that
+//! sequence, and both callers go through it.
+//!
+//! The only difference between the two callers is where the passphrase
+//! came from: a TTY / environment / stdin at boot, a request body at
+//! unlock.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+
+use crate::api;
+use crate::api::lock::Live;
+use crate::config::{ApiConfig, CryptoConfig, StoreConfig, TransportConfig};
+
+use super::{bot, crypto, formations, sentinel, transport};
+
+/// Everything [`build_live`] needs that does not change between a boot
+/// and an unlock.
+///
+/// Held behind an `Arc` by the unlock closure, so the daemon keeps the
+/// configuration it was started with for the life of the process — a
+/// lock does not re-read `springtale.toml`, and cannot be made to pick
+/// up a file an attacker edited while the vault was closed.
+pub struct BootContext {
+    /// Ephemeral mode: everything in memory, nothing on disk.
+    pub ephemeral: bool,
+    pub store: StoreConfig,
+    pub crypto: CryptoConfig,
+    pub transport: TransportConfig,
+    pub api: ApiConfig,
+    pub heartbeat_interval_secs: u64,
+    pub sentinel: Option<springtale_sentinel::SentinelConfig>,
+    /// Per-connector `[telegram]` / `[discord]` / … tables, verbatim.
+    pub connector_configs: HashMap<String, serde_json::Value>,
+}
+
+/// Open the vault and build a complete, serving runtime from it.
+///
+/// Every `Arc` this creates is reachable from the returned [`Live`], so
+/// dropping it is what closes the database and zeroizes the key. That
+/// is the whole reason locking works.
+pub async fn build_live(ctx: &BootContext, passphrase: &[u8]) -> Result<Live> {
+    // ── Initialize crypto vault (before runtime, no dependencies) ──
+    let crypto::CryptoBoot {
+        vault,
+        keypair,
+        api_token_hash,
+        db_key_hex,
+    } = crypto::init_crypto(ctx.ephemeral, &ctx.crypto, passphrase)?;
+
+    // ── Initialize shared runtime (store + engine + registry + AI + sentinel + canvas) ──
+    let runtime_config = springtale_runtime::RuntimeConfig {
+        store: springtale_runtime::config::StoreConfig {
+            path: ctx.store.path.clone(),
+            ephemeral: ctx.ephemeral,
+            encryption_key_hex: if ctx.ephemeral {
+                None
+            } else {
+                Some(db_key_hex)
+            },
+            retention_days: ctx.store.retention_days,
+        },
+        sentinel: ctx.sentinel.clone(),
+        connector_configs: ctx.connector_configs.clone(),
+        // Default cooperation config is single-process in-memory gossip.
+        // Cross-process (chitchat) is opt-in via springtaled.toml:
+        //     [cooperation]
+        //     cross_process = true
+        //     chitchat_listen_addr = "127.0.0.1:18000"
+        //     chitchat_seeds = ["127.0.0.1:18001"]
+        cooperation: springtale_runtime::config::CooperationConfig::default(),
+    };
+    // Formation command channel: sender goes to runtime (operations send commands),
+    // receiver goes to bot (event loop materializes/removes formations).
+    let (formation_cmd_tx, formation_cmd_rx) =
+        tokio::sync::mpsc::channel::<springtale_cooperation::command::FormationCommand>(32);
+    // Kept for restoring persisted formations after `init_bot` spawns the
+    // event loop that owns `formation_cmd_rx` below (§6.11 / finding 119).
+    let formation_cmd_tx_for_restore = formation_cmd_tx.clone();
+
+    // Create the shared formations handle BEFORE runtime init.
+    // The BotBuilder will use this same Arc, and BotFormationReader reads from it.
+    let formations_handle = Arc::new(tokio::sync::RwLock::new(Vec::new()));
+    let live_reader: Option<Arc<dyn springtale_runtime::LiveFormationReader>> = Some(Arc::new(
+        bot::BotFormationReader::new(formations_handle.clone()),
+    ));
+
+    // springtaled is the headless daemon — no UI gate to prompt the
+    // user, so leave `approval_gate: None`. The sentinel falls back
+    // to `DefaultDenyApprovalGate` per W1.F design. The desktop wraps
+    // springtaled via Tauri and supplies its own `ChannelApprovalGate`.
+    let runtime = springtale_runtime::init(&runtime_config, formation_cmd_tx, live_reader, None)
+        .await
+        .context("failed to initialize runtime")?;
+
+    // ── Verify audit-log row-hash chain ──
+    // Tamper-evident audit trail (Phase-7 Finding B): walk every row
+    // in `audit_trail`, recompute the SHA-256 chain, and fail closed
+    // on any mismatch. The chain's genesis is bound to the vault
+    // identity — a different vault on the same SQLite or a tampered
+    // row both refuse to start.
+    sentinel::verify_audit_chain(&runtime.store, &keypair)
+        .await
+        .context("audit chain verification failed at startup")?;
+
+    // ── Initialize transport ──
+    let transport = transport::init_transport(&ctx.transport, &keypair).await?;
+
+    // ── Start scheduler + job queue + trigger event loop ──
+    // Shared bootstrap with the desktop app (CLAUDE.md: "The desktop
+    // app IS springtaled with a GUI. Same runtime underneath."). Both
+    // surfaces now drive identical cron/fs_watcher/queue/event-loop
+    // wiring from `springtale_runtime::embedded::bootstrap`. Those
+    // tasks register on `runtime.tasks`, so a lock ends them.
+    // The heartbeat interval is durable config: a `PUT /config/heartbeat`
+    // persists it, so boot reads the stored key back and only falls
+    // through to the config-file value when nothing was ever set.
+    let heartbeat_interval_secs = springtale_runtime::operations::heartbeat::boot_interval(
+        &*runtime.store,
+        ctx.heartbeat_interval_secs,
+    )
+    .await;
+    let springtale_runtime::EmbeddedBootHandle {
+        scheduler: embedded_scheduler,
+        heartbeat_monitor,
+    } = springtale_runtime::bootstrap_embedded(&runtime, heartbeat_interval_secs)
+        .await
+        .map_err(|e| anyhow::anyhow!("scheduler bootstrap failed: {e}"))?;
+    let trigger_tx = embedded_scheduler.trigger_tx.clone();
+
+    // Daemon-side background tasks. Separate from `runtime.tasks`
+    // because they belong to this shell, not to the shared runtime —
+    // but a lock aborts both.
+    let daemon_tasks = springtale_runtime::TaskHandles::new();
+
+    // ── Initialize bot + connector gateways ──
+    // Chat ingress lives on the runtime (plan 6.4): connector chat loops
+    // are wired off the registry, so the daemon only takes the receiving
+    // end for the bot and clones the sender for webhook ingress.
+    let bot_msg_rx = runtime
+        .take_chat_rx()
+        .await
+        .context("runtime chat receiver already taken")?;
+    let api_bot_msg_tx = runtime.chat_tx.clone();
+    // W5 in-app chat broadcast — created here so both the bot response
+    // dispatcher (producer) and AppState's `GET /chat/stream` (consumers)
+    // share the same channel.
+    let (chat_tx, _chat_rx) = tokio::sync::broadcast::channel::<api::chat::ChatStreamMessage>(256);
+    bot::init_bot(
+        &runtime,
+        embedded_scheduler.clone(),
+        bot::BotChannels {
+            bot_msg_rx,
+            chat_tx: chat_tx.clone(),
+        },
+        formation_cmd_rx,
+        formations_handle,
+        &daemon_tasks,
+    )
+    .await?;
+
+    // ── Restore formations persisted from a previous run ──
+    // `init_bot` has already spawned the event loop that owns
+    // `formation_cmd_rx`, so these sends queue behind it rather than
+    // blocking boot (§6.11 / finding 119).
+    let formations_restored =
+        formations::restore_formations(&runtime.store, &formation_cmd_tx_for_restore).await?;
+    tracing::info!(
+        formations_restored,
+        "formation restore step complete at boot"
+    );
+
+    // ── ConnectorEvent handlers are wired inside `bootstrap_embedded`
+    // (shared with desktop), which publishes the registry on
+    // `RuntimeState`. Clone it for AppState so the rule CRUD handlers
+    // attach/detach through the same instance.
+    let trigger_registry = runtime.trigger_registry.get().cloned().unwrap_or_else(|| {
+        springtale_runtime::TriggerRegistry::new(trigger_tx.clone(), runtime.store.clone())
+    });
+
+    // ── Start data retention purge (if configured) ──
+    if let Some(days) = ctx.store.retention_days {
+        let purge_store = runtime.store.clone();
+        daemon_tasks.spawn(async move {
+            let mut interval = tokio::time::interval(std::time::Duration::from_secs(3600));
+            loop {
+                interval.tick().await;
+                if let Err(e) =
+                    springtale_runtime::operations::data::purge_expired_data(&*purge_store, days)
+                        .await
+                {
+                    tracing::warn!(error = %e, "data retention purge failed");
+                }
+            }
+        });
+        tracing::info!(
+            retention_days = days,
+            "data retention purge started (hourly)"
+        );
+    }
+
+    // ── Assemble the API state ──
+    // Ready immediately: by the time this state exists every subsystem
+    // above is up. A cold boot flips the flag again after binding; an
+    // unlock has nothing left to wait for.
+    let ready_flag = Arc::new(std::sync::atomic::AtomicBool::new(true));
+
+    // Plan 6.7 — the runtime owns the events broadcast so runtime-side
+    // announcers (approval gate) reach `GET /events/stream`.
+    let event_tx = runtime.event_tx.clone();
+    let (lock_signal, _lock_rx) = tokio::sync::watch::channel(false);
+
+    let state = api::state::AppState {
+        runtime,
+        api_token_hash,
+        sessions: Arc::new(tokio::sync::Mutex::new(HashMap::new())),
+        ready: ready_flag,
+        trigger_tx,
+        scheduler: embedded_scheduler,
+        rate_limit_per_sec: u64::from(ctx.api.rate_limit_per_sec),
+        event_tx,
+        heartbeat_monitor,
+        trigger_registry,
+        bot_msg_tx: api_bot_msg_tx,
+        chat_tx,
+        stream_tickets: Arc::new(tokio::sync::Mutex::new(HashMap::new())),
+        lock_signal,
+    };
+
+    Ok(Live::new(state, daemon_tasks, vault, Some(transport)))
+}
diff --git a/apps/springtaled/src/test_harness/app.rs b/apps/springtaled/src/test_harness/app.rs
index d07ced1e..98702c56 100644
--- a/apps/springtaled/src/test_harness/app.rs
+++ b/apps/springtaled/src/test_harness/app.rs
@@ -128,6 +128,8 @@ impl TestApp {
             engine,
             ai_adapter,
             bot_settings: Arc::new(arc_swap::ArcSwap::from_pointee(Default::default())),
+            tasks: springtale_runtime::TaskHandles::new(),
+            activity: springtale_runtime::ActivityClock::new(),
             sentinel,
             wasm_engine,
             wasm_tier_cache,
@@ -181,6 +183,7 @@ impl TestApp {
             trigger_registry,
             chat_tx,
             stream_tickets: Arc::new(Mutex::new(HashMap::new())),
+            lock_signal: tokio::sync::watch::channel(false).0,
         };
 
         Self {
diff --git a/apps/springtaled/src/test_harness/lock.rs b/apps/springtaled/src/test_harness/lock.rs
new file mode 100644
index 00000000..fe26b05a
--- /dev/null
+++ b/apps/springtaled/src/test_harness/lock.rs
@@ -0,0 +1,121 @@
+//! A [`RuntimeGuard`] over the in-memory fixture, for lock/unlock tests.
+//!
+//! Locking the real daemon drops a runtime built on an encrypted SQLite
+//! file and a vault on disk. Rebuilding one of those per test would make
+//! the suite slow and would test Argon2id rather than the lock. This
+//! fixture keeps the lock machinery exactly as it ships — the same
+//! [`RuntimeGuard`], the same outer router, the same teardown — and
+//! swaps only the pipeline behind `POST /vault/unlock` for one that
+//! rebuilds a [`TestApp`] in memory.
+
+use std::sync::{Arc, Mutex};
+
+use axum::Router;
+use secrecy::{ExposeSecret, SecretString};
+use tokio::sync::mpsc;
+
+use springtale_cooperation::command::FormationCommand;
+use springtale_crypto::vault::store::Vault;
+use springtale_runtime::TaskHandles;
+
+use crate::api::lock::{Live, RebuildFuture, RuntimeGuard, build_outer_router};
+
+use super::app::TestApp;
+
+/// The passphrase the fixture's vault and API token are derived from.
+/// Matches [`TestApp::build`], which derives its token from the same
+/// bytes.
+pub const TEST_PASSPHRASE: &str = "test-passphrase";
+
+/// A locked-daemon fixture: the outer router, the guard behind it, and
+/// the token the inner router accepts.
+pub struct TestGuard {
+    /// The outer router — three always-on routes plus the forwarding
+    /// fallback. Exactly what `boot` serves.
+    pub router: Router,
+    /// The guard, for asserting on lock state directly.
+    pub guard: RuntimeGuard,
+    /// Hex-encoded API token accepted as `Authorization: Bearer …`.
+    pub token_hex: String,
+    /// Formation receivers for every world built so far. Held open so
+    /// `formation_cmd_tx.send` keeps succeeding after an unlock.
+    _formation_rx: Arc<Mutex<Vec<mpsc::Receiver<FormationCommand>>>>,
+}
+
+impl TestGuard {
+    /// Build an unlocked fixture.
+    ///
+    /// Must be called from inside a Tokio runtime — `TestApp::build`
+    /// registers a filesystem watcher with it.
+    pub fn build() -> Self {
+        let held: Arc<Mutex<Vec<mpsc::Receiver<FormationCommand>>>> =
+            Arc::new(Mutex::new(Vec::new()));
+        // One session, seeded into every world this fixture builds.
+        // The real daemon clears the session map on lock, so a client
+        // logs in again after an unlock; the fixture re-seeds the same
+        // token instead, so a test can assert "the route serves again"
+        // without a login round trip standing in the way.
+        let mut token_bytes = [0u8; 32];
+        rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut token_bytes);
+        let token_hex = hex::encode(token_bytes);
+
+        let live = build_test_live(&held, &token_bytes);
+        let rebuild_held = held.clone();
+        let rebuild: crate::api::lock::Rebuild =
+            Arc::new(move |passphrase: SecretString| -> RebuildFuture {
+                let held = rebuild_held.clone();
+                let token_bytes = token_bytes;
+                Box::pin(async move {
+                    // Stands in for `Vault::open`, which is the real
+                    // passphrase check: a wrong passphrase fails AEAD
+                    // decryption and no runtime is built.
+                    // SECURITY: expose needed to compare against the
+                    // fixture passphrase; the borrow does not escape.
+                    if passphrase.expose_secret() != TEST_PASSPHRASE {
+                        anyhow::bail!("wrong passphrase or corrupted vault");
+                    }
+                    Ok(build_test_live(&held, &token_bytes))
+                })
+            });
+
+        let guard = RuntimeGuard::new(live, rebuild);
+        Self {
+            router: build_outer_router(guard.clone()),
+            guard,
+            token_hex,
+            _formation_rx: held,
+        }
+    }
+}
+
+/// One in-memory world, with its formation receiver parked in `held`.
+fn build_test_live(
+    held: &Arc<Mutex<Vec<mpsc::Receiver<FormationCommand>>>>,
+    token_bytes: &[u8; 32],
+) -> Live {
+    let TestApp {
+        state,
+        formation_cmd_rx,
+        ..
+    } = TestApp::build(true);
+    match held.lock() {
+        Ok(mut list) => list.push(formation_cmd_rx),
+        Err(poisoned) => poisoned.into_inner().push(formation_cmd_rx),
+    }
+    // `TestApp` mints its own random session; replace it with the
+    // fixture's so the same bearer works across a lock/unlock cycle.
+    // The mutex is fresh and uncontended, so `try_lock` cannot fail.
+    if let Ok(mut sessions) = state.sessions.try_lock() {
+        sessions.clear();
+        let now = std::time::Instant::now();
+        sessions.insert(
+            crate::api::login::hash_token(token_bytes),
+            crate::api::login::SessionRecord {
+                issued_at: now,
+                last_seen: now,
+            },
+        );
+    }
+    let vault = Vault::create_ephemeral(TEST_PASSPHRASE.as_bytes()).expect("ephemeral vault");
+    Live::new(state, TaskHandles::new(), vault, None)
+}
diff --git a/apps/springtaled/src/test_harness/mod.rs b/apps/springtaled/src/test_harness/mod.rs
index fea98483..7cbc45c6 100644
--- a/apps/springtaled/src/test_harness/mod.rs
+++ b/apps/springtaled/src/test_harness/mod.rs
@@ -9,7 +9,9 @@
 //! compiles it.
 
 pub mod app;
+pub mod lock;
 pub mod server;
 
 pub use app::TestApp;
+pub use lock::{TEST_PASSPHRASE, TestGuard};
 pub use server::TestServer;
diff --git a/apps/springtaled/tests/one_way_to_start.rs b/apps/springtaled/tests/one_way_to_start.rs
new file mode 100644
index 00000000..69732cd2
--- /dev/null
+++ b/apps/springtaled/tests/one_way_to_start.rs
@@ -0,0 +1,117 @@
+//! Plan §6.9 — one way to start. Recipes are the starter system, so the
+//! parallel template system must not come back: no `operations::templates`
+//! module, no `springtale new` command, no `/templates` routes, no
+//! template entry in the frontend data-provider interface.
+//!
+//! This is a source-level test rather than a route test because the point
+//! is the absence of code, not the behaviour of code that exists.
+
+use std::path::{Path, PathBuf};
+
+/// Workspace root, two levels up from `apps/springtaled`.
+fn workspace_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(Path::parent)
+        .map(Path::to_path_buf)
+        .unwrap_or_else(|| PathBuf::from("."))
+}
+
+fn read(rel: &str) -> String {
+    let path = workspace_root().join(rel);
+    std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()))
+}
+
+fn exists(rel: &str) -> bool {
+    workspace_root().join(rel).exists()
+}
+
+#[test]
+fn test_template_modules_no_longer_exist() {
+    for rel in [
+        "crates/springtale-runtime/src/operations/templates.rs",
+        "apps/springtaled/src/api/templates.rs",
+        "apps/springtale-cli/src/commands/new.rs",
+        "docs/guide/templates.md",
+    ] {
+        assert!(!exists(rel), "{rel} should have been deleted");
+    }
+}
+
+#[test]
+fn test_template_modules_are_not_declared() {
+    assert!(
+        !read("crates/springtale-runtime/src/operations/mod.rs").contains("pub mod templates;"),
+        "operations still declares the templates module"
+    );
+    assert!(
+        !read("apps/springtaled/src/api/mod.rs").contains("pub mod templates;"),
+        "api still declares the templates module"
+    );
+    assert!(
+        !read("apps/springtale-cli/src/commands/mod.rs").contains("pub mod new;"),
+        "cli still declares the new command module"
+    );
+}
+
+#[test]
+fn test_no_template_routes_remain() {
+    let router = read("apps/springtaled/src/api/mod.rs");
+    assert!(
+        !router.contains("\"/templates\""),
+        "GET /templates route still registered"
+    );
+    assert!(
+        !router.contains("\"/templates/{name}\""),
+        "POST /templates/{{name}} route still registered"
+    );
+}
+
+#[test]
+fn test_no_new_command_remains() {
+    let cli = read("apps/springtale-cli/src/cli.rs");
+    assert!(!cli.contains("    New {"), "Command::New still declared");
+    assert!(
+        !cli.contains("template: Option<String>"),
+        "Command::Init still takes a template argument"
+    );
+    assert!(
+        !read("apps/springtale-cli/src/main.rs").contains("Command::New"),
+        "main still dispatches Command::New"
+    );
+}
+
+#[test]
+fn test_frontend_interface_has_no_template_item() {
+    let types = read("tauri/packages/ui/src/dashboard/types.ts");
+    assert!(
+        !types.contains("listTemplates") && !types.contains("writeTemplate"),
+        "DataProvider still declares template methods"
+    );
+    assert!(
+        !read("tauri/packages/ui/src/web/provider.ts").contains("listTemplates"),
+        "web provider still implements listTemplates"
+    );
+    assert!(
+        !read("tauri/packages/types/src/operations.ts").contains("interface Template"),
+        "shared types still declare Template"
+    );
+}
+
+#[test]
+fn test_scaffolds_that_became_recipes_are_in_the_catalog() {
+    // §6.9: cron-runner, github-monitor, llm-assistant and llm-swarm map
+    // onto the recipe catalogue rather than onto a scaffold generator.
+    let ids: Vec<String> = springtale_runtime::operations::recipes::builtin::all()
+        .into_iter()
+        .map(|r| r.id)
+        .collect();
+    for id in [
+        "cron-runner",
+        "github-monitor",
+        "llm-assistant",
+        "llm-swarm",
+    ] {
+        assert!(ids.iter().any(|i| i == id), "recipe {id} missing");
+    }
+}
diff --git a/apps/springtaled/tests/vault_lock.rs b/apps/springtaled/tests/vault_lock.rs
new file mode 100644
index 00000000..e3cde3b5
--- /dev/null
+++ b/apps/springtaled/tests/vault_lock.rs
@@ -0,0 +1,239 @@
+//! The daemon locks — plan 6.10, finding 113.
+//!
+//! The point of the feature is that `springtaled` keeps *running* with
+//! the key gone, so every test here drives the outer router through a
+//! full lock → refuse → unlock → serve cycle without the process (or
+//! the fixture) restarting.
+
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
+use std::sync::Arc;
+
+use axum::Router;
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use tower::ServiceExt;
+
+use springtaled::test_harness::{TEST_PASSPHRASE, TestGuard};
+
+/// Send a request and read the JSON body back.
+async fn send(router: Router, request: Request<Body>) -> (StatusCode, serde_json::Value) {
+    let response = router.oneshot(request).await.unwrap();
+    let status = response.status();
+    let body = axum::body::to_bytes(response.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let json: serde_json::Value = serde_json::from_slice(&body).unwrap_or(serde_json::Value::Null);
+    (status, json)
+}
+
+/// `GET /connectors` with a bearer token — a representative
+/// authenticated route.
+fn authed_get(token_hex: &str) -> Request<Body> {
+    Request::builder()
+        .uri("/connectors")
+        .header("authorization", format!("Bearer {token_hex}"))
+        .body(Body::empty())
+        .unwrap()
+}
+
+fn get(uri: &str) -> Request<Body> {
+    Request::builder().uri(uri).body(Body::empty()).unwrap()
+}
+
+/// `POST /vault/unlock` with the given passphrase.
+fn unlock_request(passphrase: &str) -> Request<Body> {
+    Request::builder()
+        .method("POST")
+        .uri("/vault/unlock")
+        .header("content-type", "application/json")
+        .body(Body::from(
+            serde_json::json!({ "passphrase": passphrase }).to_string(),
+        ))
+        .unwrap()
+}
+
+/// `POST /vault/lock`, optionally authenticated.
+fn lock_request(token_hex: Option<&str>) -> Request<Body> {
+    let builder = Request::builder().method("POST").uri("/vault/lock");
+    let builder = match token_hex {
+        Some(t) => builder.header("authorization", format!("Bearer {t}")),
+        None => builder,
+    };
+    builder.body(Body::empty()).unwrap()
+}
+
+#[tokio::test]
+async fn test_locked_daemon_refuses_authenticated_route_with_503() {
+    let app = TestGuard::build();
+
+    // Unlocked, the route works.
+    let (status, _) = send(app.router.clone(), authed_get(&app.token_hex)).await;
+    assert_eq!(status, StatusCode::OK);
+
+    assert!(app.guard.lock().await, "lock must take effect");
+    assert!(app.guard.is_locked());
+
+    // A valid bearer token buys nothing: the runtime that would have
+    // answered no longer exists.
+    let (status, body) = send(app.router.clone(), authed_get(&app.token_hex)).await;
+    assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE);
+    assert_eq!(body["locked"], serde_json::json!(true));
+}
+
+#[tokio::test]
+async fn test_ready_reports_locked_state() {
+    let app = TestGuard::build();
+
+    let (status, body) = send(app.router.clone(), get("/ready")).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body["locked"], serde_json::json!(false));
+    assert_eq!(body["status"], serde_json::json!("ready"));
+
+    app.guard.lock().await;
+
+    let (status, body) = send(app.router.clone(), get("/ready")).await;
+    assert_eq!(
+        status,
+        StatusCode::OK,
+        "a locked daemon is still a live daemon"
+    );
+    assert_eq!(body["locked"], serde_json::json!(true));
+    assert_eq!(body["status"], serde_json::json!("locked"));
+}
+
+#[tokio::test]
+async fn test_health_answers_while_locked() {
+    let app = TestGuard::build();
+    app.guard.lock().await;
+
+    let (status, body) = send(app.router.clone(), get("/health")).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body["status"], serde_json::json!("ok"));
+}
+
+#[tokio::test]
+async fn test_unlock_restores_service() {
+    let app = TestGuard::build();
+    app.guard.lock().await;
+    assert_eq!(
+        send(app.router.clone(), authed_get(&app.token_hex)).await.0,
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+
+    let (status, body) = send(app.router.clone(), unlock_request(TEST_PASSPHRASE)).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body["locked"], serde_json::json!(false));
+    assert!(!app.guard.is_locked());
+
+    // The rebuilt runtime serves the same authenticated route, and
+    // `/ready` reports a live store again.
+    let (status, _) = send(app.router.clone(), authed_get(&app.token_hex)).await;
+    assert_eq!(status, StatusCode::OK);
+
+    let (status, body) = send(app.router.clone(), get("/ready")).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body["locked"], serde_json::json!(false));
+}
+
+#[tokio::test]
+async fn test_unlock_with_wrong_passphrase_stays_locked() {
+    let app = TestGuard::build();
+    app.guard.lock().await;
+
+    let (status, body) = send(app.router.clone(), unlock_request("not-the-passphrase")).await;
+    assert_eq!(status, StatusCode::UNAUTHORIZED);
+    assert_eq!(body["locked"], serde_json::json!(true));
+    // No oracle: the refusal says nothing about why.
+    assert_eq!(body["error"], serde_json::json!("unlock failed"));
+    assert!(app.guard.is_locked());
+
+    assert_eq!(
+        send(app.router.clone(), authed_get(&app.token_hex)).await.0,
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+}
+
+#[tokio::test]
+async fn test_unlock_on_an_unlocked_daemon_is_a_conflict() {
+    let app = TestGuard::build();
+    let (status, _) = send(app.router.clone(), unlock_request(TEST_PASSPHRASE)).await;
+    assert_eq!(status, StatusCode::CONFLICT);
+    assert!(!app.guard.is_locked());
+}
+
+#[tokio::test]
+async fn test_lock_route_requires_authentication() {
+    let app = TestGuard::build();
+
+    let (status, _) = send(app.router.clone(), lock_request(None)).await;
+    assert_eq!(status, StatusCode::UNAUTHORIZED);
+    assert!(
+        !app.guard.is_locked(),
+        "an unauthenticated POST must not lock"
+    );
+
+    let (status, _) = send(
+        app.router.clone(),
+        lock_request(Some("00".repeat(32).as_str())),
+    )
+    .await;
+    assert_eq!(status, StatusCode::UNAUTHORIZED);
+    assert!(!app.guard.is_locked());
+}
+
+#[tokio::test]
+async fn test_lock_route_locks_and_is_idempotent() {
+    let app = TestGuard::build();
+
+    let (status, body) = send(app.router.clone(), lock_request(Some(&app.token_hex))).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body["locked"], serde_json::json!(true));
+    assert!(app.guard.is_locked());
+
+    // Locking a locked daemon is a no-op, not an error — a panic button
+    // must not have to know the current state.
+    let (status, body) = send(app.router.clone(), lock_request(Some(&app.token_hex))).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body["locked"], serde_json::json!(true));
+}
+
+#[tokio::test]
+async fn test_lock_then_unlock_cycles_repeatedly() {
+    let app = TestGuard::build();
+    for round in 0..3 {
+        assert!(app.guard.lock().await, "round {round}: lock");
+        assert_eq!(
+            send(app.router.clone(), authed_get(&app.token_hex)).await.0,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "round {round}: refused while locked"
+        );
+        let (status, _) = send(app.router.clone(), unlock_request(TEST_PASSPHRASE)).await;
+        assert_eq!(status, StatusCode::OK, "round {round}: unlock");
+        assert_eq!(
+            send(app.router.clone(), authed_get(&app.token_hex)).await.0,
+            StatusCode::OK,
+            "round {round}: serving again"
+        );
+    }
+}
+
+/// The point of the whole design: locking is not a flag over a live
+/// runtime, it drops the runtime. If any clone survived, the SQLite
+/// handle would stay open and the database key would stay in memory.
+#[tokio::test]
+async fn test_lock_drops_the_store_handle() {
+    let app = TestGuard::build();
+    let store = {
+        let live = app.guard.live().expect("unlocked");
+        Arc::downgrade(&live.state().runtime.store)
+    };
+    assert!(store.upgrade().is_some(), "store is open while unlocked");
+
+    app.guard.lock().await;
+
+    assert!(
+        store.upgrade().is_none(),
+        "a locked daemon must hold no reference to the store"
+    );
+}
diff --git a/connectors/connector-kick/src/chat.rs b/connectors/connector-kick/src/chat.rs
index f996a67a..e3ba3efb 100644
--- a/connectors/connector-kick/src/chat.rs
+++ b/connectors/connector-kick/src/chat.rs
@@ -23,10 +23,10 @@ use springtale_connector::error::ConnectorError;
 use crate::client::{KickApi, KickClient};
 
 /// Connector name stamped on every emitted [`ChatMessage`].
-const CONNECTOR_NAME: &str = "connector-kick";
+pub const CONNECTOR_NAME: &str = "connector-kick";
 
 /// The connector trigger whose payloads are chat.
-const CHAT_TRIGGER: &str = "chat_message";
+pub const CHAT_TRIGGER: &str = "chat_message";
 
 /// Depth of the webhook → chat bridge. Kick chat bursts; a bounded
 /// queue drops the overflow loudly rather than growing without limit.
@@ -77,6 +77,39 @@ fn id_field(value: Option<&serde_json::Value>) -> String {
     }
 }
 
+/// Read a verified Kick `chat.message.sent` payload into a
+/// [`ChatMessage`].
+///
+/// Shared by the two ways a Kick chat payload reaches the bot: this
+/// source's webhook bridge, and the management API's webhook ingress
+/// (via [`crate::webhook::ingest_event`]) — one extraction, one set of
+/// field names.
+///
+/// `None` when the payload names neither a broadcaster nor a sender,
+/// i.e. it is not a chat message at all.
+#[must_use]
+pub fn chat_message_from_payload(payload: &serde_json::Value) -> Option<ChatMessage> {
+    // `channel_id` is the broadcaster's user id — the value Kick's
+    // POST /public/v1/chat expects back.
+    let channel_id = id_field(payload.get("broadcaster").and_then(|b| b.get("user_id")));
+    let user_id = id_field(payload.get("sender").and_then(|s| s.get("user_id")));
+    if channel_id.is_empty() && user_id.is_empty() {
+        return None;
+    }
+    let text = payload
+        .get("content")
+        .and_then(|c| c.as_str())
+        .unwrap_or("")
+        .to_owned();
+    Some(ChatMessage::chat(
+        CONNECTOR_NAME,
+        channel_id,
+        user_id,
+        text,
+        payload.clone(),
+    ))
+}
+
 #[async_trait]
 impl ChatSource for KickChatSource {
     async fn run(
@@ -94,21 +127,10 @@ impl ChatSource for KickChatSource {
                         tracing::info!("Kick chat bridge closed");
                         break;
                     };
-                    // `channel_id` is the broadcaster's user id — the
-                    // value Kick's POST /public/v1/chat expects back.
-                    let channel_id = id_field(
-                        payload.get("broadcaster").and_then(|b| b.get("user_id")),
-                    );
-                    let user_id =
-                        id_field(payload.get("sender").and_then(|s| s.get("user_id")));
-                    let text = payload
-                        .get("content")
-                        .and_then(|c| c.as_str())
-                        .unwrap_or("")
-                        .to_owned();
-
-                    let msg =
-                        ChatMessage::chat(CONNECTOR_NAME, channel_id, user_id, text, payload);
+                    let Some(msg) = chat_message_from_payload(&payload) else {
+                        tracing::debug!("Kick payload carried no chat message — skipping");
+                        continue;
+                    };
                     if let Err(e) = tx.send(msg).await {
                         tracing::error!(error = %e, "failed to forward Kick chat message");
                         break;
diff --git a/connectors/connector-kick/src/connector.rs b/connectors/connector-kick/src/connector.rs
index e1430867..90f449cc 100644
--- a/connectors/connector-kick/src/connector.rs
+++ b/connectors/connector-kick/src/connector.rs
@@ -281,6 +281,18 @@ impl Connector for KickConnector {
         &self.manifest
     }
 
+    /// Read a verified Kick webhook into the chat it carries, so
+    /// `chat.message.sent` reaches the bot through the management API's
+    /// ingress. Kick has no polling gateway — this is the only route.
+    async fn ingest_webhook(
+        &self,
+        trigger: &str,
+        headers: &std::collections::HashMap<String, String>,
+        payload: &serde_json::Value,
+    ) -> springtale_connector::webhook::WebhookIngest {
+        webhook::ingest_event(trigger, headers, payload)
+    }
+
     fn chat_source(&self) -> Option<springtale_connector::chat::SharedChatSource> {
         Some(self.chat.clone())
     }
diff --git a/connectors/connector-kick/src/webhook/ingest.rs b/connectors/connector-kick/src/webhook/ingest.rs
new file mode 100644
index 00000000..6c5fa134
--- /dev/null
+++ b/connectors/connector-kick/src/webhook/ingest.rs
@@ -0,0 +1,104 @@
+//! Reading a verified Kick webhook payload into platform types.
+//!
+//! Kick has no polling gateway — `chat.message.sent` arrives only as a
+//! signed webhook. Until the ingress could ask a connector what a
+//! payload means, Kick chat had no route to the bot at all: the daemon
+//! extracted fields for one hardcoded connector and dropped everything
+//! else.
+
+use serde_json::Value;
+
+use springtale_connector::webhook::WebhookIngest;
+
+use crate::chat::{CHAT_TRIGGER, chat_message_from_payload};
+
+/// Header carrying the Kick event type (`Kick-Event-Type`).
+pub const HEADER_EVENT_TYPE: &str = "kick-event-type";
+
+/// Kick's event type for a chat message.
+pub const CHAT_EVENT_TYPE: &str = "chat.message.sent";
+
+/// Read one verified Kick webhook into the chat messages it means.
+///
+/// The route's trigger name is authoritative; the `Kick-Event-Type`
+/// header is the fallback for a webhook registered under a Kick event
+/// type rather than the connector's trigger name.
+///
+/// No rule events are attached: the webhook ingress dispatches the
+/// route's own `ConnectorEvent`, so returning it again would fire every
+/// Kick recipe twice.
+#[must_use]
+pub fn ingest_event(
+    trigger: &str,
+    headers: &std::collections::HashMap<String, String>,
+    payload: &Value,
+) -> WebhookIngest {
+    if !is_chat(trigger, headers) {
+        return WebhookIngest::empty();
+    }
+    match chat_message_from_payload(payload) {
+        Some(msg) => WebhookIngest::message(msg),
+        None => WebhookIngest::empty(),
+    }
+}
+
+/// Whether this request carries a Kick chat message.
+fn is_chat(trigger: &str, headers: &std::collections::HashMap<String, String>) -> bool {
+    if trigger == CHAT_TRIGGER {
+        return true;
+    }
+    headers
+        .iter()
+        .find(|(k, _)| k.eq_ignore_ascii_case(HEADER_EVENT_TYPE))
+        .is_some_and(|(_, v)| v == CHAT_EVENT_TYPE)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn chat_payload() -> Value {
+        serde_json::json!({
+            "message_id": "m1",
+            "broadcaster": { "user_id": 555, "username": "streamer" },
+            "sender": { "user_id": 777, "username": "viewer" },
+            "content": "!uptime"
+        })
+    }
+
+    #[test]
+    fn test_ingest_event_chat_trigger_returns_chat_message() {
+        let ingest = ingest_event(
+            CHAT_TRIGGER,
+            &std::collections::HashMap::new(),
+            &chat_payload(),
+        );
+        assert_eq!(ingest.messages.len(), 1);
+        let msg = &ingest.messages[0];
+        assert_eq!(msg.connector, "connector-kick");
+        assert_eq!(msg.channel_id, "555");
+        assert_eq!(msg.user_id, "777");
+        assert_eq!(msg.text, "!uptime");
+        assert!(msg.deliver_to_bot);
+        assert!(ingest.events.is_empty());
+    }
+
+    #[test]
+    fn test_ingest_event_event_type_header_returns_chat_message() {
+        let mut headers = std::collections::HashMap::new();
+        headers.insert("Kick-Event-Type".to_owned(), CHAT_EVENT_TYPE.to_owned());
+        let ingest = ingest_event("some_route", &headers, &chat_payload());
+        assert_eq!(ingest.messages.len(), 1);
+        assert_eq!(ingest.messages[0].text, "!uptime");
+    }
+
+    #[test]
+    fn test_ingest_event_non_chat_trigger_returns_empty() {
+        let ingest = ingest_event(
+            "stream_live",
+            &std::collections::HashMap::new(),
+            &serde_json::json!({ "is_live": true }),
+        );
+        assert!(ingest.is_empty());
+    }
+}
diff --git a/connectors/connector-kick/src/webhook/mod.rs b/connectors/connector-kick/src/webhook/mod.rs
index d857418c..1eb2b78e 100644
--- a/connectors/connector-kick/src/webhook/mod.rs
+++ b/connectors/connector-kick/src/webhook/mod.rs
@@ -12,8 +12,10 @@ use rustls_pemfile::Item;
 
 use crate::error::KickError;
 
+pub mod ingest;
 pub mod replay;
 
+pub use ingest::ingest_event;
 pub use replay::{ReplayCache, check_timestamp};
 
 /// Header carrying the idempotent message id (`Kick-Event-Message-Id`).
diff --git a/connectors/connector-telegram/src/connector.rs b/connectors/connector-telegram/src/connector.rs
index b69c8768..6a7c64e1 100644
--- a/connectors/connector-telegram/src/connector.rs
+++ b/connectors/connector-telegram/src/connector.rs
@@ -204,6 +204,19 @@ impl Connector for TelegramConnector {
         crate::triggers::normalize::normalize(trigger, &raw)
     }
 
+    /// Read a verified Telegram `Update` into the chat it carries.
+    ///
+    /// The daemon used to do this itself, in a `match` on the connector
+    /// name — see [`crate::webhook::ingest_update`].
+    async fn ingest_webhook(
+        &self,
+        _trigger: &str,
+        _headers: &std::collections::HashMap<String, String>,
+        payload: &serde_json::Value,
+    ) -> springtale_connector::webhook::WebhookIngest {
+        crate::webhook::ingest_update(payload)
+    }
+
     /// Verify an incoming webhook request using the `X-Telegram-Bot-Api-Secret-Token` header.
     ///
     /// Telegram sets this header on every webhook POST when `set_webhook` was
diff --git a/connectors/connector-telegram/src/webhook/ingest.rs b/connectors/connector-telegram/src/webhook/ingest.rs
new file mode 100644
index 00000000..4d9d646e
--- /dev/null
+++ b/connectors/connector-telegram/src/webhook/ingest.rs
@@ -0,0 +1,131 @@
+//! Reading a verified Telegram webhook `Update` into platform types.
+//!
+//! This extraction used to live in the daemon (`api/webhooks.rs`), keyed
+//! off a `match` on the connector name — which is why no other
+//! connector's webhook chat could reach the bot. It belongs to the crate
+//! that speaks the protocol.
+
+use serde_json::Value;
+
+use springtale_connector::chat::ChatMessage;
+use springtale_connector::webhook::WebhookIngest;
+
+use crate::chat::CONNECTOR_NAME;
+
+/// Read one verified Telegram `Update` into the chat messages it means.
+///
+/// Mirrors the polling dispatcher's field extraction
+/// ([`crate::chat::TelegramChatSource`]) so webhook-mode and
+/// polling-mode chat reach the bot identically.
+///
+/// No rule events are attached: the webhook ingress dispatches the
+/// route's own `ConnectorEvent`, so returning it again would fire every
+/// matching recipe twice.
+#[must_use]
+pub fn ingest_update(payload: &Value) -> WebhookIngest {
+    if let Some(message) = payload.get("message") {
+        return match message_fields(message) {
+            Some((channel_id, user_id, text)) => WebhookIngest::message(ChatMessage::chat(
+                CONNECTOR_NAME,
+                channel_id,
+                user_id,
+                text,
+                payload.clone(),
+            )),
+            None => WebhookIngest::empty(),
+        };
+    }
+
+    // Inline keyboard button press: the callback data is the text, so
+    // handlers treat it as a command-like input.
+    if let Some(callback) = payload.get("callback_query") {
+        return match callback_fields(callback) {
+            Some((channel_id, user_id, text)) => WebhookIngest::message(ChatMessage::chat(
+                CONNECTOR_NAME,
+                channel_id,
+                user_id,
+                text,
+                payload.clone(),
+            )),
+            None => WebhookIngest::empty(),
+        };
+    }
+
+    WebhookIngest::empty()
+}
+
+/// `(channel_id, user_id, text)` from a Telegram `message` object.
+fn message_fields(message: &Value) -> Option<(String, String, String)> {
+    let user_id = numeric_id(message.get("from")?.get("id"))?;
+    let channel_id = numeric_id(message.get("chat")?.get("id"))?;
+    let text = message
+        .get("text")
+        .and_then(Value::as_str)
+        .unwrap_or("")
+        .to_owned();
+    Some((channel_id, user_id, text))
+}
+
+/// `(channel_id, user_id, text)` from a Telegram `callback_query`.
+fn callback_fields(callback: &Value) -> Option<(String, String, String)> {
+    let user_id = numeric_id(callback.get("from")?.get("id"))?;
+    let channel_id = numeric_id(callback.get("message")?.get("chat")?.get("id"))?;
+    let text = callback
+        .get("data")
+        .and_then(Value::as_str)
+        .unwrap_or("")
+        .to_owned();
+    Some((channel_id, user_id, text))
+}
+
+/// Telegram ids are 64-bit integers; render one as the string every
+/// downstream consumer uses.
+fn numeric_id(value: Option<&Value>) -> Option<String> {
+    value.and_then(Value::as_i64).map(|i| i.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_ingest_update_message_returns_chat_message() {
+        let update = serde_json::json!({
+            "message": {
+                "from": { "id": 42 },
+                "chat": { "id": -100 },
+                "text": "/help"
+            }
+        });
+        let ingest = ingest_update(&update);
+        assert_eq!(ingest.messages.len(), 1);
+        let msg = &ingest.messages[0];
+        assert_eq!(msg.connector, CONNECTOR_NAME);
+        assert_eq!(msg.user_id, "42");
+        assert_eq!(msg.channel_id, "-100");
+        assert_eq!(msg.text, "/help");
+        assert!(ingest.events.is_empty());
+    }
+
+    #[test]
+    fn test_ingest_update_callback_query_returns_chat_message() {
+        let update = serde_json::json!({
+            "callback_query": {
+                "id": "cb1",
+                "from": { "id": 7 },
+                "message": { "chat": { "id": 9 } },
+                "data": "confirm"
+            }
+        });
+        let ingest = ingest_update(&update);
+        assert_eq!(ingest.messages.len(), 1);
+        assert_eq!(ingest.messages[0].text, "confirm");
+        assert_eq!(ingest.messages[0].channel_id, "9");
+    }
+
+    #[test]
+    fn test_ingest_update_unknown_shape_returns_empty() {
+        let update = serde_json::json!({ "edited_channel_post": { "text": "x" } });
+        assert!(ingest_update(&update).is_empty());
+    }
+}
diff --git a/connectors/connector-telegram/src/webhook/mod.rs b/connectors/connector-telegram/src/webhook/mod.rs
index fbfec880..45268455 100644
--- a/connectors/connector-telegram/src/webhook/mod.rs
+++ b/connectors/connector-telegram/src/webhook/mod.rs
@@ -1,5 +1,9 @@
 use crate::error::TelegramError;
 
+pub mod ingest;
+
+pub use ingest::ingest_update;
+
 /// Verify a Telegram webhook request by checking the secret_token header.
 ///
 /// Telegram's webhook auth model: when you call `setWebhook` with a `secret_token`,
diff --git a/crates/springtale-bot/src/cooperation/lifecycle.rs b/crates/springtale-bot/src/cooperation/lifecycle.rs
index 74d95273..0dd7e259 100644
--- a/crates/springtale-bot/src/cooperation/lifecycle.rs
+++ b/crates/springtale-bot/src/cooperation/lifecycle.rs
@@ -112,6 +112,19 @@ pub async fn spawn_formation(
     // Parse intent from stored string
     let intent = springtale_cooperation::command::parse_intent(&row.intent);
 
+    // Guard mode is durable in the `guard:{formation_id}` config row; the live
+    // formation carries it in `constraints.guard_mode`. Seed it here so a
+    // formation that was guarded before a restart comes back guarded — the
+    // toggle keeps the two in step afterward via `FormationCommand::SetGuard`.
+    let constraints = FormationConstraints {
+        guard_mode: springtale_runtime::operations::config::formation_guard_engaged(
+            &**store,
+            formation_id,
+        )
+        .await,
+        ..FormationConstraints::default()
+    };
+
     let deps = FormationDeps {
         cadence: cadence.clone(),
         store: store.clone(),
@@ -120,7 +133,7 @@ pub async fn spawn_formation(
         formation_gossip: formation_gossip.cloned(),
     };
     let (mut formation, proto_dispatch, ack_dispatch) =
-        Formation::new(members, intent, FormationConstraints::default(), deps);
+        Formation::new(members, intent, constraints, deps);
 
     // Override the auto-generated ID with the stored one
     if let Ok(uuid) = uuid::Uuid::parse_str(&row.id) {
diff --git a/crates/springtale-bot/src/lib.rs b/crates/springtale-bot/src/lib.rs
index 070067fa..126a6389 100644
--- a/crates/springtale-bot/src/lib.rs
+++ b/crates/springtale-bot/src/lib.rs
@@ -20,4 +20,4 @@ pub mod tool_runner;
 
 pub use error::BotError;
 pub use router::RouteResult;
-pub use runtime::lifecycle::{Bot, BotBuilder, BotConfig, OutgoingResponse};
+pub use runtime::lifecycle::{Bot, BotBuilder, OutgoingResponse};
diff --git a/crates/springtale-bot/src/runtime/headless.rs b/crates/springtale-bot/src/runtime/headless.rs
index ffa4c887..8e6f789a 100644
--- a/crates/springtale-bot/src/runtime/headless.rs
+++ b/crates/springtale-bot/src/runtime/headless.rs
@@ -10,7 +10,7 @@ use springtale_store::SqliteBackend;
 use crate::error::BotError;
 use springtale_connector::chat::ChatMessage;
 
-use crate::runtime::lifecycle::{BotBuilder, BotConfig, OutgoingResponse};
+use crate::runtime::lifecycle::{BotBuilder, OutgoingResponse};
 
 /// A headless bot for testing. No Telegram, no network.
 ///
@@ -26,14 +26,9 @@ pub struct HeadlessBot {
 }
 
 impl HeadlessBot {
-    /// Create a headless bot with in-memory SQLite and default config.
+    /// Create a headless bot with in-memory SQLite and default settings.
     pub async fn new() -> Result<Self, BotError> {
-        Self::with_config(BotConfig::default()).await
-    }
-
-    /// Create a headless bot with a custom config.
-    pub async fn with_config(config: BotConfig) -> Result<Self, BotError> {
-        Self::with_config_and_deployer(config, None).await
+        Self::with_deployer(None).await
     }
 
     /// Create a headless bot with custom bot settings (persona, context
@@ -42,7 +37,6 @@ impl HeadlessBot {
         settings: springtale_runtime::operations::bot_settings::BotSettings,
     ) -> Result<Self, BotError> {
         Self::build(
-            BotConfig::default(),
             None,
             Some(std::sync::Arc::new(arc_swap::ArcSwap::from_pointee(
                 settings,
@@ -53,15 +47,13 @@ impl HeadlessBot {
 
     /// Create a headless bot, optionally wiring a conversational-setup
     /// deploy port (tests use a mock to observe what would be deployed).
-    pub async fn with_config_and_deployer(
-        config: BotConfig,
+    pub async fn with_deployer(
         deployer: Option<crate::conversation::deploy::SharedDeployer>,
     ) -> Result<Self, BotError> {
-        Self::build(config, deployer, None).await
+        Self::build(deployer, None).await
     }
 
     async fn build(
-        config: BotConfig,
         deployer: Option<crate::conversation::deploy::SharedDeployer>,
         settings: Option<
             std::sync::Arc<
@@ -113,7 +105,6 @@ impl HeadlessBot {
             .registry(registry)
             .engine(engine)
             .sentinel(sentinel)
-            .config(config)
             .connector_rx(msg_rx)
             .rule_rx(rule_rx)
             .response_tx(response_tx)
@@ -227,10 +218,9 @@ mod tests {
     async fn test_conversational_weather_setup_no_ai_end_to_end() {
         let deployer = RecordingDeployer::default();
         let recorded = deployer.last.clone();
-        let mut bot =
-            HeadlessBot::with_config_and_deployer(BotConfig::default(), Some(Arc::new(deployer)))
-                .await
-                .unwrap();
+        let mut bot = HeadlessBot::with_deployer(Some(Arc::new(deployer)))
+            .await
+            .unwrap();
 
         // The exact order the user reported — a city NOT in any list.
         let r1 = bot
@@ -277,10 +267,9 @@ mod tests {
     async fn test_conversational_correction_before_deploy() {
         let deployer = RecordingDeployer::default();
         let recorded = deployer.last.clone();
-        let mut bot =
-            HeadlessBot::with_config_and_deployer(BotConfig::default(), Some(Arc::new(deployer)))
-                .await
-                .unwrap();
+        let mut bot = HeadlessBot::with_deployer(Some(Arc::new(deployer)))
+            .await
+            .unwrap();
 
         let _ = bot.ask("user1", "morning weather for Phoenix").await;
         let _ = bot.ask("user1", "actually make it Tucson").await;
@@ -298,10 +287,9 @@ mod tests {
     async fn test_conversational_cancel_deploys_nothing() {
         let deployer = RecordingDeployer::default();
         let recorded = deployer.last.clone();
-        let mut bot =
-            HeadlessBot::with_config_and_deployer(BotConfig::default(), Some(Arc::new(deployer)))
-                .await
-                .unwrap();
+        let mut bot = HeadlessBot::with_deployer(Some(Arc::new(deployer)))
+            .await
+            .unwrap();
 
         let _ = bot.ask("user1", "set up the morning weather").await;
         let _ = bot.ask("user1", "never mind").await;
@@ -315,10 +303,9 @@ mod tests {
     async fn test_secret_recipe_handed_off_and_no_token_in_session_store() {
         let deployer = RecordingDeployer::default();
         let recorded = deployer.last.clone();
-        let mut bot =
-            HeadlessBot::with_config_and_deployer(BotConfig::default(), Some(Arc::new(deployer)))
-                .await
-                .unwrap();
+        let mut bot = HeadlessBot::with_deployer(Some(Arc::new(deployer)))
+            .await
+            .unwrap();
 
         let r = bot
             .ask("user1", "set up a telegram echo bot")
diff --git a/crates/springtale-bot/src/runtime/lifecycle.rs b/crates/springtale-bot/src/runtime/lifecycle.rs
index b4b6e6d1..9ef2e948 100644
--- a/crates/springtale-bot/src/runtime/lifecycle.rs
+++ b/crates/springtale-bot/src/runtime/lifecycle.rs
@@ -2,7 +2,6 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use arc_swap::ArcSwap;
-use serde::Deserialize;
 use tokio::sync::{RwLock, broadcast, mpsc};
 
 use springtale_connector::registry::store::ConnectorRegistry;
@@ -29,31 +28,6 @@ pub struct OutgoingResponse {
     pub connector: String,
 }
 
-/// Configuration for the bot runtime.
-///
-/// Persona, context window and tool policy are NOT here — plan 6.3 moved
-/// them to `springtale_runtime::operations::bot_settings`, so they can be
-/// changed from the UI/CLI at runtime instead of by editing a TOML file
-/// and restarting the daemon.
-#[derive(Debug, Clone, Deserialize)]
-pub struct BotConfig {
-    /// Vault auto-lock timeout in seconds. Default: 300 (5 min).
-    #[serde(default = "default_vault_timeout")]
-    pub vault_timeout_secs: u64,
-}
-
-fn default_vault_timeout() -> u64 {
-    300
-}
-
-impl Default for BotConfig {
-    fn default() -> Self {
-        Self {
-            vault_timeout_secs: default_vault_timeout(),
-        }
-    }
-}
-
 /// The bot runtime. Owns all bot subsystems.
 pub struct Bot {
     pub(crate) router: Router,
@@ -61,12 +35,6 @@ pub struct Bot {
     pub(crate) store: Arc<dyn StorageBackend>,
     pub(crate) registry: Arc<RwLock<ConnectorRegistry>>,
     pub(crate) engine: Arc<RwLock<RuleEngine>>,
-    /// Boot-time config. Only `vault_timeout_secs` remains here and no
-    /// bot subsystem reads it yet — plan 6.10 moves it to the vault
-    /// settings that own it. Held so the builder API stays stable until
-    /// then.
-    #[allow(dead_code)]
-    pub(crate) config: BotConfig,
     /// Live bot settings (persona, context window, tool policy) shared
     /// with `RuntimeState::bot_settings`. Read per message so a settings
     /// change lands without restarting the event loop (plan 6.3).
@@ -173,7 +141,6 @@ pub struct BotBuilder {
     store: Option<Arc<dyn StorageBackend>>,
     registry: Option<Arc<RwLock<ConnectorRegistry>>>,
     engine: Option<Arc<RwLock<RuleEngine>>>,
-    config: BotConfig,
     /// Shared settings handle — the daemon/desktop pass
     /// `RuntimeState::bot_settings`; tests and CLI runs get defaults.
     settings: Option<Arc<ArcSwap<BotSettings>>>,
@@ -235,7 +202,6 @@ impl BotBuilder {
             store: None,
             registry: None,
             engine: None,
-            config: BotConfig::default(),
             settings: None,
             ai_adapter: None,
             sentinel: None,
@@ -403,11 +369,6 @@ impl BotBuilder {
         self
     }
 
-    pub fn config(mut self, config: BotConfig) -> Self {
-        self.config = config;
-        self
-    }
-
     pub fn connector_rx(mut self, rx: mpsc::Receiver<ChatMessage>) -> Self {
         self.connector_rx = Some(rx);
         self
@@ -588,7 +549,6 @@ impl BotBuilder {
             store,
             registry,
             engine,
-            config: self.config,
             settings,
             context,
             ai_adapter,
diff --git a/crates/springtale-bot/src/runtime/tick_steps/handle_command.rs b/crates/springtale-bot/src/runtime/tick_steps/handle_command.rs
index eed7ae24..cecfaf98 100644
--- a/crates/springtale-bot/src/runtime/tick_steps/handle_command.rs
+++ b/crates/springtale-bot/src/runtime/tick_steps/handle_command.rs
@@ -33,6 +33,34 @@ fn guarded(formation: &Formation, verb: &str) -> bool {
     }
 }
 
+/// Engage or disengage guard mode on a live formation and republish the
+/// formation context so members see the new constraint on their next read.
+///
+/// The `guard:{formation_id}` config row is the durable copy (read back into
+/// `constraints.guard_mode` at deploy); this is the live copy that
+/// [`guarded`] enforces. `operations::config::toggle_formation_guard` writes
+/// the row and posts `FormationCommand::SetGuard` together, so engaging guard
+/// protects the formation immediately rather than at the next redeploy.
+fn set_guard(formation: &mut Formation, engaged: bool) {
+    formation.constraints.guard_mode = engaged;
+    formation.broadcast_context();
+}
+
+/// Failures a formation recorded over its whole life, for the dissolve
+/// outcome that gossip and the knowledge store publish.
+///
+/// The momentum FSM is the only place that counts a formation's failures:
+/// `record_interference` bumps `interference_total` on every interference and
+/// never resets it, while `interference_count` and `consecutive_successes` are
+/// per-clean-run and reset on every break (Patapon combo). A dissolve is a
+/// lifetime summary, so `interference_total` is the count that matches
+/// `success_count`'s question — "how did this formation do" — and a hardcoded
+/// zero read as "nothing ever failed here", which skewed the retrieval
+/// scorer's success/total ratio in `cooperation::lifecycle`.
+fn dissolve_failure_count(momentum: &springtale_cooperation::momentum::MomentumState) -> u32 {
+    momentum.interference_total
+}
+
 pub async fn handle_formation_command(bot: &mut Bot, cmd: FormationCommand) {
     match cmd {
         FormationCommand::Deploy { formation_id } => {
@@ -85,7 +113,7 @@ pub async fn handle_formation_command(bot: &mut Bot, cmd: FormationCommand) {
                         formation_id: f.id,
                         final_intent: f.intent.clone(),
                         success_count: f.momentum.consecutive_successes,
-                        failure_count: 0,
+                        failure_count: dissolve_failure_count(&f.momentum),
                         dissolve_reason: reason.clone(),
                         at: chrono::Utc::now(),
                     };
@@ -110,7 +138,7 @@ pub async fn handle_formation_command(bot: &mut Bot, cmd: FormationCommand) {
                         peak_tier: f.momentum.tier,
                         connectors,
                         success_count: f.momentum.consecutive_successes,
-                        failure_count: 0,
+                        failure_count: dissolve_failure_count(&f.momentum),
                         dissolve_reason: reason.clone(),
                         at: chrono::Utc::now(),
                     };
@@ -136,6 +164,18 @@ pub async fn handle_formation_command(bot: &mut Bot, cmd: FormationCommand) {
                 tracing::warn!(id = %formation_id, "formation not found for pause");
             }
         }
+        FormationCommand::SetGuard {
+            formation_id,
+            engaged,
+        } => {
+            let mut formations = bot.formations.write().await;
+            if let Some(formation) = formations.iter_mut().find(|f| f.id == formation_id) {
+                set_guard(formation, engaged);
+                tracing::info!(id = %formation_id, engaged, "formation guard mode set");
+            } else {
+                tracing::warn!(id = %formation_id, "formation not found for SetGuard");
+            }
+        }
         FormationCommand::Resume { formation_id } => {
             let mut formations = bot.formations.write().await;
             if let Some(formation) = formations.iter_mut().find(|f| f.id == formation_id) {
@@ -271,8 +311,8 @@ pub async fn handle_formation_command(bot: &mut Bot, cmd: FormationCommand) {
                         tier = ?formation.momentum.tier,
                         "recruit denied — formation has not earned Fever tier"
                     );
-                } else if formation.constraints.guard_mode {
-                    tracing::info!(id = %formation_id, "recruit denied — guard mode engaged");
+                } else if guarded(formation, "recruit") {
+                    // `guarded` already logged the denial.
                 } else {
                     let member = crate::cooperation::formation::FormationMember::from_strings(
                         AgentId::new(),
@@ -418,6 +458,61 @@ mod tests {
         crate::cooperation::formation::FormationMember::new(id, vec!["connector-telegram".into()])
     }
 
+    /// Toggling guard on a *live* formation blocks a guarded verb straight
+    /// away. The guard flag used to be read only at deploy, so engaging it
+    /// left the running formation unprotected until a redeploy;
+    /// `FormationCommand::SetGuard` (posted by `toggle_formation_guard`) lands
+    /// here instead.
+    #[test]
+    fn test_set_guard_blocks_guarded_verbs_without_redeploy() {
+        use springtale_cooperation::cadence::IntentPattern;
+        use springtale_cooperation::types::FormationConstraints;
+
+        // Deployed with guard off — the default every spawn used to get.
+        let mut formation = crate::cooperation::formation::Formation::new_disconnected(
+            vec![member(AgentId::new())],
+            IntentPattern::Stabilize {
+                reason: "test".into(),
+            },
+            FormationConstraints::default(),
+        );
+        assert!(!formation.constraints.guard_mode);
+        for verb in ["dissolve", "intent", "remove_member", "rally", "recruit"] {
+            assert!(!guarded(&formation, verb), "{verb} blocked before toggle");
+        }
+
+        set_guard(&mut formation, true);
+
+        assert!(formation.constraints.guard_mode);
+        for verb in ["dissolve", "intent", "remove_member", "rally", "recruit"] {
+            assert!(guarded(&formation, verb), "{verb} not blocked under guard");
+        }
+
+        set_guard(&mut formation, false);
+        assert!(!guarded(&formation, "dissolve"));
+    }
+
+    /// The dissolve outcome reports the failures the formation actually
+    /// recorded, not a hardcoded zero.
+    #[test]
+    fn test_dissolve_failure_count_matches_recorded_interferences() {
+        use springtale_cooperation::momentum::MomentumState;
+
+        let mut momentum = MomentumState::default();
+        assert_eq!(dissolve_failure_count(&momentum), 0);
+
+        momentum.record_interference();
+        momentum.record_success();
+        momentum.record_interference();
+        momentum.record_interference();
+
+        // Three interferences over the formation's life; the per-run counter
+        // reset behind each one, which is why it cannot be the source.
+        assert_eq!(momentum.interference_total, 3);
+        assert_eq!(momentum.interference_count, 0);
+        assert_eq!(dissolve_failure_count(&momentum), 3);
+    }
+
     /// A rally relieves the member carrying the most attention. Picking the
     /// least-loaded member, as this path once did, releases load that was
     /// never there.
diff --git a/crates/springtale-connector/src/connector/trait_.rs b/crates/springtale-connector/src/connector/trait_.rs
index a24b0c7d..8c64f509 100644
--- a/crates/springtale-connector/src/connector/trait_.rs
+++ b/crates/springtale-connector/src/connector/trait_.rs
@@ -94,6 +94,40 @@ pub trait Connector: Send + Sync + 'static {
         ))
     }
 
+    /// Read an already-VERIFIED webhook payload: what chat messages and
+    /// rule-engine events does it mean?
+    ///
+    /// Called by the management API's webhook ingress immediately after
+    /// [`Connector::verify_webhook`] returns `Ok`. The ingress owns the
+    /// transport (route, signature check, event log, rate limits); the
+    /// connector owns the protocol — which field is the sender, which is
+    /// the channel, which updates are chat at all.
+    ///
+    /// Before this existed the daemon extracted those fields itself with
+    /// a `match` on one connector name, so only that connector's webhook
+    /// chat could reach the bot and every other connector's webhook was
+    /// receive-only.
+    ///
+    /// # Arguments
+    /// * `trigger` — trigger name from the webhook route
+    /// * `headers` — HTTP headers from the request (already verified)
+    /// * `payload` — parsed JSON body (already verified, depth-checked)
+    ///
+    /// The ingress dispatches the route's own `ConnectorEvent` itself, so
+    /// return an event in [`WebhookIngest::events`] only for an
+    /// *additional* rule event the same request implies.
+    ///
+    /// Default: [`WebhookIngest::empty`] — correct for connectors with no
+    /// webhooks and for gateway/polling connectors.
+    async fn ingest_webhook(
+        &self,
+        _trigger: &str,
+        _headers: &std::collections::HashMap<String, String>,
+        _payload: &serde_json::Value,
+    ) -> crate::webhook::WebhookIngest {
+        crate::webhook::WebhookIngest::empty()
+    }
+
     /// Normalize a raw provider event payload for `trigger` into this
     /// connector's declared trigger schema — the canonical flat shape
     /// recipes consume via `${trigger.*}`.
diff --git a/crates/springtale-connector/src/host/trait_.rs b/crates/springtale-connector/src/host/trait_.rs
index d9a1ab67..55bb1a5e 100644
--- a/crates/springtale-connector/src/host/trait_.rs
+++ b/crates/springtale-connector/src/host/trait_.rs
@@ -57,6 +57,23 @@ pub trait ConnectorHost: Send + Sync + 'static {
         body: &[u8],
     ) -> Result<(), ConnectorError>;
 
+    /// Read an already-verified webhook payload into the chat messages
+    /// and rule events it means — see
+    /// [`crate::connector::trait_::Connector::ingest_webhook`]. Exposed
+    /// through the host so the daemon's webhook ingress can ask the
+    /// connector what a payload means instead of hardcoding one
+    /// connector's field names. Native hosts delegate to the inner
+    /// connector; WASM hosts return nothing (a sandbox-side hook can
+    /// follow, like `mention_extractor`).
+    async fn ingest_webhook(
+        &self,
+        _trigger: &str,
+        _headers: &std::collections::HashMap<String, String>,
+        _payload: &serde_json::Value,
+    ) -> crate::webhook::WebhookIngest {
+        crate::webhook::WebhookIngest::empty()
+    }
+
     /// The connector's chat ingestion half (see
     /// [`crate::chat::ChatSource`]), exposed through the host so the
     /// runtime can start and stop the loop without downcasting.
diff --git a/crates/springtale-connector/src/lib.rs b/crates/springtale-connector/src/lib.rs
index b4cd8f64..6f266660 100644
--- a/crates/springtale-connector/src/lib.rs
+++ b/crates/springtale-connector/src/lib.rs
@@ -20,6 +20,7 @@ pub mod registry;
 pub mod tier;
 #[cfg(feature = "wasm-sandbox")]
 pub mod wasm;
+pub mod webhook;
 pub mod workspace_key;
 
 pub use chat::{ChatMessage, ChatSource, SharedChatSource};
@@ -31,3 +32,4 @@ pub use host::ConnectorHost;
 pub use manifest::types::{ActionDecl, Capability, ConnectorManifest, TriggerDecl};
 pub use registry::store::ConnectorRegistry;
 pub use tier::WasmTier;
+pub use webhook::{WebhookEvent, WebhookIngest};
diff --git a/crates/springtale-connector/src/native/runtime.rs b/crates/springtale-connector/src/native/runtime.rs
index 974da8bc..0125e9c7 100644
--- a/crates/springtale-connector/src/native/runtime.rs
+++ b/crates/springtale-connector/src/native/runtime.rs
@@ -155,6 +155,15 @@ impl ConnectorHost for NativeConnectorHost {
         NativeConnectorHost::verify_webhook(self, headers, body).await
     }
 
+    async fn ingest_webhook(
+        &self,
+        trigger: &str,
+        headers: &std::collections::HashMap<String, String>,
+        payload: &serde_json::Value,
+    ) -> crate::webhook::WebhookIngest {
+        self.inner.ingest_webhook(trigger, headers, payload).await
+    }
+
     fn chat_source(&self) -> Option<crate::chat::SharedChatSource> {
         self.inner.chat_source()
     }
diff --git a/crates/springtale-connector/src/webhook/ingest.rs b/crates/springtale-connector/src/webhook/ingest.rs
new file mode 100644
index 00000000..6a0bd3e1
--- /dev/null
+++ b/crates/springtale-connector/src/webhook/ingest.rs
@@ -0,0 +1,68 @@
+//! What a verified webhook payload means, in the platform's own types.
+
+use crate::chat::ChatMessage;
+
+/// One rule-engine event a webhook payload carries, beyond the trigger
+/// the ingress already dispatches for the request path itself.
+///
+/// A connector returns these only when a single verified request means
+/// *more* than its path trigger — the ingress always dispatches the
+/// path's own `ConnectorEvent`, so repeating it here would fire every
+/// matching recipe twice.
+#[derive(Debug, Clone)]
+pub struct WebhookEvent {
+    /// `ConnectorEvent` name, as declared in
+    /// [`crate::connector::trait_::Connector::triggers`].
+    pub event: String,
+    /// Payload the recipe sees (normalized centrally, downstream).
+    pub payload: serde_json::Value,
+}
+
+impl WebhookEvent {
+    /// Build an event from its name and payload.
+    pub fn new(event: impl Into<String>, payload: serde_json::Value) -> Self {
+        Self {
+            event: event.into(),
+            payload,
+        }
+    }
+}
+
+/// The result of reading a verified webhook payload.
+///
+/// Both halves reuse the platform's existing types: `messages` are the
+/// same [`ChatMessage`] the polling gateways push through
+/// [`crate::chat::ChatSource`], so webhook-mode chat and polling-mode
+/// chat reach the bot down one path.
+#[derive(Debug, Clone, Default)]
+pub struct WebhookIngest {
+    /// Chat messages the payload carries, bound for the bot runtime
+    /// (subject to each message's `deliver_to_bot`).
+    pub messages: Vec<ChatMessage>,
+    /// Additional rule-engine events the payload carries.
+    pub events: Vec<WebhookEvent>,
+}
+
+impl WebhookIngest {
+    /// Nothing to ingest — the default for connectors without webhooks
+    /// and for payloads a connector does not recognize.
+    #[must_use]
+    pub fn empty() -> Self {
+        Self::default()
+    }
+
+    /// One chat message, no extra rule events.
+    #[must_use]
+    pub fn message(msg: ChatMessage) -> Self {
+        Self {
+            messages: vec![msg],
+            events: Vec::new(),
+        }
+    }
+
+    /// Whether this ingest carries nothing at all.
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.messages.is_empty() && self.events.is_empty()
+    }
+}
diff --git a/crates/springtale-connector/src/webhook/mod.rs b/crates/springtale-connector/src/webhook/mod.rs
new file mode 100644
index 00000000..d1e66850
--- /dev/null
+++ b/crates/springtale-connector/src/webhook/mod.rs
@@ -0,0 +1,16 @@
+//! Inbound webhook ingress — what a *verified* webhook payload means.
+//!
+//! Signature verification ([`crate::connector::trait_::Connector::verify_webhook`])
+//! answers "is this payload genuine?". It does not answer "what is in
+//! it?" — and the daemon used to answer that itself, with a `match` on
+//! one connector name, so exactly one connector's webhooks could reach
+//! the bot. Every other connector's webhook was receive-only.
+//!
+//! [`crate::connector::trait_::Connector::ingest_webhook`] moves that
+//! answer into the crate that owns the protocol. The ingress verifies,
+//! then asks the connector what the payload means, and forwards the
+//! result — no connector names in the daemon.
+
+pub mod ingest;
+
+pub use ingest::{WebhookEvent, WebhookIngest};
diff --git a/crates/springtale-cooperation/src/command.rs b/crates/springtale-cooperation/src/command.rs
index abcbd81e..a2cf0d15 100644
--- a/crates/springtale-cooperation/src/command.rs
+++ b/crates/springtale-cooperation/src/command.rs
@@ -15,6 +15,17 @@ pub enum FormationCommand {
     Pause { formation_id: FormationId },
     /// Resume a paused formation.
     Resume { formation_id: FormationId },
+    /// Engage or disengage guard mode on a live formation.
+    ///
+    /// Guard mode lives in two places: the `guard:{formation_id}` config row
+    /// (durable, read back at deploy into `constraints.guard_mode`) and the
+    /// live `Formation` the bot ticks. `operations::config::toggle_formation_guard`
+    /// writes the row and posts this command in the same call, so the two can
+    /// never disagree and the toggle takes effect without a redeploy.
+    SetGuard {
+        formation_id: FormationId,
+        engaged: bool,
+    },
     /// Dissolve a formation and remove from memory.
     Dissolve {
         formation_id: FormationId,
diff --git a/crates/springtale-runtime/src/activity.rs b/crates/springtale-runtime/src/activity.rs
new file mode 100644
index 00000000..159daeb8
--- /dev/null
+++ b/crates/springtale-runtime/src/activity.rs
@@ -0,0 +1,85 @@
+//! When this runtime last did something a person asked for.
+//!
+//! The auto-lock timer (plan 6.10) fires after `auto_lock_secs` with "no
+//! authenticated request and no chat message". The two halves of that
+//! sentence live on opposite sides of the crate boundary — API requests
+//! are the daemon's business, inbound chat is the runtime's — so the
+//! shared stamp lives here, on `RuntimeState`, and both sides touch it.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicI64, Ordering};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// A shared "last active at" stamp, in whole seconds since the epoch.
+///
+/// Cheap to clone; every clone reads and writes the same instant.
+#[derive(Clone)]
+pub struct ActivityClock {
+    at: Arc<AtomicI64>,
+}
+
+impl Default for ActivityClock {
+    fn default() -> Self {
+        Self {
+            at: Arc::new(AtomicI64::new(now_secs())),
+        }
+    }
+}
+
+impl ActivityClock {
+    /// A clock stamped with the current instant.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Record activity now.
+    pub fn touch(&self) {
+        self.at.store(now_secs(), Ordering::Release);
+    }
+
+    /// Seconds since the last [`touch`](Self::touch). Saturates at zero
+    /// so a backwards clock step cannot report a negative idle time (and
+    /// so cannot delay an auto-lock).
+    pub fn idle_secs(&self) -> u64 {
+        let last = self.at.load(Ordering::Acquire);
+        now_secs().saturating_sub(last).max(0).unsigned_abs()
+    }
+}
+
+/// Seconds since the Unix epoch, or 0 if the system clock is before it.
+fn now_secs() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs() as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_fresh_clock_is_not_idle() {
+        assert_eq!(ActivityClock::new().idle_secs(), 0);
+    }
+
+    #[test]
+    fn test_touch_resets_idle() {
+        let clock = ActivityClock::new();
+        clock.at.store(now_secs() - 120, Ordering::Release);
+        assert!(clock.idle_secs() >= 120);
+        clock.touch();
+        assert_eq!(clock.idle_secs(), 0);
+    }
+
+    #[test]
+    fn test_clones_share_one_stamp() {
+        let clock = ActivityClock::new();
+        let other = clock.clone();
+        clock.at.store(now_secs() - 60, Ordering::Release);
+        assert!(other.idle_secs() >= 60);
+        other.touch();
+        assert_eq!(clock.idle_secs(), 0);
+    }
+}
diff --git a/crates/springtale-runtime/src/dispatch.rs b/crates/springtale-runtime/src/dispatch.rs
deleted file mode 100644
index b53f6b38..00000000
--- a/crates/springtale-runtime/src/dispatch.rs
+++ /dev/null
@@ -1,1265 +0,0 @@
-//! Shared rule-action dispatcher — executes matched rule actions.
-//!
-//! Both springtaled (daemon) and springtale-bot route action dispatch
-//! through this module. Per ARCHITECTURE.md §6.10, this is the single
-//! enforcement point that calls `sentinel.evaluate()` before every
-//! action.
-//!
-//! ## Phase 0 rework (chain context + real I/O)
-//!
-//! Pre-Phase-0 this module returned `Result<String, String>` and
-//! discarded step outputs between iterations. `Action::AiComplete`
-//! was a stub returning `"ai: noop"`. `Action::RunConnector` captured
-//! only the connector's plain-text `message` and dropped its
-//! structured `output: Value`. The net effect: ~12 shipped builtin
-//! recipes referenced `${last_ai_output}` / `${last_connector_output}`
-//! in their TOML, but the dispatcher had no path that resolved those
-//! placeholders — users received literal `${last_ai_output}` strings
-//! in their messaging channels.
-//!
-//! The new shape closes all four gaps:
-//!
-//! 1. Return type is `Result<ChainContext, ChainError>` —
-//!    `ChainContext` carries every step's typed `output`, the
-//!    `last_*_output` aliases, and the trigger payload. Callers read
-//!    it to surface results or persist to the executions log.
-//! 2. Before each step runs, action parameters are template-resolved
-//!    against the chain via [`resolve_chain_value`] — `${trigger.x}`,
-//!    `${last_ai_output}`, `${stepN.field}`, `${step.NAME.field}` all
-//!    bind to live values.
-//! 3. `RunConnector` captures the connector's `ActionResult.output`
-//!    (the structured JSON) into `StepOutput.output`, not just the
-//!    human message.
-//! 4. `AiComplete` calls the real adapter via
-//!    [`CapabilityBridge::ai_adapter_for`] — falls back to
-//!    `NoopAdapter` (clean error, not silent stubbing) when no
-//!    adapter is wired.
-//!
-//! Cooperation alignment: every dispatch carries an
-//! [`ExecutionContext`] from `springtale-cooperation::execution`, so
-//! the runtime knows which agent in which formation at which momentum
-//! tier is firing. The bridge consults the tier for capability
-//! routing (per-tier WASM `InstancePre` selection, §16). The sentinel
-//! consults the tier for rate-budget scaling: Cold = 1/30s, Warming =
-//! 12/min, Hot = 60/min, Fever = 600/min — the Phase 0.5 mapping in
-//! [`crate::cooperation::momentum_to_throttle_tier`].
-
-use std::sync::Arc;
-
-use springtale_ai::{AiOptions, AiRequest};
-use springtale_cooperation::execution::ExecutionContext;
-use springtale_core::rule::action::Action;
-use springtale_core::rule::template_resolve::{resolve_chain_template, resolve_chain_value};
-use springtale_core::rule::{ChainContext, ChainError, StepOutput};
-use springtale_sentinel::impact::ActionHints;
-use springtale_sentinel::sentinel::EvaluateRequest;
-use springtale_sentinel::{Sentinel, Verdict};
-
-use crate::cooperation::{CapabilityBridge, momentum_to_throttle_tier, momentum_to_wasm_tier};
-
-/// Maximum size for WriteFile action content (10 MiB).
-const MAX_WRITE_FILE_BYTES: usize = 10 * 1024 * 1024;
-
-/// Dispatch one top-level rule action with full chain-context
-/// threading. Returns the final [`ChainContext`] containing every
-/// recorded [`StepOutput`].
-///
-/// `trigger_payload` is the JSON the trigger fired with — referenced
-/// by recipe templates as `${trigger.path}`. Cron triggers pass
-/// `Value::Null`. Webhook / connector-event triggers pass the
-/// inbound payload.
-pub fn dispatch_action<'a>(
-    action: &'a Action,
-    bridge: &'a CapabilityBridge,
-    sentinel: &'a Arc<Sentinel>,
-    execution: ExecutionContext,
-    trigger_payload: serde_json::Value,
-) -> std::pin::Pin<
-    Box<dyn std::future::Future<Output = Result<ChainContext, ChainError>> + Send + 'a>,
-> {
-    dispatch_actions(
-        std::slice::from_ref(action),
-        bridge,
-        sentinel,
-        execution,
-        trigger_payload,
-    )
-}
-
-/// Dispatch a sequence of top-level actions as a single chain fire.
-/// Used by `trigger_dispatch` when a [`RuleMatch::actions`] holds
-/// `Vec<Action>` — each action becomes a step in the shared
-/// `ChainContext`, so `${last_*_output}` and `${stepN.*}` resolve
-/// across the whole rule.
-pub fn dispatch_actions<'a>(
-    actions: &'a [Action],
-    bridge: &'a CapabilityBridge,
-    sentinel: &'a Arc<Sentinel>,
-    execution: ExecutionContext,
-    trigger_payload: serde_json::Value,
-) -> std::pin::Pin<
-    Box<dyn std::future::Future<Output = Result<ChainContext, ChainError>> + Send + 'a>,
-> {
-    Box::pin(async move {
-        let recorder = bridge.recorder();
-        let trigger_summary = summarize_trigger(&trigger_payload, execution.mode);
-        // Best-effort recorder.begin — failures fall through to
-        // dispatch so the chain still runs. The privacy invariant
-        // is about NOT writing content; missing rows are fine.
-        if let Err(e) = recorder.begin(&execution, &trigger_summary, None).await {
-            tracing::warn!(error = %e, "executions recorder.begin failed");
-        }
-
-        let execution_id = execution.execution_id.to_string();
-        let mut chain = ChainContext::new(trigger_payload);
-        let mut steps_emitted = 0usize;
-        let mut final_status = springtale_store::schema::executions::ExecutionStatus::Succeeded;
-        let mut error_kind: Option<&'static str> = None;
-        let mut chain_outcome: Result<(), ChainError> = Ok(());
-
-        for action in actions {
-            match run_step(action, bridge, sentinel, &execution, &mut chain, 0).await {
-                Ok(()) => {
-                    // Record any new steps the action appended to
-                    // chain.steps. Chain action expands into
-                    // multiple sub-steps so we drain everything past
-                    // `steps_emitted`.
-                    while steps_emitted < chain.steps.len() {
-                        let step = &chain.steps[steps_emitted];
-                        if let Err(e) = recorder.record_step(&execution_id, step).await {
-                            tracing::warn!(error = %e, "executions recorder.record_step failed");
-                        }
-                        steps_emitted += 1;
-                    }
-                }
-                Err(ChainError::Suppressed) => {
-                    // Flush any steps that did run (dedupe step itself).
-                    while steps_emitted < chain.steps.len() {
-                        let step = &chain.steps[steps_emitted];
-                        if let Err(e) = recorder.record_step(&execution_id, step).await {
-                            tracing::warn!(error = %e, "executions recorder.record_step failed");
-                        }
-                        steps_emitted += 1;
-                    }
-                    final_status = springtale_store::schema::executions::ExecutionStatus::Empty;
-                    chain_outcome = Ok(());
-                    break;
-                }
-                Err(e) => {
-                    while steps_emitted < chain.steps.len() {
-                        let step = &chain.steps[steps_emitted];
-                        if let Err(rec_err) = recorder.record_step(&execution_id, step).await {
-                            tracing::warn!(error = %rec_err, "executions recorder.record_step failed");
-                        }
-                        steps_emitted += 1;
-                    }
-                    final_status = springtale_store::schema::executions::ExecutionStatus::Failed;
-                    error_kind = Some(classify_chain_error(&e));
-                    chain_outcome = Err(e);
-                    break;
-                }
-            }
-        }
-
-        if let Err(e) = recorder
-            .finish(&execution_id, final_status, error_kind)
-            .await
-        {
-            tracing::warn!(error = %e, "executions recorder.finish failed");
-        }
-
-        match chain_outcome {
-            Ok(()) => Ok(chain),
-            Err(e) => Err(e),
-        }
-    })
-}
-
-/// Build a short summary string the executions log records for the
-/// firing trigger. Sized for a status line — no payload, just the
-/// kind + the obvious discriminator.
-fn summarize_trigger(
-    trigger: &serde_json::Value,
-    mode: springtale_cooperation::execution::ExecutionMode,
-) -> String {
-    use springtale_cooperation::execution::ExecutionMode as M;
-    match mode {
-        M::Cron => trigger
-            .get("expression")
-            .and_then(|v| v.as_str())
-            .map(|e| format!("Cron {e}"))
-            .unwrap_or_else(|| "Cron".to_owned()),
-        M::Webhook => "Webhook".to_owned(),
-        M::ConnectorEvent => trigger
-            .get("trigger_name")
-            .and_then(|v| v.as_str())
-            .map(|t| format!("Event {t}"))
-            .unwrap_or_else(|| "ConnectorEvent".to_owned()),
-        M::FileWatch => "FileWatch".to_owned(),
-        M::Manual => "Manual".to_owned(),
-        M::Cooperation => "Cooperation".to_owned(),
-        M::Retry => "Retry".to_owned(),
-        M::DryRun => "DryRun".to_owned(),
-    }
-}
-
-/// Map a chain error to the same enum-tag set the recorder writes
-/// for step errors. Keeps the audit trail consistent — privacy
-/// invariant says no full messages reach the DB.
-fn classify_chain_error(err: &ChainError) -> &'static str {
-    match err {
-        ChainError::Suppressed => "suppressed",
-        ChainError::StepNotYetRun(_) => "template_step_unresolved",
-        ChainError::StepNameNotFound(_) => "template_name_unresolved",
-        ChainError::DuplicateStepName(_) => "template_duplicate_name",
-        ChainError::DepthExceeded { .. } => "chain_depth_exceeded",
-        ChainError::StepFailed { .. } => "step_failed",
-        ChainError::Template(_) => "template_invalid",
-    }
-}
-
-/// Run one action against the chain. Recursive — `Action::Chain`
-/// expands into multiple sub-steps that all share the chain context.
-fn run_step<'a>(
-    action: &'a Action,
-    bridge: &'a CapabilityBridge,
-    sentinel: &'a Arc<Sentinel>,
-    execution: &'a ExecutionContext,
-    chain: &'a mut ChainContext,
-    depth: u32,
-) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<(), ChainError>> + Send + 'a>> {
-    Box::pin(run_step_inner(
-        action, bridge, sentinel, execution, chain, depth,
-    ))
-}
-
-async fn run_step_inner(
-    action: &Action,
-    bridge: &CapabilityBridge,
-    sentinel: &Arc<Sentinel>,
-    execution: &ExecutionContext,
-    chain: &mut ChainContext,
-    depth: u32,
-) -> Result<(), ChainError> {
-    let run_id = execution.execution_id.to_string();
-
-    // ── Sentinel ─────────────────────────────────────────────────
-    // Throw the (unresolved) action at sentinel for connector-name
-    // routing only — the resolver below produces the executable
-    // version. Sentinel doesn't read action parameters; it reads the
-    // connector name, the manifest's advisory hints for the named
-    // action, and the envelope's policy / autonomy.
-    let connector_name = match action {
-        Action::RunConnector { connector, .. } => connector.as_str(),
-        _ => "system",
-    };
-    let throttle_tier = momentum_to_throttle_tier(execution.momentum);
-    let hints = if let Action::RunConnector {
-        connector,
-        action: name,
-        ..
-    } = action
-    {
-        let reg = bridge.registry().read().await;
-        reg.get(connector)
-            .and_then(|e| e.host.actions().iter().find(|d| d.name == *name).cloned())
-            .map(|d| ActionHints {
-                read_only: d.read_only,
-                destructive: d.destructive,
-            })
-    } else {
-        None
-    };
-    let action_name = if let Action::RunConnector { action: name, .. } = action {
-        Some(name.as_str())
-    } else {
-        None
-    };
-    let verdict = sentinel
-        .evaluate(EvaluateRequest {
-            action,
-            connector_name,
-            tier: throttle_tier,
-            hints,
-            action_name,
-            policy: execution.policy,
-            autonomy: execution.autonomy,
-            origin: execution.origin.as_ref(),
-        })
-        .await;
-    match verdict {
-        Verdict::Go => {}
-        Verdict::Throttle(duration) => {
-            tracing::info!(
-                connector = connector_name,
-                delay_ms = duration.as_millis() as u64,
-                "sentinel: throttling action"
-            );
-            chain.throttles += 1;
-            tokio::time::sleep(duration).await;
-        }
-        Verdict::Pause(reason) => {
-            return Err(ChainError::StepFailed {
-                index: chain.next_step_index(),
-                kind: action_kind(action).into(),
-                message: format!("sentinel paused: {reason}"),
-            });
-        }
-        Verdict::Quarantine(reason) => {
-            return Err(ChainError::StepFailed {
-                index: chain.next_step_index(),
-                kind: action_kind(action).into(),
-                message: format!("sentinel quarantined: {reason}"),
-            });
-        }
-    }
-
-    let kind = action_kind(action);
-    let started = std::time::Instant::now();
-    let dry_run = matches!(
-        execution.mode,
-        springtale_cooperation::execution::ExecutionMode::DryRun
-    );
-
-    // ── Action arm dispatch ─────────────────────────────────────
-    let outcome: Result<StepOutput, ChainError> = match action {
-        Action::RunConnector {
-            connector,
-            action: action_name,
-            params,
-        } => {
-            // Resolve `${trigger.*}` / `${last_*_output.*}` /
-            // `${stepN.*}` in every param string before handing to
-            // the connector.
-            let raw = serde_json::Value::Object(params.clone());
-            let resolved = resolve_chain_value(&raw, chain, Some(&run_id));
-            let input = resolved;
-
-            // Dry-run stubs side-effecting connector actions but
-            // lets read-only actions (HTTP get, browser navigate,
-            // extract_text, etc.) run for real — that's the whole
-            // point of "Test This Step": fetch real upstream data
-            // to validate downstream rendering without spamming
-            // the destination channel.
-            if dry_run && is_side_effecting_action(action_name) {
-                tracing::info!(
-                    connector = %connector,
-                    action = %action_name,
-                    "DRY RUN — side-effecting connector action stubbed"
-                );
-                let step = StepOutput {
-                    index: chain.next_step_index(),
-                    kind: kind.into(),
-                    name: None,
-                    output: serde_json::json!({
-                        "success": true,
-                        "message": format!(
-                            "dry-run: would call {connector}.{action_name}"
-                        ),
-                        "output": {
-                            "connector": connector,
-                            "action": action_name,
-                            "params": input,
-                        },
-                        "dry_run": true,
-                    }),
-                    duration_ms: started.elapsed().as_millis() as u64,
-                    error: None,
-                };
-                chain.record_step(step);
-                sentinel.report_success(connector_name);
-                return Ok(());
-            }
-
-            let effective_tier = momentum_to_wasm_tier(execution.momentum);
-            let exec = bridge
-                .execute_with_origin(
-                    connector,
-                    action_name,
-                    input,
-                    effective_tier,
-                    execution.origin.clone(),
-                )
-                .await;
-            match exec {
-                Ok(result) => {
-                    tracing::info!(
-                        connector = %connector,
-                        action = %action_name,
-                        success = result.success,
-                        "connector action executed"
-                    );
-                    let index = chain.next_step_index();
-                    // Capture both the structured output AND the
-                    // human message so downstream templates can read
-                    // either. `output` keys exposed in the chain
-                    // alias: `last_connector_output.output.*` is the
-                    // structured data, `last_connector_output.message`
-                    // is the plain-text result.
-                    let payload = serde_json::json!({
-                        "success": result.success,
-                        "message": result.message,
-                        "output": result.output,
-                    });
-                    Ok(StepOutput {
-                        index,
-                        kind: kind.into(),
-                        name: None,
-                        output: payload,
-                        duration_ms: started.elapsed().as_millis() as u64,
-                        error: None,
-                    })
-                }
-                Err(e) => {
-                    tracing::warn!(
-                        connector = %connector,
-                        action = %action_name,
-                        error = %e,
-                        "connector action failed"
-                    );
-                    Err(ChainError::StepFailed {
-                        index: chain.next_step_index(),
-                        kind: kind.into(),
-                        message: e.to_string(),
-                    })
-                }
-            }
-        }
-
-        Action::Notify { title, body } => {
-            let resolved_title = resolve_chain_template(title, chain, Some(&run_id));
-            let resolved_body = resolve_chain_template(body, chain, Some(&run_id));
-            if dry_run {
-                tracing::info!(
-                    title = %resolved_title,
-                    "DRY RUN — Notify stubbed"
-                );
-            } else {
-                tracing::info!(title = %resolved_title, body = %resolved_body, "NOTIFICATION");
-            }
-            Ok(StepOutput {
-                index: chain.next_step_index(),
-                kind: kind.into(),
-                name: None,
-                output: serde_json::json!({
-                    "title": resolved_title,
-                    "body": resolved_body,
-                    "dry_run": dry_run,
-                }),
-                duration_ms: started.elapsed().as_millis() as u64,
-                error: None,
-            })
-        }
-
-        Action::SendMessage { text } => {
-            let resolved = resolve_chain_template(text, chain, Some(&run_id));
-            if dry_run {
-                tracing::info!(text_len = resolved.len(), "DRY RUN — SendMessage stubbed");
-            } else {
-                tracing::info!(text = %resolved, "SendMessage (no destination context)");
-            }
-            Ok(StepOutput {
-                index: chain.next_step_index(),
-                kind: kind.into(),
-                name: None,
-                output: serde_json::json!({
-                    "text": resolved,
-                    "dry_run": dry_run,
-                }),
-                duration_ms: started.elapsed().as_millis() as u64,
-                error: None,
-            })
-        }
-
-        Action::WriteFile {
-            destination,
-            content,
-            delete_source: _,
-        } => {
-            let resolved_destination = resolve_chain_template(destination, chain, Some(&run_id));
-            let resolved_content = resolve_chain_template(content, chain, Some(&run_id));
-
-            if resolved_content.len() > MAX_WRITE_FILE_BYTES {
-                return Err(ChainError::StepFailed {
-                    index: chain.next_step_index(),
-                    kind: kind.into(),
-                    message: format!(
-                        "file content size ({} bytes) exceeds maximum ({MAX_WRITE_FILE_BYTES} bytes)",
-                        resolved_content.len()
-                    ),
-                });
-            }
-            let path = std::path::Path::new(&resolved_destination);
-            if !path.is_absolute() {
-                return Err(ChainError::StepFailed {
-                    index: chain.next_step_index(),
-                    kind: kind.into(),
-                    message: "WriteFile requires absolute path".to_string(),
-                });
-            }
-            if path
-                .components()
-                .any(|c| matches!(c, std::path::Component::ParentDir))
-            {
-                return Err(ChainError::StepFailed {
-                    index: chain.next_step_index(),
-                    kind: kind.into(),
-                    message: "WriteFile path must not contain '..'".to_string(),
-                });
-            }
-            if dry_run {
-                tracing::info!(
-                    path = %resolved_destination,
-                    bytes = resolved_content.len(),
-                    "DRY RUN — WriteFile stubbed"
-                );
-            } else {
-                tokio::fs::write(&resolved_destination, &resolved_content)
-                    .await
-                    .map_err(|e| ChainError::StepFailed {
-                        index: chain.next_step_index(),
-                        kind: kind.into(),
-                        message: format!("failed to write file {resolved_destination}: {e}"),
-                    })?;
-                tracing::info!(path = %resolved_destination, "file written");
-            }
-            Ok(StepOutput {
-                index: chain.next_step_index(),
-                kind: kind.into(),
-                name: None,
-                output: serde_json::json!({
-                    "path": resolved_destination,
-                    "bytes": resolved_content.len(),
-                    "dry_run": dry_run,
-                }),
-                duration_ms: started.elapsed().as_millis() as u64,
-                error: None,
-            })
-        }
-
-        Action::RunShell { command } => {
-            let resolved = resolve_chain_template(command, chain, Some(&run_id));
-            // ShellExec requires capability approval flow — actual
-            // execution is gated outside the dispatcher. The
-            // dispatcher records the request so the capability layer
-            // and audit trail see it.
-            tracing::info!(
-                command = %resolved,
-                "SHELL (not executed — requires ShellExec approval)"
-            );
-            Ok(StepOutput {
-                index: chain.next_step_index(),
-                kind: kind.into(),
-                name: None,
-                output: serde_json::json!({
-                    "command": resolved,
-                    "executed": false,
-                    "reason": "ShellExec capability gate",
-                }),
-                duration_ms: started.elapsed().as_millis() as u64,
-                error: None,
-            })
-        }
-
-        Action::Delay { seconds } => {
-            if dry_run {
-                tracing::info!(seconds = seconds, "DRY RUN — Delay stubbed");
-            } else {
-                tokio::time::sleep(std::time::Duration::from_secs(*seconds)).await;
-                tracing::debug!(seconds = seconds, "delay completed");
-            }
-            Ok(StepOutput {
-                index: chain.next_step_index(),
-                kind: kind.into(),
-                name: None,
-                output: serde_json::json!({ "seconds": seconds }),
-                duration_ms: started.elapsed().as_millis() as u64,
-                error: None,
-            })
-        }
-
-        Action::Chain { steps } => {
-            let new_depth = depth + 1;
-            if new_depth > springtale_core::rule::action::MAX_CHAIN_DEPTH {
-                return Err(ChainError::DepthExceeded {
-                    depth: new_depth,
-                    max: springtale_core::rule::action::MAX_CHAIN_DEPTH,
-                });
-            }
-            // Chain expands transparently — each sub-step is recorded
-            // as its own StepOutput in the shared ChainContext. The
-            // Chain action itself doesn't produce a wrapper step.
-            for (i, step) in steps.iter().enumerate() {
-                match run_step(step, bridge, sentinel, execution, chain, new_depth).await {
-                    Ok(()) => {}
-                    Err(ChainError::Suppressed) => {
-                        // A nested dedupe step suppressed the chain —
-                        // propagate cleanly so the outer caller can
-                        // mark execution status `empty`.
-                        return Err(ChainError::Suppressed);
-                    }
-                    Err(e) => {
-                        tracing::warn!(step = i, error = %e, "chain step failed");
-                        return Err(e);
-                    }
-                }
-            }
-            // Chain returns without recording its own StepOutput —
-            // sub-steps are already in chain.steps.
-            //
-            // Skip the post-step alias refresh path below: we already
-            // returned the sub-steps individually.
-            sentinel.report_success(connector_name);
-            return Ok(());
-        }
-
-        Action::Transform { operation, params } => {
-            // Transform is a placeholder today — operation-specific
-            // implementations land in Phase A (the extraction ladder
-            // replaces most Transform use cases). For now we record
-            // the transform request so the chain context surfaces it.
-            tracing::debug!(operation = %operation, "transform pass-through");
-            Ok(StepOutput {
-                index: chain.next_step_index(),
-                kind: kind.into(),
-                name: None,
-                output: serde_json::json!({
-                    "operation": operation,
-                    "params": params,
-                }),
-                duration_ms: started.elapsed().as_millis() as u64,
-                error: None,
-            })
-        }
-
-        Action::AiComplete { prompt, .. } => {
-            // Resolve `${...}` placeholders in the prompt before the
-            // model sees it. Critical: this is how `${last_connector_output}`
-            // ends up in the prompt for "summarize this fetched
-            // body" recipes.
-            //
-            // OWASP LLM01:2025 indirect-injection guard: every
-            // substituted value is wrapped in `<external_context>` tags
-            // by the AI-specific resolver, and the rule explaining the
-            // tags is prepended to the system prompt. The model
-            // therefore sees both (a) explicit instructions that the
-            // tagged content is untrusted data, and (b) the tagged
-            // values themselves.
-            let resolved_user_prompt =
-                springtale_core::rule::template_resolve::resolve_chain_template_for_ai(
-                    prompt,
-                    chain,
-                    Some(&run_id),
-                );
-            let resolved_prompt = format!(
-                "{rule}\n\n{prompt}",
-                rule = springtale_core::rule::template_resolve::AI_EXTERNAL_CONTEXT_RULE,
-                prompt = resolved_user_prompt,
-            );
-
-            // Route through the bridge — falls back to NoopAdapter
-            // when no adapter is wired. NoopAdapter returns
-            // `AiError::Disabled`, which we surface as a step error
-            // (not a silent stub).
-            let adapter_arc = bridge.ai_adapter_for(execution).await;
-            let request = AiRequest::Complete {
-                prompt: resolved_prompt.clone(),
-            };
-            let options = AiOptions::default();
-            let response = adapter_arc.complete(request, options).await;
-            match response {
-                Ok(ai_response) => {
-                    tracing::debug!(
-                        prompt_len = resolved_prompt.len(),
-                        content_len = ai_response.content.len(),
-                        finish_reason = ?ai_response.finish_reason,
-                        "AI complete"
-                    );
-                    Ok(StepOutput {
-                        index: chain.next_step_index(),
-                        kind: kind.into(),
-                        name: None,
-                        output: serde_json::json!({
-                            "text": ai_response.content,
-                            "finish_reason": ai_response.finish_reason,
-                        }),
-                        duration_ms: started.elapsed().as_millis() as u64,
-                        error: None,
-                    })
-                }
-                Err(e) => {
-                    tracing::warn!(error = %e, "AI complete failed");
-                    Err(ChainError::StepFailed {
-                        index: chain.next_step_index(),
-                        kind: kind.into(),
-                        message: e.to_string(),
-                    })
-                }
-            }
-        }
-
-        Action::Extract {
-            source,
-            kind: extract_kind,
-        } => {
-            // Resolve `source` as a path against the chain — e.g.
-            // `"last_connector_output.body"` → the HTTP body string,
-            // or `"trigger.payload"` → the trigger event JSON.
-            let resolved_source = resolve_chain_value(
-                &serde_json::Value::String(format!("${{{source}}}")),
-                chain,
-                Some(&run_id),
-            );
-
-            // The AI adapter for LlmSchema extraction. We pass it
-            // through opt-in — Phase A only fires non-LLM tiers;
-            // Phase B activates LlmSchema and the adapter is read.
-            let adapter_arc = bridge.ai_adapter_for(execution).await;
-            let ai_ref: Option<&dyn springtale_ai::AiAdapter> = Some(&*adapter_arc);
-
-            let extracted =
-                crate::extraction::extract(&resolved_source, extract_kind, ai_ref).await;
-            match extracted {
-                Ok(value) => Ok(StepOutput {
-                    index: chain.next_step_index(),
-                    kind: kind.into(),
-                    name: None,
-                    output: value,
-                    duration_ms: started.elapsed().as_millis() as u64,
-                    error: None,
-                }),
-                Err(e) => Err(ChainError::StepFailed {
-                    index: chain.next_step_index(),
-                    kind: kind.into(),
-                    message: e.to_string(),
-                }),
-            }
-        }
-
-        Action::Dedupe {
-            key,
-            bucket,
-            history,
-        } => {
-            // Resolve key + bucket templates against the chain.
-            let resolved_key = resolve_chain_template(key, chain, Some(&run_id));
-            let resolved_bucket = resolve_chain_template(bucket, chain, Some(&run_id));
-
-            // Bridge holds the store handle. Test builds without a
-            // store wired fall through to "fresh" (the default impl
-            // on the StorageBackend trait) so dispatcher tests don't
-            // need a real DB just to exercise non-dedupe arms.
-            let formation_id = execution.formation_id.map(|f| f.0.to_string());
-            let rule_id = execution.rule_id.0.to_string();
-
-            // Dry-run: never write to the dedupe table. We want
-            // Test This Step to render the downstream steps as
-            // if the data were fresh — without polluting the
-            // real dedupe state for the next production fire.
-            let outcome = if dry_run {
-                springtale_store::schema::dedupe::DedupeOutcome::Fresh
-            } else {
-                match bridge.store() {
-                    Some(store) => crate::dedupe::check_and_record(
-                        store,
-                        formation_id.as_deref(),
-                        &rule_id,
-                        &resolved_bucket,
-                        &resolved_key,
-                        *history,
-                    )
-                    .await
-                    .map_err(|e| ChainError::StepFailed {
-                        index: chain.next_step_index(),
-                        kind: kind.into(),
-                        message: e.to_string(),
-                    })?,
-                    None => springtale_store::schema::dedupe::DedupeOutcome::Fresh,
-                }
-            };
-
-            // SeenBefore short-circuits the chain. The Chain runner
-            // arm above catches `ChainError::Suppressed` and ends
-            // the execution cleanly with status `empty`.
-            if matches!(
-                outcome,
-                springtale_store::schema::dedupe::DedupeOutcome::SeenBefore
-            ) {
-                tracing::info!(
-                    rule = %rule_id,
-                    bucket = %resolved_bucket,
-                    "dedupe: key seen before — chain suppressed"
-                );
-                return Err(ChainError::Suppressed);
-            }
-
-            Ok(StepOutput {
-                index: chain.next_step_index(),
-                kind: kind.into(),
-                name: None,
-                output: serde_json::json!({
-                    "outcome": "fresh",
-                    "bucket": resolved_bucket,
-                    "dry_run": dry_run,
-                }),
-                duration_ms: started.elapsed().as_millis() as u64,
-                error: None,
-            })
-        }
-    };
-
-    // ── Record outcome + sentinel report ────────────────────────
-    match outcome {
-        Ok(step) => {
-            chain.record_step(step);
-            sentinel.report_success(connector_name);
-            Ok(())
-        }
-        Err(e) => {
-            sentinel.report_failure(connector_name);
-            Err(e)
-        }
-    }
-}
-
-/// Stable kind tag the dispatcher writes into [`StepOutput::kind`].
-/// Mirrors the [`Action`] variant discriminant so chain-context
-/// readers can filter by kind without re-matching the original
-/// variant.
-fn action_kind(action: &Action) -> &'static str {
-    match action {
-        Action::RunConnector { .. } => "run_connector",
-        Action::SendMessage { .. } => "send_message",
-        Action::WriteFile { .. } => "write_file",
-        Action::RunShell { .. } => "run_shell",
-        Action::Notify { .. } => "notify",
-        Action::Chain { .. } => "chain",
-        Action::Transform { .. } => "transform",
-        Action::Delay { .. } => "delay",
-        Action::AiComplete { .. } => "ai_complete",
-        Action::Extract { .. } => "extract",
-        Action::Dedupe { .. } => "dedupe",
-    }
-}
-
-/// Classify a connector action name as side-effecting. Used by the
-/// DryRun dispatcher path: side-effecting actions are stubbed
-/// (return a "would have done X" StepOutput); read-only actions
-/// run for real so Test This Step shows realistic upstream data.
-///
-/// The heuristic is verb-prefix based — connector authors who add
-/// new write actions just need to use a recognizable prefix.
-/// First-party connectors today: `send_message`, `post_*`,
-/// `write_*`, `create_*`, `delete_*`, `update_*`, `publish_*`,
-/// `commit_*`, `push_*`, `react`, `dispatch`, `react_to_message`,
-/// `set_*` (config writes). Read-side actions use `get_*`, `list_*`,
-/// `read_*`, `fetch_*`, `search_*`, `query_*`, `wait_*`, plus the
-/// browser primitives `navigate`, `evaluate`, `screenshot`,
-/// `extract_text`, `get_html`, `query_all`, `fill_form`, `click`.
-///
-/// `fill_form` + `click` are ambiguous — they mutate page state but
-/// don't reach external systems. We classify them as read-only
-/// (false) so chained recipes like "navigate → fill_form → click →
-/// extract_text" produce useful Test This Step output. Connectors
-/// that ship truly destructive actions under those names should
-/// rename them.
-fn is_side_effecting_action(name: &str) -> bool {
-    const WRITE_PREFIXES: &[&str] = &[
-        "send_",
-        "post_",
-        "write_",
-        "create_",
-        "delete_",
-        "remove_",
-        "update_",
-        "publish_",
-        "commit_",
-        "push_",
-        "dispatch_",
-        "set_",
-        "ban_",
-        "kick_",
-        "mute_",
-        "broadcast_",
-        "react_",
-        "reply_",
-        "subscribe_",
-        "unsubscribe_",
-        "approve_",
-        "deny_",
-    ];
-    const WRITE_EXACT: &[&str] = &[
-        "send",
-        "post",
-        "write",
-        "publish",
-        "commit",
-        "react",
-        "react_to_message",
-        "dispatch",
-        "ban",
-        "kick",
-        "mute",
-    ];
-    if WRITE_EXACT.contains(&name) {
-        return true;
-    }
-    WRITE_PREFIXES.iter().any(|p| name.starts_with(p))
-}
-
-#[cfg(test)]
-mod side_effect_tests {
-    use super::is_side_effecting_action;
-
-    #[test]
-    fn send_message_is_side_effecting() {
-        assert!(is_side_effecting_action("send_message"));
-    }
-
-    #[test]
-    fn get_is_read_only() {
-        assert!(!is_side_effecting_action("get"));
-        assert!(!is_side_effecting_action("get_html"));
-        assert!(!is_side_effecting_action("list_repos"));
-    }
-
-    #[test]
-    fn browser_navigation_is_read_only() {
-        assert!(!is_side_effecting_action("navigate"));
-        assert!(!is_side_effecting_action("evaluate"));
-        assert!(!is_side_effecting_action("screenshot"));
-        assert!(!is_side_effecting_action("query_all"));
-        assert!(!is_side_effecting_action("wait_for_selector"));
-        assert!(!is_side_effecting_action("extract_text"));
-    }
-
-    #[test]
-    fn write_prefixes_are_side_effecting() {
-        for name in [
-            "post_status",
-            "write_file",
-            "create_issue",
-            "delete_message",
-            "update_repo",
-            "publish_release",
-            "commit_change",
-            "push_branch",
-            "set_config",
-            "ban_user",
-            "kick_member",
-            "mute_user",
-        ] {
-            assert!(
-                is_side_effecting_action(name),
-                "expected {name} to be side-effecting"
-            );
-        }
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::expect_used)]
-mod tests {
-    use super::*;
-    use springtale_cooperation::execution::{
-        ExecutionContext as CoopExecutionContext, ExecutionMode as CoopExecutionMode,
-    };
-    use springtale_store::SqliteBackend;
-    use springtale_store::backend::StorageBackend;
-    use springtale_store::schema::executions::ExecutionFilter;
-    use std::sync::Arc;
-
-    /// Build a bridge wired against an in-memory SqliteBackend with
-    /// a real StoreRecorder — used by tests that assert on
-    /// executions-log rows after a chain runs.
-    fn bridge_with_recorded_store() -> (CapabilityBridge, Arc<dyn StorageBackend>) {
-        let store: Arc<dyn StorageBackend> = Arc::new(SqliteBackend::open_in_memory().unwrap());
-        let recorder: Arc<dyn crate::operations::executions::ExecutionRecorder> = Arc::new(
-            crate::operations::executions::StoreRecorder::new(store.clone()),
-        );
-        let registry = Arc::new(tokio::sync::RwLock::new(
-            springtale_connector::registry::store::ConnectorRegistry::default(),
-        ));
-        let bridge = CapabilityBridge::new(registry)
-            .with_store(store.clone())
-            .with_recorder(recorder);
-        (bridge, store)
-    }
-
-    fn manual_execution_ctx() -> CoopExecutionContext {
-        CoopExecutionContext::for_global(
-            springtale_core::rule::types::RuleId::new(),
-            CoopExecutionMode::Manual,
-        )
-    }
-
-    #[tokio::test]
-    async fn dispatch_records_execution_and_step_rows() {
-        let (bridge, store) = bridge_with_recorded_store();
-        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
-            springtale_sentinel::SentinelConfig::default(),
-            store.clone(),
-        ));
-        let execution = manual_execution_ctx();
-        let exec_id = execution.execution_id.to_string();
-
-        // SendMessage: simplest non-network action — produces one step.
-        let action = Action::SendMessage {
-            text: "hello".into(),
-        };
-        let chain = dispatch_action(
-            &action,
-            &bridge,
-            &sentinel,
-            execution,
-            serde_json::Value::Null,
-        )
-        .await
-        .unwrap();
-        assert_eq!(chain.steps.len(), 1);
-
-        // executions row recorded.
-        let list = store
-            .list_executions(ExecutionFilter::default())
-            .await
-            .unwrap();
-        assert_eq!(list.len(), 1);
-        assert_eq!(list[0].id, exec_id);
-        assert_eq!(
-            list[0].status,
-            springtale_store::schema::executions::ExecutionStatus::Succeeded
-        );
-        assert_eq!(
-            list[0].mode,
-            springtale_store::schema::executions::ExecutionMode::Manual
-        );
-
-        // execution_steps row recorded with sizes only.
-        let steps = store.get_execution_steps(&exec_id).await.unwrap();
-        assert_eq!(steps.len(), 1);
-        assert_eq!(steps[0].step_kind, "send_message");
-        assert!(steps[0].output_bytes > 0, "output_bytes captured size");
-        assert!(
-            steps[0].input_blob_ref.is_none() && steps[0].output_blob_ref.is_none(),
-            "privacy default: no content retained"
-        );
-    }
-
-    #[tokio::test]
-    async fn dispatch_dry_run_stubs_sendmessage_and_returns_dry_run_flag() {
-        let (bridge, store) = bridge_with_recorded_store();
-        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
-            springtale_sentinel::SentinelConfig::default(),
-            store.clone(),
-        ));
-        let execution = CoopExecutionContext::for_global(
-            springtale_core::rule::types::RuleId::new(),
-            CoopExecutionMode::DryRun,
-        );
-
-        let action = Action::SendMessage {
-            text: "would have sent this".into(),
-        };
-        let chain = dispatch_action(
-            &action,
-            &bridge,
-            &sentinel,
-            execution,
-            serde_json::Value::Null,
-        )
-        .await
-        .unwrap();
-
-        assert_eq!(chain.steps.len(), 1);
-        let step = &chain.steps[0];
-        assert_eq!(step.kind, "send_message");
-        assert_eq!(
-            step.output.get("dry_run").and_then(|v| v.as_bool()),
-            Some(true)
-        );
-
-        // Executions log captured the run in DryRun mode.
-        let runs = store
-            .list_executions(ExecutionFilter::default())
-            .await
-            .unwrap();
-        assert_eq!(runs.len(), 1);
-        assert_eq!(
-            runs[0].mode,
-            springtale_store::schema::executions::ExecutionMode::DryRun
-        );
-    }
-
-    #[tokio::test]
-    async fn dispatch_records_failure_status_on_step_failure() {
-        // WriteFile with a relative path is rejected at the
-        // dispatcher's pre-flight — yields a StepFailed chain error.
-        let (bridge, store) = bridge_with_recorded_store();
-        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
-            springtale_sentinel::SentinelConfig::default(),
-            store.clone(),
-        ));
-        let execution = manual_execution_ctx();
-        let exec_id = execution.execution_id.to_string();
-
-        let action = Action::WriteFile {
-            destination: "relative.txt".into(),
-            content: "data".into(),
-            delete_source: false,
-        };
-        let result = dispatch_action(
-            &action,
-            &bridge,
-            &sentinel,
-            execution,
-            serde_json::Value::Null,
-        )
-        .await;
-        assert!(result.is_err());
-
-        let list = store
-            .list_executions(ExecutionFilter::default())
-            .await
-            .unwrap();
-        assert_eq!(list.len(), 1);
-        assert_eq!(
-            list[0].status,
-            springtale_store::schema::executions::ExecutionStatus::Failed,
-            "WriteFile rejected → executions row marked failed"
-        );
-        assert_eq!(list[0].error_kind.as_deref(), Some("step_failed"));
-        let _ = exec_id; // unused but kept for parallel-with-success test
-    }
-
-    /// Minimal native connector whose single action declares no
-    /// `destructive` hint — the "unknown hint" case the sentinel must
-    /// treat as destructive (MCP `destructiveHint` default `true`).
-    struct HintlessConnector {
-        manifest: springtale_connector::manifest::types::ConnectorManifest,
-    }
-
-    impl HintlessConnector {
-        fn new(name: &str) -> Self {
-            use springtale_connector::manifest::SignatureAlgorithm;
-            use springtale_connector::manifest::types::{
-                ActionDecl, Capability, ConnectorManifest, TriggerDecl,
-            };
-            Self {
-                manifest: ConnectorManifest {
-                    name: name.to_owned(),
-                    version: "0.1.0".into(),
-                    author: "test".into(),
-                    description: "hintless".into(),
-                    capabilities: vec![Capability::NetworkOutbound {
-                        host: "api.example.com".into(),
-                    }],
-                    triggers: vec![TriggerDecl {
-                        name: "test_event".into(),
-                        description: "test".into(),
-                        schema: None,
-                    }],
-                    actions: vec![ActionDecl {
-                        read_only: false,
-                        destructive: None,
-                        poll_interval_secs: None,
-                        name: "echo".into(),
-                        description: "echo".into(),
-                        input_schema: None,
-                        output_schema: None,
-                    }],
-                    data_disclosure: vec![],
-                    roles: vec![],
-                    wasm_hash: None,
-                    signature_alg: SignatureAlgorithm::default(),
-                    signature: None,
-                },
-            }
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl springtale_connector::connector::trait_::Connector for HintlessConnector {
-        fn triggers(&self) -> &[springtale_connector::manifest::types::TriggerDecl] {
-            &self.manifest.triggers
-        }
-        fn actions(&self) -> &[springtale_connector::manifest::types::ActionDecl] {
-            &self.manifest.actions
-        }
-        async fn execute(
-            &self,
-            action: &str,
-            input: serde_json::Value,
-        ) -> Result<
-            springtale_connector::connector::trait_::ActionResult,
-            springtale_connector::ConnectorError,
-        > {
-            Ok(springtale_connector::connector::trait_::ActionResult {
-                success: true,
-                output: serde_json::json!({"echoed": input, "action": action}),
-                message: "ok".into(),
-            })
-        }
-        async fn on_event(
-            &self,
-            trigger: &str,
-            _handler: springtale_connector::connector::trait_::EventHandler,
-        ) -> Result<
-            springtale_connector::connector::subscription::Subscription,
-            springtale_connector::ConnectorError,
-        > {
-            Ok(
-                springtale_connector::connector::subscription::Subscription {
-                    id: springtale_connector::connector::subscription::SubscriptionId(0),
-                    trigger: trigger.to_owned(),
-                },
-            )
-        }
-        async fn remove_event(
-            &self,
-            _sub: &springtale_connector::connector::subscription::Subscription,
-        ) -> Result<(), springtale_connector::ConnectorError> {
-            Ok(())
-        }
-        fn manifest(&self) -> &springtale_connector::manifest::types::ConnectorManifest {
-            &self.manifest
-        }
-    }
-
-    #[tokio::test]
-    async fn dispatch_quarantines_hintless_connector_action_under_default_deny() {
-        let store: Arc<dyn StorageBackend> = Arc::new(SqliteBackend::open_in_memory().unwrap());
-        let mut registry = springtale_connector::registry::store::ConnectorRegistry::new(
-            springtale_connector::capability::grant::CapabilityPolicy::AllowAll,
-        );
-        registry
-            .install_native(Box::new(HintlessConnector::new("hintless")))
-            .unwrap();
-        let bridge = CapabilityBridge::new(Arc::new(tokio::sync::RwLock::new(registry)))
-            .with_store(store.clone());
-        // `Sentinel::new` wires `DefaultDenyApprovalGate`.
-        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
-            springtale_sentinel::SentinelConfig::default(),
-            store.clone(),
-        ));
-        let execution = manual_execution_ctx();
-
-        let action = Action::RunConnector {
-            connector: "hintless".into(),
-            action: "echo".into(),
-            params: serde_json::Map::new(),
-        };
-        let err = dispatch_action(
-            &action,
-            &bridge,
-            &sentinel,
-            execution,
-            serde_json::Value::Null,
-        )
-        .await
-        .unwrap_err();
-        assert!(
-            matches!(&err, ChainError::StepFailed { message, .. } if message.contains("quarantined")),
-            "expected sentinel quarantine, got {err:?}"
-        );
-    }
-}
diff --git a/crates/springtale-runtime/src/dispatch/chain.rs b/crates/springtale-runtime/src/dispatch/chain.rs
new file mode 100644
index 00000000..e000a933
--- /dev/null
+++ b/crates/springtale-runtime/src/dispatch/chain.rs
@@ -0,0 +1,58 @@
+//! The `Action::Chain` arm — sub-step expansion inside one shared
+//! [`ChainContext`].
+
+use std::sync::Arc;
+
+use springtale_cooperation::execution::ExecutionContext;
+use springtale_core::rule::action::Action;
+use springtale_core::rule::{ChainContext, ChainError};
+use springtale_sentinel::Sentinel;
+
+use super::step::run_step;
+use crate::cooperation::CapabilityBridge;
+
+/// Run every sub-step of a chain action against the shared context.
+///
+/// Records no wrapper step of its own: each sub-step lands in
+/// `chain.steps` as it runs. `ChainError::Suppressed` from a nested dedupe
+/// propagates unchanged so the outer caller can end the execution `empty`.
+pub(super) async fn run_chain_steps(
+    steps: &[Action],
+    bridge: &CapabilityBridge,
+    sentinel: &Arc<Sentinel>,
+    execution: &ExecutionContext,
+    chain: &mut ChainContext,
+    depth: u32,
+) -> Result<(), ChainError> {
+    let new_depth = depth + 1;
+    if new_depth > springtale_core::rule::action::MAX_CHAIN_DEPTH {
+        return Err(ChainError::DepthExceeded {
+            depth: new_depth,
+            max: springtale_core::rule::action::MAX_CHAIN_DEPTH,
+        });
+    }
+    // Chain expands transparently — each sub-step is recorded
+    // as its own StepOutput in the shared ChainContext. The
+    // Chain action itself doesn't produce a wrapper step.
+    for (i, step) in steps.iter().enumerate() {
+        match run_step(step, bridge, sentinel, execution, chain, new_depth).await {
+            Ok(()) => {}
+            Err(ChainError::Suppressed) => {
+                // A nested dedupe step suppressed the chain —
+                // propagate cleanly so the outer caller can
+                // mark execution status `empty`.
+                return Err(ChainError::Suppressed);
+            }
+            Err(e) => {
+                tracing::warn!(step = i, error = %e, "chain step failed");
+                return Err(e);
+            }
+        }
+    }
+    // Chain returns without recording its own StepOutput —
+    // sub-steps are already in chain.steps.
+    //
+    // Skip the post-step alias refresh path below: we already
+    // returned the sub-steps individually.
+    Ok(())
+}
diff --git a/crates/springtale-runtime/src/dispatch/connector.rs b/crates/springtale-runtime/src/dispatch/connector.rs
new file mode 100644
index 00000000..785a06bb
--- /dev/null
+++ b/crates/springtale-runtime/src/dispatch/connector.rs
@@ -0,0 +1,235 @@
+//! The `Action::RunConnector` arm — the only step that reaches a
+//! connector, plus the read-only/side-effecting split that decides what a
+//! dry run is allowed to actually do.
+
+use springtale_cooperation::execution::ExecutionContext;
+use springtale_core::rule::template_resolve::resolve_chain_value;
+use springtale_core::rule::{ChainContext, ChainError, StepOutput};
+
+use crate::cooperation::{CapabilityBridge, momentum_to_wasm_tier};
+/// Classify a connector action name as side-effecting. Used by the
+/// DryRun dispatcher path: side-effecting actions are stubbed
+/// (return a "would have done X" StepOutput); read-only actions
+/// run for real so Test This Step shows realistic upstream data.
+///
+/// The heuristic is verb-prefix based — connector authors who add
+/// new write actions just need to use a recognizable prefix.
+/// First-party connectors today: `send_message`, `post_*`,
+/// `write_*`, `create_*`, `delete_*`, `update_*`, `publish_*`,
+/// `commit_*`, `push_*`, `react`, `dispatch`, `react_to_message`,
+/// `set_*` (config writes). Read-side actions use `get_*`, `list_*`,
+/// `read_*`, `fetch_*`, `search_*`, `query_*`, `wait_*`, plus the
+/// browser primitives `navigate`, `evaluate`, `screenshot`,
+/// `extract_text`, `get_html`, `query_all`, `fill_form`, `click`.
+///
+/// `fill_form` + `click` are ambiguous — they mutate page state but
+/// don't reach external systems. We classify them as read-only
+/// (false) so chained recipes like "navigate → fill_form → click →
+/// extract_text" produce useful Test This Step output. Connectors
+/// that ship truly destructive actions under those names should
+/// rename them.
+fn is_side_effecting_action(name: &str) -> bool {
+    const WRITE_PREFIXES: &[&str] = &[
+        "send_",
+        "post_",
+        "write_",
+        "create_",
+        "delete_",
+        "remove_",
+        "update_",
+        "publish_",
+        "commit_",
+        "push_",
+        "dispatch_",
+        "set_",
+        "ban_",
+        "kick_",
+        "mute_",
+        "broadcast_",
+        "react_",
+        "reply_",
+        "subscribe_",
+        "unsubscribe_",
+        "approve_",
+        "deny_",
+    ];
+    const WRITE_EXACT: &[&str] = &[
+        "send",
+        "post",
+        "write",
+        "publish",
+        "commit",
+        "react",
+        "react_to_message",
+        "dispatch",
+        "ban",
+        "kick",
+        "mute",
+    ];
+    if WRITE_EXACT.contains(&name) {
+        return true;
+    }
+    WRITE_PREFIXES.iter().any(|p| name.starts_with(p))
+}
+/// Run one connector action against the chain.
+///
+/// Returns the [`StepOutput`] the caller records; the dry-run path returns a
+/// stub step rather than calling the connector.
+#[allow(clippy::too_many_arguments)]
+pub(super) async fn run_connector_step(
+    connector: &str,
+    action_name: &str,
+    params: &serde_json::Map<String, serde_json::Value>,
+    bridge: &CapabilityBridge,
+    execution: &ExecutionContext,
+    chain: &mut ChainContext,
+    run_id: &str,
+    kind: &'static str,
+    started: std::time::Instant,
+    dry_run: bool,
+) -> Result<StepOutput, ChainError> {
+    // Resolve `${trigger.*}` / `${last_*_output.*}` /
+    // `${stepN.*}` in every param string before handing to
+    // the connector.
+    let raw = serde_json::Value::Object(params.clone());
+    let resolved = resolve_chain_value(&raw, chain, Some(run_id));
+    let input = resolved;
+
+    // Dry-run stubs side-effecting connector actions but
+    // lets read-only actions (HTTP get, browser navigate,
+    // extract_text, etc.) run for real — that's the whole
+    // point of "Test This Step": fetch real upstream data
+    // to validate downstream rendering without spamming
+    // the destination channel.
+    if dry_run && is_side_effecting_action(action_name) {
+        tracing::info!(
+            connector = %connector,
+            action = %action_name,
+            "DRY RUN — side-effecting connector action stubbed"
+        );
+        let step = StepOutput {
+            index: chain.next_step_index(),
+            kind: kind.into(),
+            name: None,
+            output: serde_json::json!({
+                "success": true,
+                "message": format!(
+                    "dry-run: would call {connector}.{action_name}"
+                ),
+                "output": {
+                    "connector": connector,
+                    "action": action_name,
+                    "params": input,
+                },
+                "dry_run": true,
+            }),
+            duration_ms: started.elapsed().as_millis() as u64,
+            error: None,
+        };
+        return Ok(step);
+    }
+
+    let effective_tier = momentum_to_wasm_tier(execution.momentum);
+    let exec = bridge
+        .execute_with_origin(
+            connector,
+            action_name,
+            input,
+            effective_tier,
+            execution.origin.clone(),
+        )
+        .await;
+    match exec {
+        Ok(result) => {
+            tracing::info!(
+                connector = %connector,
+                action = %action_name,
+                success = result.success,
+                "connector action executed"
+            );
+            let index = chain.next_step_index();
+            // Capture both the structured output AND the
+            // human message so downstream templates can read
+            // either. `output` keys exposed in the chain
+            // alias: `last_connector_output.output.*` is the
+            // structured data, `last_connector_output.message`
+            // is the plain-text result.
+            let payload = serde_json::json!({
+                "success": result.success,
+                "message": result.message,
+                "output": result.output,
+            });
+            Ok(StepOutput {
+                index,
+                kind: kind.into(),
+                name: None,
+                output: payload,
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+        Err(e) => {
+            tracing::warn!(
+                connector = %connector,
+                action = %action_name,
+                error = %e,
+                "connector action failed"
+            );
+            Err(ChainError::StepFailed {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                message: e.to_string(),
+            })
+        }
+    }
+}
+
+#[cfg(test)]
+mod side_effect_tests {
+    use super::is_side_effecting_action;
+
+    #[test]
+    fn send_message_is_side_effecting() {
+        assert!(is_side_effecting_action("send_message"));
+    }
+
+    #[test]
+    fn get_is_read_only() {
+        assert!(!is_side_effecting_action("get"));
+        assert!(!is_side_effecting_action("get_html"));
+        assert!(!is_side_effecting_action("list_repos"));
+    }
+
+    #[test]
+    fn browser_navigation_is_read_only() {
+        assert!(!is_side_effecting_action("navigate"));
+        assert!(!is_side_effecting_action("evaluate"));
+        assert!(!is_side_effecting_action("screenshot"));
+        assert!(!is_side_effecting_action("query_all"));
+        assert!(!is_side_effecting_action("wait_for_selector"));
+        assert!(!is_side_effecting_action("extract_text"));
+    }
+
+    #[test]
+    fn write_prefixes_are_side_effecting() {
+        for name in [
+            "post_status",
+            "write_file",
+            "create_issue",
+            "delete_message",
+            "update_repo",
+            "publish_release",
+            "commit_change",
+            "push_branch",
+            "set_config",
+            "ban_user",
+            "kick_member",
+            "mute_user",
+        ] {
+            assert!(
+                is_side_effecting_action(name),
+                "expected {name} to be side-effecting"
+            );
+        }
+    }
+}
diff --git a/crates/springtale-runtime/src/dispatch/entry.rs b/crates/springtale-runtime/src/dispatch/entry.rs
new file mode 100644
index 00000000..5ec07cbd
--- /dev/null
+++ b/crates/springtale-runtime/src/dispatch/entry.rs
@@ -0,0 +1,477 @@
+//! Dispatch entry points — what callers outside this crate reach for.
+//!
+//! [`dispatch_action`] and [`dispatch_actions`] own the chain-fire
+//! envelope: they build the [`ChainContext`], hand each top-level action
+//! to [`super::step::run_step`], and record the executions-log row. The
+//! per-action work lives in the sibling modules.
+
+use std::sync::Arc;
+
+use springtale_cooperation::execution::ExecutionContext;
+use springtale_core::rule::action::Action;
+use springtale_core::rule::{ChainContext, ChainError};
+use springtale_sentinel::Sentinel;
+
+use super::step::run_step;
+use crate::cooperation::CapabilityBridge;
+
+/// Dispatch one top-level rule action with full chain-context
+/// threading. Returns the final [`ChainContext`] containing every
+/// recorded [`StepOutput`].
+///
+/// `trigger_payload` is the JSON the trigger fired with — referenced
+/// by recipe templates as `${trigger.path}`. Cron triggers pass
+/// `Value::Null`. Webhook / connector-event triggers pass the
+/// inbound payload.
+pub fn dispatch_action<'a>(
+    action: &'a Action,
+    bridge: &'a CapabilityBridge,
+    sentinel: &'a Arc<Sentinel>,
+    execution: ExecutionContext,
+    trigger_payload: serde_json::Value,
+) -> std::pin::Pin<
+    Box<dyn std::future::Future<Output = Result<ChainContext, ChainError>> + Send + 'a>,
+> {
+    dispatch_actions(
+        std::slice::from_ref(action),
+        bridge,
+        sentinel,
+        execution,
+        trigger_payload,
+    )
+}
+/// Dispatch a sequence of top-level actions as a single chain fire.
+/// Used by `trigger_dispatch` when a [`RuleMatch::actions`] holds
+/// `Vec<Action>` — each action becomes a step in the shared
+/// `ChainContext`, so `${last_*_output}` and `${stepN.*}` resolve
+/// across the whole rule.
+pub fn dispatch_actions<'a>(
+    actions: &'a [Action],
+    bridge: &'a CapabilityBridge,
+    sentinel: &'a Arc<Sentinel>,
+    execution: ExecutionContext,
+    trigger_payload: serde_json::Value,
+) -> std::pin::Pin<
+    Box<dyn std::future::Future<Output = Result<ChainContext, ChainError>> + Send + 'a>,
+> {
+    Box::pin(async move {
+        let recorder = bridge.recorder();
+        let trigger_summary = summarize_trigger(&trigger_payload, execution.mode);
+        // Best-effort recorder.begin — failures fall through to
+        // dispatch so the chain still runs. The privacy invariant
+        // is about NOT writing content; missing rows are fine.
+        if let Err(e) = recorder.begin(&execution, &trigger_summary, None).await {
+            tracing::warn!(error = %e, "executions recorder.begin failed");
+        }
+
+        let execution_id = execution.execution_id.to_string();
+        let mut chain = ChainContext::new(trigger_payload);
+        let mut steps_emitted = 0usize;
+        let mut final_status = springtale_store::schema::executions::ExecutionStatus::Succeeded;
+        let mut error_kind: Option<&'static str> = None;
+        let mut chain_outcome: Result<(), ChainError> = Ok(());
+
+        for action in actions {
+            match run_step(action, bridge, sentinel, &execution, &mut chain, 0).await {
+                Ok(()) => {
+                    // Record any new steps the action appended to
+                    // chain.steps. Chain action expands into
+                    // multiple sub-steps so we drain everything past
+                    // `steps_emitted`.
+                    while steps_emitted < chain.steps.len() {
+                        let step = &chain.steps[steps_emitted];
+                        if let Err(e) = recorder.record_step(&execution_id, step).await {
+                            tracing::warn!(error = %e, "executions recorder.record_step failed");
+                        }
+                        steps_emitted += 1;
+                    }
+                }
+                Err(ChainError::Suppressed) => {
+                    // Flush any steps that did run (dedupe step itself).
+                    while steps_emitted < chain.steps.len() {
+                        let step = &chain.steps[steps_emitted];
+                        if let Err(e) = recorder.record_step(&execution_id, step).await {
+                            tracing::warn!(error = %e, "executions recorder.record_step failed");
+                        }
+                        steps_emitted += 1;
+                    }
+                    final_status = springtale_store::schema::executions::ExecutionStatus::Empty;
+                    chain_outcome = Ok(());
+                    break;
+                }
+                Err(e) => {
+                    while steps_emitted < chain.steps.len() {
+                        let step = &chain.steps[steps_emitted];
+                        if let Err(rec_err) = recorder.record_step(&execution_id, step).await {
+                            tracing::warn!(error = %rec_err, "executions recorder.record_step failed");
+                        }
+                        steps_emitted += 1;
+                    }
+                    final_status = springtale_store::schema::executions::ExecutionStatus::Failed;
+                    error_kind = Some(classify_chain_error(&e));
+                    chain_outcome = Err(e);
+                    break;
+                }
+            }
+        }
+
+        if let Err(e) = recorder
+            .finish(&execution_id, final_status, error_kind)
+            .await
+        {
+            tracing::warn!(error = %e, "executions recorder.finish failed");
+        }
+
+        match chain_outcome {
+            Ok(()) => Ok(chain),
+            Err(e) => Err(e),
+        }
+    })
+}
+/// Build a short summary string the executions log records for the
+/// firing trigger. Sized for a status line — no payload, just the
+/// kind + the obvious discriminator.
+fn summarize_trigger(
+    trigger: &serde_json::Value,
+    mode: springtale_cooperation::execution::ExecutionMode,
+) -> String {
+    use springtale_cooperation::execution::ExecutionMode as M;
+    match mode {
+        M::Cron => trigger
+            .get("expression")
+            .and_then(|v| v.as_str())
+            .map(|e| format!("Cron {e}"))
+            .unwrap_or_else(|| "Cron".to_owned()),
+        M::Webhook => "Webhook".to_owned(),
+        M::ConnectorEvent => trigger
+            .get("trigger_name")
+            .and_then(|v| v.as_str())
+            .map(|t| format!("Event {t}"))
+            .unwrap_or_else(|| "ConnectorEvent".to_owned()),
+        M::FileWatch => "FileWatch".to_owned(),
+        M::Manual => "Manual".to_owned(),
+        M::Cooperation => "Cooperation".to_owned(),
+        M::Retry => "Retry".to_owned(),
+        M::DryRun => "DryRun".to_owned(),
+    }
+}
+/// Map a chain error to the same enum-tag set the recorder writes
+/// for step errors. Keeps the audit trail consistent — privacy
+/// invariant says no full messages reach the DB.
+fn classify_chain_error(err: &ChainError) -> &'static str {
+    match err {
+        ChainError::Suppressed => "suppressed",
+        ChainError::StepNotYetRun(_) => "template_step_unresolved",
+        ChainError::StepNameNotFound(_) => "template_name_unresolved",
+        ChainError::DuplicateStepName(_) => "template_duplicate_name",
+        ChainError::DepthExceeded { .. } => "chain_depth_exceeded",
+        ChainError::StepFailed { .. } => "step_failed",
+        ChainError::Template(_) => "template_invalid",
+    }
+}
+#[cfg(test)]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod tests {
+    use super::*;
+    use springtale_cooperation::execution::{
+        ExecutionContext as CoopExecutionContext, ExecutionMode as CoopExecutionMode,
+    };
+    use springtale_store::SqliteBackend;
+    use springtale_store::backend::StorageBackend;
+    use springtale_store::schema::executions::ExecutionFilter;
+    use std::sync::Arc;
+
+    /// Build a bridge wired against an in-memory SqliteBackend with
+    /// a real StoreRecorder — used by tests that assert on
+    /// executions-log rows after a chain runs.
+    fn bridge_with_recorded_store() -> (CapabilityBridge, Arc<dyn StorageBackend>) {
+        let store: Arc<dyn StorageBackend> = Arc::new(SqliteBackend::open_in_memory().unwrap());
+        let recorder: Arc<dyn crate::operations::executions::ExecutionRecorder> = Arc::new(
+            crate::operations::executions::StoreRecorder::new(store.clone()),
+        );
+        let registry = Arc::new(tokio::sync::RwLock::new(
+            springtale_connector::registry::store::ConnectorRegistry::default(),
+        ));
+        let bridge = CapabilityBridge::new(registry)
+            .with_store(store.clone())
+            .with_recorder(recorder);
+        (bridge, store)
+    }
+
+    fn manual_execution_ctx() -> CoopExecutionContext {
+        CoopExecutionContext::for_global(
+            springtale_core::rule::types::RuleId::new(),
+            CoopExecutionMode::Manual,
+        )
+    }
+
+    #[tokio::test]
+    async fn dispatch_records_execution_and_step_rows() {
+        let (bridge, store) = bridge_with_recorded_store();
+        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
+            springtale_sentinel::SentinelConfig::default(),
+            store.clone(),
+        ));
+        let execution = manual_execution_ctx();
+        let exec_id = execution.execution_id.to_string();
+
+        // SendMessage: simplest non-network action — produces one step.
+        let action = Action::SendMessage {
+            text: "hello".into(),
+        };
+        let chain = dispatch_action(
+            &action,
+            &bridge,
+            &sentinel,
+            execution,
+            serde_json::Value::Null,
+        )
+        .await
+        .unwrap();
+        assert_eq!(chain.steps.len(), 1);
+
+        // executions row recorded.
+        let list = store
+            .list_executions(ExecutionFilter::default())
+            .await
+            .unwrap();
+        assert_eq!(list.len(), 1);
+        assert_eq!(list[0].id, exec_id);
+        assert_eq!(
+            list[0].status,
+            springtale_store::schema::executions::ExecutionStatus::Succeeded
+        );
+        assert_eq!(
+            list[0].mode,
+            springtale_store::schema::executions::ExecutionMode::Manual
+        );
+
+        // execution_steps row recorded with sizes only.
+        let steps = store.get_execution_steps(&exec_id).await.unwrap();
+        assert_eq!(steps.len(), 1);
+        assert_eq!(steps[0].step_kind, "send_message");
+        assert!(steps[0].output_bytes > 0, "output_bytes captured size");
+        assert!(
+            steps[0].input_blob_ref.is_none() && steps[0].output_blob_ref.is_none(),
+            "privacy default: no content retained"
+        );
+    }
+
+    #[tokio::test]
+    async fn dispatch_dry_run_stubs_sendmessage_and_returns_dry_run_flag() {
+        let (bridge, store) = bridge_with_recorded_store();
+        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
+            springtale_sentinel::SentinelConfig::default(),
+            store.clone(),
+        ));
+        let execution = CoopExecutionContext::for_global(
+            springtale_core::rule::types::RuleId::new(),
+            CoopExecutionMode::DryRun,
+        );
+
+        let action = Action::SendMessage {
+            text: "would have sent this".into(),
+        };
+        let chain = dispatch_action(
+            &action,
+            &bridge,
+            &sentinel,
+            execution,
+            serde_json::Value::Null,
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(chain.steps.len(), 1);
+        let step = &chain.steps[0];
+        assert_eq!(step.kind, "send_message");
+        assert_eq!(
+            step.output.get("dry_run").and_then(|v| v.as_bool()),
+            Some(true)
+        );
+
+        // Executions log captured the run in DryRun mode.
+        let runs = store
+            .list_executions(ExecutionFilter::default())
+            .await
+            .unwrap();
+        assert_eq!(runs.len(), 1);
+        assert_eq!(
+            runs[0].mode,
+            springtale_store::schema::executions::ExecutionMode::DryRun
+        );
+    }
+
+    #[tokio::test]
+    async fn dispatch_records_failure_status_on_step_failure() {
+        // WriteFile with a relative path is rejected at the
+        // dispatcher's pre-flight — yields a StepFailed chain error.
+        let (bridge, store) = bridge_with_recorded_store();
+        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
+            springtale_sentinel::SentinelConfig::default(),
+            store.clone(),
+        ));
+        let execution = manual_execution_ctx();
+        let exec_id = execution.execution_id.to_string();
+
+        let action = Action::WriteFile {
+            destination: "relative.txt".into(),
+            content: "data".into(),
+            delete_source: false,
+        };
+        let result = dispatch_action(
+            &action,
+            &bridge,
+            &sentinel,
+            execution,
+            serde_json::Value::Null,
+        )
+        .await;
+        assert!(result.is_err());
+
+        let list = store
+            .list_executions(ExecutionFilter::default())
+            .await
+            .unwrap();
+        assert_eq!(list.len(), 1);
+        assert_eq!(
+            list[0].status,
+            springtale_store::schema::executions::ExecutionStatus::Failed,
+            "WriteFile rejected → executions row marked failed"
+        );
+        assert_eq!(list[0].error_kind.as_deref(), Some("step_failed"));
+        let _ = exec_id; // unused but kept for parallel-with-success test
+    }
+
+    /// Minimal native connector whose single action declares no
+    /// `destructive` hint — the "unknown hint" case the sentinel must
+    /// treat as destructive (MCP `destructiveHint` default `true`).
+    struct HintlessConnector {
+        manifest: springtale_connector::manifest::types::ConnectorManifest,
+    }
+
+    impl HintlessConnector {
+        fn new(name: &str) -> Self {
+            use springtale_connector::manifest::SignatureAlgorithm;
+            use springtale_connector::manifest::types::{
+                ActionDecl, Capability, ConnectorManifest, TriggerDecl,
+            };
+            Self {
+                manifest: ConnectorManifest {
+                    name: name.to_owned(),
+                    version: "0.1.0".into(),
+                    author: "test".into(),
+                    description: "hintless".into(),
+                    capabilities: vec![Capability::NetworkOutbound {
+                        host: "api.example.com".into(),
+                    }],
+                    triggers: vec![TriggerDecl {
+                        name: "test_event".into(),
+                        description: "test".into(),
+                        schema: None,
+                    }],
+                    actions: vec![ActionDecl {
+                        read_only: false,
+                        destructive: None,
+                        poll_interval_secs: None,
+                        name: "echo".into(),
+                        description: "echo".into(),
+                        input_schema: None,
+                        output_schema: None,
+                    }],
+                    data_disclosure: vec![],
+                    roles: vec![],
+                    wasm_hash: None,
+                    signature_alg: SignatureAlgorithm::default(),
+                    signature: None,
+                },
+            }
+        }
+    }
+
+    #[async_trait::async_trait]
+    impl springtale_connector::connector::trait_::Connector for HintlessConnector {
+        fn triggers(&self) -> &[springtale_connector::manifest::types::TriggerDecl] {
+            &self.manifest.triggers
+        }
+        fn actions(&self) -> &[springtale_connector::manifest::types::ActionDecl] {
+            &self.manifest.actions
+        }
+        async fn execute(
+            &self,
+            action: &str,
+            input: serde_json::Value,
+        ) -> Result<
+            springtale_connector::connector::trait_::ActionResult,
+            springtale_connector::ConnectorError,
+        > {
+            Ok(springtale_connector::connector::trait_::ActionResult {
+                success: true,
+                output: serde_json::json!({"echoed": input, "action": action}),
+                message: "ok".into(),
+            })
+        }
+        async fn on_event(
+            &self,
+            trigger: &str,
+            _handler: springtale_connector::connector::trait_::EventHandler,
+        ) -> Result<
+            springtale_connector::connector::subscription::Subscription,
+            springtale_connector::ConnectorError,
+        > {
+            Ok(
+                springtale_connector::connector::subscription::Subscription {
+                    id: springtale_connector::connector::subscription::SubscriptionId(0),
+                    trigger: trigger.to_owned(),
+                },
+            )
+        }
+        async fn remove_event(
+            &self,
+            _sub: &springtale_connector::connector::subscription::Subscription,
+        ) -> Result<(), springtale_connector::ConnectorError> {
+            Ok(())
+        }
+        fn manifest(&self) -> &springtale_connector::manifest::types::ConnectorManifest {
+            &self.manifest
+        }
+    }
+
+    #[tokio::test]
+    async fn dispatch_quarantines_hintless_connector_action_under_default_deny() {
+        let store: Arc<dyn StorageBackend> = Arc::new(SqliteBackend::open_in_memory().unwrap());
+        let mut registry = springtale_connector::registry::store::ConnectorRegistry::new(
+            springtale_connector::capability::grant::CapabilityPolicy::AllowAll,
+        );
+        registry
+            .install_native(Box::new(HintlessConnector::new("hintless")))
+            .unwrap();
+        let bridge = CapabilityBridge::new(Arc::new(tokio::sync::RwLock::new(registry)))
+            .with_store(store.clone());
+        // `Sentinel::new` wires `DefaultDenyApprovalGate`.
+        let sentinel = Arc::new(springtale_sentinel::Sentinel::new(
+            springtale_sentinel::SentinelConfig::default(),
+            store.clone(),
+        ));
+        let execution = manual_execution_ctx();
+
+        let action = Action::RunConnector {
+            connector: "hintless".into(),
+            action: "echo".into(),
+            params: serde_json::Map::new(),
+        };
+        let err = dispatch_action(
+            &action,
+            &bridge,
+            &sentinel,
+            execution,
+            serde_json::Value::Null,
+        )
+        .await
+        .unwrap_err();
+        assert!(
+            matches!(&err, ChainError::StepFailed { message, .. } if message.contains("quarantined")),
+            "expected sentinel quarantine, got {err:?}"
+        );
+    }
+}
diff --git a/crates/springtale-runtime/src/dispatch/extract.rs b/crates/springtale-runtime/src/dispatch/extract.rs
new file mode 100644
index 00000000..fafaca91
--- /dev/null
+++ b/crates/springtale-runtime/src/dispatch/extract.rs
@@ -0,0 +1,51 @@
+//! The `Action::Extract` arm — the extraction ladder's step wrapper.
+
+use springtale_cooperation::execution::ExecutionContext;
+use springtale_core::rule::template_resolve::resolve_chain_value;
+use springtale_core::rule::{ChainContext, ChainError, StepOutput};
+
+use crate::cooperation::CapabilityBridge;
+/// Resolve the extraction source against the chain and run the ladder.
+#[allow(clippy::too_many_arguments)]
+pub(super) async fn run_extract_step(
+    source: &str,
+    extract_kind: &springtale_core::rule::action::ExtractKind,
+    bridge: &CapabilityBridge,
+    execution: &ExecutionContext,
+    chain: &mut ChainContext,
+    run_id: &str,
+    kind: &'static str,
+    started: std::time::Instant,
+) -> Result<StepOutput, ChainError> {
+    // Resolve `source` as a path against the chain — e.g.
+    // `"last_connector_output.body"` → the HTTP body string,
+    // or `"trigger.payload"` → the trigger event JSON.
+    let resolved_source = resolve_chain_value(
+        &serde_json::Value::String(format!("${{{source}}}")),
+        chain,
+        Some(run_id),
+    );
+
+    // The AI adapter for LlmSchema extraction. We pass it
+    // through opt-in — Phase A only fires non-LLM tiers;
+    // Phase B activates LlmSchema and the adapter is read.
+    let adapter_arc = bridge.ai_adapter_for(execution).await;
+    let ai_ref: Option<&dyn springtale_ai::AiAdapter> = Some(&*adapter_arc);
+
+    let extracted = crate::extraction::extract(&resolved_source, extract_kind, ai_ref).await;
+    match extracted {
+        Ok(value) => Ok(StepOutput {
+            index: chain.next_step_index(),
+            kind: kind.into(),
+            name: None,
+            output: value,
+            duration_ms: started.elapsed().as_millis() as u64,
+            error: None,
+        }),
+        Err(e) => Err(ChainError::StepFailed {
+            index: chain.next_step_index(),
+            kind: kind.into(),
+            message: e.to_string(),
+        }),
+    }
+}
diff --git a/crates/springtale-runtime/src/dispatch/mod.rs b/crates/springtale-runtime/src/dispatch/mod.rs
new file mode 100644
index 00000000..4ca1ad65
--- /dev/null
+++ b/crates/springtale-runtime/src/dispatch/mod.rs
@@ -0,0 +1,53 @@
+//! Shared rule-action dispatcher — executes matched rule actions.
+//!
+//! Both springtaled (daemon) and springtale-bot route action dispatch
+//! through this module. Per ARCHITECTURE.md §6.10, this is the single
+//! enforcement point that calls `sentinel.evaluate()` before every
+//! action.
+//!
+//! ## Phase 0 rework (chain context + real I/O)
+//!
+//! Pre-Phase-0 this module returned `Result<String, String>` and
+//! discarded step outputs between iterations. `Action::AiComplete`
+//! was a stub returning `"ai: noop"`. `Action::RunConnector` captured
+//! only the connector's plain-text `message` and dropped its
+//! structured `output: Value`. The net effect: ~12 shipped builtin
+//! recipes referenced `${last_ai_output}` / `${last_connector_output}`
+//! in their TOML, but the dispatcher had no path that resolved those
+//! placeholders — users received literal `${last_ai_output}` strings
+//! in their messaging channels.
+//!
+//! The new shape closes all four gaps:
+//!
+//! 1. Return type is `Result<ChainContext, ChainError>` —
+//!    `ChainContext` carries every step's typed `output`, the
+//!    `last_*_output` aliases, and the trigger payload. Callers read
+//!    it to surface results or persist to the executions log.
+//! 2. Before each step runs, action parameters are template-resolved
+//!    against the chain via [`resolve_chain_value`] — `${trigger.x}`,
+//!    `${last_ai_output}`, `${stepN.field}`, `${step.NAME.field}` all
+//!    bind to live values.
+//! 3. `RunConnector` captures the connector's `ActionResult.output`
+//!    (the structured JSON) into `StepOutput.output`, not just the
+//!    human message.
+//! 4. `AiComplete` calls the real adapter via
+//!    [`CapabilityBridge::ai_adapter_for`] — falls back to
+//!    `NoopAdapter` (clean error, not silent stubbing) when no
+//!    adapter is wired.
+//!
+//! Cooperation alignment: every dispatch carries an
+//! [`ExecutionContext`] from `springtale-cooperation::execution`, so
+//! the runtime knows which agent in which formation at which momentum
+//! tier is firing. The bridge consults the tier for capability
+//! routing (per-tier WASM `InstancePre` selection, §16). The sentinel
+//! consults the tier for rate-budget scaling: Cold = 1/30s, Warming =
+//! 12/min, Hot = 60/min, Fever = 600/min — the Phase 0.5 mapping in
+//! [`crate::cooperation::momentum_to_throttle_tier`].
+
+pub mod chain;
+pub mod connector;
+pub mod entry;
+pub mod extract;
+pub mod step;
+
+pub use entry::{dispatch_action, dispatch_actions};
diff --git a/crates/springtale-runtime/src/dispatch/step.rs b/crates/springtale-runtime/src/dispatch/step.rs
new file mode 100644
index 00000000..9b41c83d
--- /dev/null
+++ b/crates/springtale-runtime/src/dispatch/step.rs
@@ -0,0 +1,515 @@
+//! The step runner — sentinel gate, template resolution, and the
+//! per-`Action` arm dispatch that every chain step goes through.
+//!
+//! Arms with enough substance to stand alone live in sibling modules
+//! ([`super::connector`], [`super::chain`], [`super::extract`]); the rest
+//! are inline here because they are a handful of lines each.
+
+use std::sync::Arc;
+
+use springtale_ai::{AiOptions, AiRequest};
+use springtale_cooperation::execution::ExecutionContext;
+use springtale_core::rule::action::Action;
+use springtale_core::rule::template_resolve::resolve_chain_template;
+use springtale_core::rule::{ChainContext, ChainError, StepOutput};
+use springtale_sentinel::impact::ActionHints;
+use springtale_sentinel::sentinel::EvaluateRequest;
+use springtale_sentinel::{Sentinel, Verdict};
+
+use super::{chain, connector, extract};
+use crate::cooperation::{CapabilityBridge, momentum_to_throttle_tier};
+
+/// Maximum size for WriteFile action content (10 MiB).
+const MAX_WRITE_FILE_BYTES: usize = 10 * 1024 * 1024;
+
+/// Run one action against the chain. Recursive — `Action::Chain`
+/// expands into multiple sub-steps that all share the chain context.
+pub(super) fn run_step<'a>(
+    action: &'a Action,
+    bridge: &'a CapabilityBridge,
+    sentinel: &'a Arc<Sentinel>,
+    execution: &'a ExecutionContext,
+    chain: &'a mut ChainContext,
+    depth: u32,
+) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<(), ChainError>> + Send + 'a>> {
+    Box::pin(run_step_inner(
+        action, bridge, sentinel, execution, chain, depth,
+    ))
+}
+
+async fn run_step_inner(
+    action: &Action,
+    bridge: &CapabilityBridge,
+    sentinel: &Arc<Sentinel>,
+    execution: &ExecutionContext,
+    chain: &mut ChainContext,
+    depth: u32,
+) -> Result<(), ChainError> {
+    let run_id = execution.execution_id.to_string();
+
+    // ── Sentinel ─────────────────────────────────────────────────
+    // Throw the (unresolved) action at sentinel for connector-name
+    // routing only — the resolver below produces the executable
+    // version. Sentinel doesn't read action parameters; it reads the
+    // connector name, the manifest's advisory hints for the named
+    // action, and the envelope's policy / autonomy.
+    let connector_name = match action {
+        Action::RunConnector { connector, .. } => connector.as_str(),
+        _ => "system",
+    };
+    let throttle_tier = momentum_to_throttle_tier(execution.momentum);
+    let hints = if let Action::RunConnector {
+        connector,
+        action: name,
+        ..
+    } = action
+    {
+        let reg = bridge.registry().read().await;
+        reg.get(connector)
+            .and_then(|e| e.host.actions().iter().find(|d| d.name == *name).cloned())
+            .map(|d| ActionHints {
+                read_only: d.read_only,
+                destructive: d.destructive,
+            })
+    } else {
+        None
+    };
+    let action_name = if let Action::RunConnector { action: name, .. } = action {
+        Some(name.as_str())
+    } else {
+        None
+    };
+    let verdict = sentinel
+        .evaluate(EvaluateRequest {
+            action,
+            connector_name,
+            tier: throttle_tier,
+            hints,
+            action_name,
+            policy: execution.policy,
+            autonomy: execution.autonomy,
+            origin: execution.origin.as_ref(),
+        })
+        .await;
+    match verdict {
+        Verdict::Go => {}
+        Verdict::Throttle(duration) => {
+            tracing::info!(
+                connector = connector_name,
+                delay_ms = duration.as_millis() as u64,
+                "sentinel: throttling action"
+            );
+            chain.throttles += 1;
+            tokio::time::sleep(duration).await;
+        }
+        Verdict::Pause(reason) => {
+            return Err(ChainError::StepFailed {
+                index: chain.next_step_index(),
+                kind: action_kind(action).into(),
+                message: format!("sentinel paused: {reason}"),
+            });
+        }
+        Verdict::Quarantine(reason) => {
+            return Err(ChainError::StepFailed {
+                index: chain.next_step_index(),
+                kind: action_kind(action).into(),
+                message: format!("sentinel quarantined: {reason}"),
+            });
+        }
+    }
+
+    let kind = action_kind(action);
+    let started = std::time::Instant::now();
+    let dry_run = matches!(
+        execution.mode,
+        springtale_cooperation::execution::ExecutionMode::DryRun
+    );
+
+    // ── Action arm dispatch ─────────────────────────────────────
+    let outcome: Result<StepOutput, ChainError> = match action {
+        Action::RunConnector {
+            connector,
+            action: action_name,
+            params,
+        } => {
+            connector::run_connector_step(
+                connector,
+                action_name,
+                params,
+                bridge,
+                execution,
+                chain,
+                &run_id,
+                kind,
+                started,
+                dry_run,
+            )
+            .await
+        }
+
+        Action::Notify { title, body } => {
+            let resolved_title = resolve_chain_template(title, chain, Some(&run_id));
+            let resolved_body = resolve_chain_template(body, chain, Some(&run_id));
+            if dry_run {
+                tracing::info!(
+                    title = %resolved_title,
+                    "DRY RUN — Notify stubbed"
+                );
+            } else {
+                tracing::info!(title = %resolved_title, body = %resolved_body, "NOTIFICATION");
+            }
+            Ok(StepOutput {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                name: None,
+                output: serde_json::json!({
+                    "title": resolved_title,
+                    "body": resolved_body,
+                    "dry_run": dry_run,
+                }),
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+
+        Action::SendMessage { text } => {
+            let resolved = resolve_chain_template(text, chain, Some(&run_id));
+            if dry_run {
+                tracing::info!(text_len = resolved.len(), "DRY RUN — SendMessage stubbed");
+            } else {
+                tracing::info!(text = %resolved, "SendMessage (no destination context)");
+            }
+            Ok(StepOutput {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                name: None,
+                output: serde_json::json!({
+                    "text": resolved,
+                    "dry_run": dry_run,
+                }),
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+
+        Action::WriteFile {
+            destination,
+            content,
+            delete_source: _,
+        } => {
+            let resolved_destination = resolve_chain_template(destination, chain, Some(&run_id));
+            let resolved_content = resolve_chain_template(content, chain, Some(&run_id));
+
+            if resolved_content.len() > MAX_WRITE_FILE_BYTES {
+                return Err(ChainError::StepFailed {
+                    index: chain.next_step_index(),
+                    kind: kind.into(),
+                    message: format!(
+                        "file content size ({} bytes) exceeds maximum ({MAX_WRITE_FILE_BYTES} bytes)",
+                        resolved_content.len()
+                    ),
+                });
+            }
+            let path = std::path::Path::new(&resolved_destination);
+            if !path.is_absolute() {
+                return Err(ChainError::StepFailed {
+                    index: chain.next_step_index(),
+                    kind: kind.into(),
+                    message: "WriteFile requires absolute path".to_string(),
+                });
+            }
+            if path
+                .components()
+                .any(|c| matches!(c, std::path::Component::ParentDir))
+            {
+                return Err(ChainError::StepFailed {
+                    index: chain.next_step_index(),
+                    kind: kind.into(),
+                    message: "WriteFile path must not contain '..'".to_string(),
+                });
+            }
+            if dry_run {
+                tracing::info!(
+                    path = %resolved_destination,
+                    bytes = resolved_content.len(),
+                    "DRY RUN — WriteFile stubbed"
+                );
+            } else {
+                tokio::fs::write(&resolved_destination, &resolved_content)
+                    .await
+                    .map_err(|e| ChainError::StepFailed {
+                        index: chain.next_step_index(),
+                        kind: kind.into(),
+                        message: format!("failed to write file {resolved_destination}: {e}"),
+                    })?;
+                tracing::info!(path = %resolved_destination, "file written");
+            }
+            Ok(StepOutput {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                name: None,
+                output: serde_json::json!({
+                    "path": resolved_destination,
+                    "bytes": resolved_content.len(),
+                    "dry_run": dry_run,
+                }),
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+
+        Action::RunShell { command } => {
+            let resolved = resolve_chain_template(command, chain, Some(&run_id));
+            // ShellExec requires capability approval flow — actual
+            // execution is gated outside the dispatcher. The
+            // dispatcher records the request so the capability layer
+            // and audit trail see it.
+            tracing::info!(
+                command = %resolved,
+                "SHELL (not executed — requires ShellExec approval)"
+            );
+            Ok(StepOutput {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                name: None,
+                output: serde_json::json!({
+                    "command": resolved,
+                    "executed": false,
+                    "reason": "ShellExec capability gate",
+                }),
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+
+        Action::Delay { seconds } => {
+            if dry_run {
+                tracing::info!(seconds = seconds, "DRY RUN — Delay stubbed");
+            } else {
+                tokio::time::sleep(std::time::Duration::from_secs(*seconds)).await;
+                tracing::debug!(seconds = seconds, "delay completed");
+            }
+            Ok(StepOutput {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                name: None,
+                output: serde_json::json!({ "seconds": seconds }),
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+
+        Action::Chain { steps } => {
+            chain::run_chain_steps(steps, bridge, sentinel, execution, chain, depth).await?;
+            // Chain records no wrapper step of its own — its sub-steps are
+            // already in `chain.steps`, so skip the post-step alias refresh.
+            sentinel.report_success(connector_name);
+            return Ok(());
+        }
+
+        Action::Transform { operation, params } => {
+            // Transform is a placeholder today — operation-specific
+            // implementations land in Phase A (the extraction ladder
+            // replaces most Transform use cases). For now we record
+            // the transform request so the chain context surfaces it.
+            tracing::debug!(operation = %operation, "transform pass-through");
+            Ok(StepOutput {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                name: None,
+                output: serde_json::json!({
+                    "operation": operation,
+                    "params": params,
+                }),
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+
+        Action::AiComplete { prompt, .. } => {
+            // Resolve `${...}` placeholders in the prompt before the
+            // model sees it. Critical: this is how `${last_connector_output}`
+            // ends up in the prompt for "summarize this fetched
+            // body" recipes.
+            //
+            // OWASP LLM01:2025 indirect-injection guard: every
+            // substituted value is wrapped in `<external_context>` tags
+            // by the AI-specific resolver, and the rule explaining the
+            // tags is prepended to the system prompt. The model
+            // therefore sees both (a) explicit instructions that the
+            // tagged content is untrusted data, and (b) the tagged
+            // values themselves.
+            let resolved_user_prompt =
+                springtale_core::rule::template_resolve::resolve_chain_template_for_ai(
+                    prompt,
+                    chain,
+                    Some(&run_id),
+                );
+            let resolved_prompt = format!(
+                "{rule}\n\n{prompt}",
+                rule = springtale_core::rule::template_resolve::AI_EXTERNAL_CONTEXT_RULE,
+                prompt = resolved_user_prompt,
+            );
+
+            // Route through the bridge — falls back to NoopAdapter
+            // when no adapter is wired. NoopAdapter returns
+            // `AiError::Disabled`, which we surface as a step error
+            // (not a silent stub).
+            let adapter_arc = bridge.ai_adapter_for(execution).await;
+            let request = AiRequest::Complete {
+                prompt: resolved_prompt.clone(),
+            };
+            let options = AiOptions::default();
+            let response = adapter_arc.complete(request, options).await;
+            match response {
+                Ok(ai_response) => {
+                    tracing::debug!(
+                        prompt_len = resolved_prompt.len(),
+                        content_len = ai_response.content.len(),
+                        finish_reason = ?ai_response.finish_reason,
+                        "AI complete"
+                    );
+                    Ok(StepOutput {
+                        index: chain.next_step_index(),
+                        kind: kind.into(),
+                        name: None,
+                        output: serde_json::json!({
+                            "text": ai_response.content,
+                            "finish_reason": ai_response.finish_reason,
+                        }),
+                        duration_ms: started.elapsed().as_millis() as u64,
+                        error: None,
+                    })
+                }
+                Err(e) => {
+                    tracing::warn!(error = %e, "AI complete failed");
+                    Err(ChainError::StepFailed {
+                        index: chain.next_step_index(),
+                        kind: kind.into(),
+                        message: e.to_string(),
+                    })
+                }
+            }
+        }
+
+        Action::Extract {
+            source,
+            kind: extract_kind,
+        } => {
+            extract::run_extract_step(
+                source,
+                extract_kind,
+                bridge,
+                execution,
+                chain,
+                &run_id,
+                kind,
+                started,
+            )
+            .await
+        }
+
+        Action::Dedupe {
+            key,
+            bucket,
+            history,
+        } => {
+            // Resolve key + bucket templates against the chain.
+            let resolved_key = resolve_chain_template(key, chain, Some(&run_id));
+            let resolved_bucket = resolve_chain_template(bucket, chain, Some(&run_id));
+
+            // Bridge holds the store handle. Test builds without a
+            // store wired fall through to "fresh" (the default impl
+            // on the StorageBackend trait) so dispatcher tests don't
+            // need a real DB just to exercise non-dedupe arms.
+            let formation_id = execution.formation_id.map(|f| f.0.to_string());
+            let rule_id = execution.rule_id.0.to_string();
+
+            // Dry-run: never write to the dedupe table. We want
+            // Test This Step to render the downstream steps as
+            // if the data were fresh — without polluting the
+            // real dedupe state for the next production fire.
+            let outcome = if dry_run {
+                springtale_store::schema::dedupe::DedupeOutcome::Fresh
+            } else {
+                match bridge.store() {
+                    Some(store) => crate::dedupe::check_and_record(
+                        store,
+                        formation_id.as_deref(),
+                        &rule_id,
+                        &resolved_bucket,
+                        &resolved_key,
+                        *history,
+                    )
+                    .await
+                    .map_err(|e| ChainError::StepFailed {
+                        index: chain.next_step_index(),
+                        kind: kind.into(),
+                        message: e.to_string(),
+                    })?,
+                    None => springtale_store::schema::dedupe::DedupeOutcome::Fresh,
+                }
+            };
+
+            // SeenBefore short-circuits the chain. The Chain runner
+            // arm above catches `ChainError::Suppressed` and ends
+            // the execution cleanly with status `empty`.
+            if matches!(
+                outcome,
+                springtale_store::schema::dedupe::DedupeOutcome::SeenBefore
+            ) {
+                tracing::info!(
+                    rule = %rule_id,
+                    bucket = %resolved_bucket,
+                    "dedupe: key seen before — chain suppressed"
+                );
+                return Err(ChainError::Suppressed);
+            }
+
+            Ok(StepOutput {
+                index: chain.next_step_index(),
+                kind: kind.into(),
+                name: None,
+                output: serde_json::json!({
+                    "outcome": "fresh",
+                    "bucket": resolved_bucket,
+                    "dry_run": dry_run,
+                }),
+                duration_ms: started.elapsed().as_millis() as u64,
+                error: None,
+            })
+        }
+    };
+
+    // ── Record outcome + sentinel report ────────────────────────
+    match outcome {
+        Ok(step) => {
+            chain.record_step(step);
+            sentinel.report_success(connector_name);
+            Ok(())
+        }
+        Err(e) => {
+            sentinel.report_failure(connector_name);
+            Err(e)
+        }
+    }
+}
+/// Stable kind tag the dispatcher writes into [`StepOutput::kind`].
+/// Mirrors the [`Action`] variant discriminant so chain-context
+/// readers can filter by kind without re-matching the original
+/// variant.
+fn action_kind(action: &Action) -> &'static str {
+    match action {
+        Action::RunConnector { .. } => "run_connector",
+        Action::SendMessage { .. } => "send_message",
+        Action::WriteFile { .. } => "write_file",
+        Action::RunShell { .. } => "run_shell",
+        Action::Notify { .. } => "notify",
+        Action::Chain { .. } => "chain",
+        Action::Transform { .. } => "transform",
+        Action::Delay { .. } => "delay",
+        Action::AiComplete { .. } => "ai_complete",
+        Action::Extract { .. } => "extract",
+        Action::Dedupe { .. } => "dedupe",
+    }
+}
diff --git a/crates/springtale-runtime/src/embedded.rs b/crates/springtale-runtime/src/embedded.rs
index 0eb6f687..42ab737d 100644
--- a/crates/springtale-runtime/src/embedded.rs
+++ b/crates/springtale-runtime/src/embedded.rs
@@ -107,6 +107,35 @@ impl EmbeddedScheduler {
         }
     }
 
+    /// Stop every trigger this scheduler owns — used when the daemon
+    /// locks (plan 6.10). Cancels all cron jobs and drops every
+    /// filesystem watch, so no rule can fire while the vault is
+    /// closed. Idempotent, and reversible only by a fresh
+    /// [`bootstrap`]: unlock rebuilds the runtime from scratch.
+    pub async fn pause(&self) {
+        let cancelled = {
+            let mut cron = self.cron.lock().await;
+            let n = cron.list().len();
+            cron.cancel_all();
+            n
+        };
+        let unwatched = {
+            let mut watcher = self.fs_watcher.lock().await;
+            let paths: Vec<std::path::PathBuf> = watcher.watched_paths().to_vec();
+            for path in &paths {
+                if let Err(e) = watcher.unwatch(path) {
+                    tracing::warn!(path = %path.display(), error = %e, "failed to unwatch on pause");
+                }
+            }
+            paths.len()
+        };
+        tracing::info!(
+            cron_cancelled = cancelled,
+            paths_unwatched = unwatched,
+            "scheduler paused"
+        );
+    }
+
     /// Cancel a previously-registered trigger. Idempotent —
     /// unscheduling something that was never scheduled is a no-op.
     pub async fn unschedule(&self, rule: &Rule) {
@@ -265,7 +294,7 @@ pub async fn bootstrap(
             Ok(())
         })
     }));
-    tokio::spawn(async move {
+    runtime.tasks.spawn(async move {
         if let Err(e) = consumer.run().await {
             tracing::error!(error = %e, "job consumer error");
         }
@@ -279,7 +308,7 @@ pub async fn bootstrap(
     let engine = runtime.engine.clone();
     let normalize_registry = runtime.registry.clone();
     let event_producer = producer.clone();
-    tokio::spawn(async move {
+    runtime.tasks.spawn(async move {
         let mut rx = trigger_rx;
         while let Some(mut event) = rx.recv().await {
             // Anti-corruption boundary: every ConnectorEvent entering the
diff --git a/crates/springtale-runtime/src/init.rs b/crates/springtale-runtime/src/init.rs
index 500ba908..590a5a7b 100644
--- a/crates/springtale-runtime/src/init.rs
+++ b/crates/springtale-runtime/src/init.rs
@@ -87,12 +87,19 @@ pub async fn init(
         .unwrap_or_else(|| Arc::new(crate::approval::SentinelChatGate::new(chat_gate.clone())));
     let sentinel = init_sentinel(config, &store, sentinel_gate);
 
+    // Every background task spawned from here on registers in `tasks`
+    // so `RuntimeState::shutdown_tasks` can end them. A task that
+    // outlives its runtime holds an `Arc` clone of the store, which
+    // would keep the database open and the key in memory after a lock
+    // (plan 6.10).
+    let tasks = crate::tasks::TaskHandles::new();
+
     // Start WASM epoch ticker — increments every 1s so wall-clock
     // timeouts actually fire. Without this, a malicious WASM module
     // doing blocking I/O could run forever (fuel only counts instructions).
     {
         let ticker_engine = wasm_engine.engine().clone();
-        tokio::spawn(async move {
+        tasks.spawn(async move {
             let mut interval = tokio::time::interval(std::time::Duration::from_secs(1));
             loop {
                 interval.tick().await;
@@ -109,7 +116,7 @@ pub async fn init(
     // rows but never expired ones.
     {
         let store_sweeper = store.clone();
-        tokio::spawn(async move {
+        tasks.spawn(async move {
             let mut interval = tokio::time::interval(std::time::Duration::from_secs(5));
             loop {
                 interval.tick().await;
@@ -133,7 +140,7 @@ pub async fn init(
     // Cascades to `execution_steps` via the FK ON DELETE CASCADE.
     {
         let store_sweeper = store.clone();
-        tokio::spawn(async move {
+        tasks.spawn(async move {
             let mut interval = tokio::time::interval(std::time::Duration::from_secs(3600));
             loop {
                 interval.tick().await;
@@ -166,7 +173,7 @@ pub async fn init(
     // surfaces stale data. The identifier the sweep uses is the peer's
     // SocketAddr string — the same id chitchat stamps onto incoming
     // entries via `GossipEntry::with_peer_id`.
-    let swim_node = init_swim_node(&config.cooperation, gossip_store.clone()).await?;
+    let swim_node = init_swim_node(&config.cooperation, gossip_store.clone(), &tasks).await?;
 
     // Canvas/A2UI
     let canvas = Arc::new(tokio::sync::RwLock::new(
@@ -196,7 +203,7 @@ pub async fn init(
     {
         let canvas = canvas.clone();
         let mut rx = canvas_tx.subscribe();
-        tokio::spawn(async move {
+        tasks.spawn(async move {
             loop {
                 match rx.recv().await {
                     Ok(update) => {
@@ -217,7 +224,10 @@ pub async fn init(
     let (cooperation_tx, _) = tokio::sync::broadcast::channel(512);
     // Plan §1.15 F/G: utterance ring + def table + the bot-written tick clock.
     let utterances = crate::utterance_ring::UtteranceRing::default();
-    crate::utterance_ring::spawn_collector(utterances.clone(), cooperation_tx.subscribe());
+    tasks.push(crate::utterance_ring::spawn_collector(
+        utterances.clone(),
+        cooperation_tx.subscribe(),
+    ));
     let utterance_defs = Arc::new(config.cooperation.utterances.clone());
     let cadence_tick = Arc::new(std::sync::atomic::AtomicU64::new(0));
     // G6 — cross-formation gossip bus. In-memory default; cross-process
@@ -312,7 +322,7 @@ pub async fn init(
         let mut announcements = chat_gate.subscribe();
         let bridge = capability_bridge.clone();
         let announce_tx = event_tx.clone();
-        tokio::spawn(async move {
+        tasks.spawn(async move {
             while let Ok(req) = announcements.recv().await {
                 let expires_at = req.requested_at
                     + chrono::Duration::from_std(crate::approval::CHAT_APPROVAL_TIMEOUT)
@@ -403,6 +413,8 @@ pub async fn init(
         engine,
         ai_adapter: ai_adapter_handle,
         bot_settings,
+        tasks,
+        activity: crate::activity::ActivityClock::new(),
         sentinel,
         wasm_engine,
         wasm_tier_cache,
@@ -472,6 +484,7 @@ async fn register_persisted_manifest_roles(
 async fn init_swim_node(
     cfg: &crate::config::CooperationConfig,
     gossip_store: Arc<dyn springtale_cooperation::awareness::GossipStore>,
+    tasks: &crate::tasks::TaskHandles,
 ) -> Result<Option<Arc<springtale_cooperation::awareness::SwimNode>>, OperationError> {
     use springtale_cooperation::awareness::{SwimNode, SwimNodeConfig};
     use std::num::NonZeroU32;
@@ -526,7 +539,7 @@ async fn init_swim_node(
         use springtale_cooperation::awareness::{SwimEvent, SwimSelfState};
         let mut rx = node.subscribe();
         let sweep_gossip = gossip_store.clone();
-        tokio::spawn(async move {
+        tasks.spawn(async move {
             loop {
                 match rx.recv().await {
                     Ok(SwimEvent::MemberUp(peer)) => {
diff --git a/crates/springtale-runtime/src/lib.rs b/crates/springtale-runtime/src/lib.rs
index dc38744b..b2f19f64 100644
--- a/crates/springtale-runtime/src/lib.rs
+++ b/crates/springtale-runtime/src/lib.rs
@@ -34,6 +34,7 @@ extern crate connector_signal;
 extern crate connector_slack;
 extern crate connector_telegram;
 
+pub mod activity;
 pub mod approval;
 pub mod client_config;
 pub mod config;
@@ -48,9 +49,11 @@ pub mod notification;
 pub mod operations;
 pub mod quota;
 pub mod state;
+pub mod tasks;
 pub mod triggers;
 pub mod utterance_ring;
 
+pub use activity::ActivityClock;
 pub use approval::{
     ApprovalDecision, ApprovalError, ApprovalGate, ApprovalRequest, ApprovalRequestId,
     DEFAULT_APPROVAL_TIMEOUT, DefaultDenyApprovalGate,
@@ -65,4 +68,5 @@ pub use init::init;
 pub use notification::NotificationEvent;
 pub use quota::SqliteTokenQuota;
 pub use state::{LiveFormationReader, RuntimeState};
+pub use tasks::TaskHandles;
 pub use triggers::{TriggerRegistry, activate_rule, deactivate_rule, wire_connector_events};
diff --git a/crates/springtale-runtime/src/operations/bot_settings.rs b/crates/springtale-runtime/src/operations/bot_settings.rs
index 545385fb..84e76126 100644
--- a/crates/springtale-runtime/src/operations/bot_settings.rs
+++ b/crates/springtale-runtime/src/operations/bot_settings.rs
@@ -54,6 +54,11 @@ fn default_context_window() -> usize {
     50
 }
 
+/// Five minutes, matching the `vault_timeout_secs` this setting replaced.
+fn default_auto_lock_secs() -> u64 {
+    300
+}
+
 /// Session idle timeout: 30 minutes (plan 6.6).
 fn default_session_idle_secs() -> u64 {
     1_800
@@ -91,6 +96,16 @@ pub struct BotSettings {
     #[serde(default)]
     #[schema(value_type = Object)]
     pub tool_policy: springtale_ai::ToolPolicy,
+    /// Idle seconds before the daemon locks itself: drops the runtime,
+    /// closes the database and zeroizes the vault key (plan 6.10).
+    /// `0` disables auto-lock. Default: 300.
+    ///
+    /// Moved here from `springtale_bot::BotConfig::vault_timeout_secs`,
+    /// which nothing read and which could only be changed by editing a
+    /// TOML file and restarting — exactly what the product model
+    /// forbids of a setting.
+    #[serde(default = "default_auto_lock_secs")]
+    pub auto_lock_secs: u64,
     /// Management-API session idle timeout, seconds. A session with no
     /// accepted request inside this window is dropped. Default 1800.
     #[serde(default = "default_session_idle_secs")]
@@ -108,6 +123,7 @@ impl Default for BotSettings {
             persona: BotPersona::default(),
             context_window: default_context_window(),
             tool_policy: springtale_ai::ToolPolicy::default(),
+            auto_lock_secs: default_auto_lock_secs(),
             session_idle_secs: default_session_idle_secs(),
             session_absolute_secs: default_session_absolute_secs(),
         }
@@ -214,5 +230,19 @@ mod tests {
         let settings = get(&*state.store).await.expect("defaults");
         assert_eq!(settings.persona.prefix, '/');
         assert_eq!(settings.context_window, 50);
+        assert_eq!(settings.auto_lock_secs, 300);
+    }
+
+    #[tokio::test]
+    async fn test_auto_lock_secs_round_trips() {
+        let state = boot().await;
+        let settings = BotSettings {
+            auto_lock_secs: 30,
+            ..Default::default()
+        };
+        set(&state, settings).await.expect("store settings");
+        let read_back = get(&*state.store).await.expect("read back");
+        assert_eq!(read_back.auto_lock_secs, 30);
+        assert_eq!(state.bot_settings.load().auto_lock_secs, 30);
     }
 }
diff --git a/crates/springtale-runtime/src/operations/config.rs b/crates/springtale-runtime/src/operations/config.rs
index a8d7ce48..85d7eeec 100644
--- a/crates/springtale-runtime/src/operations/config.rs
+++ b/crates/springtale-runtime/src/operations/config.rs
@@ -222,22 +222,66 @@ pub async fn upsert_connector_config(
     }
 }
 
+/// Config key holding a formation's guard-mode flag. The single source of
+/// truth for the durable copy — every reader goes through
+/// [`formation_guard_engaged`] and the only writer is
+/// [`toggle_formation_guard`].
+fn guard_key(formation_id: &str) -> String {
+    format!("guard:{formation_id}")
+}
+
+/// Whether guard mode is engaged for a formation, read from the durable
+/// config row. Deploy copies this into the live formation's
+/// `constraints.guard_mode`, and [`toggle_formation_guard`] keeps the live
+/// copy in step afterward, so the two agree.
+pub async fn formation_guard_engaged(
+    store: &dyn springtale_store::backend::StorageBackend,
+    formation_id: &str,
+) -> bool {
+    !get_config(store, &guard_key(formation_id))
+        .await
+        .unwrap_or(Value::Null)
+        .is_null()
+}
+
 /// Toggle guard mode for a formation.
 ///
 /// Replaces the frontend read-modify-write pattern on guard config.
+///
+/// Writes the durable config row AND posts `FormationCommand::SetGuard` so the
+/// live `Formation` in the bot tick loop picks the change up on its next
+/// command drain. Without the command the live `constraints.guard_mode` would
+/// keep whatever value deploy gave it, and engaging guard would protect
+/// nothing until the formation was redeployed.
 pub async fn toggle_formation_guard(
     state: &RuntimeState,
     formation_id: &str,
 ) -> Result<bool, OperationError> {
-    let key = format!("guard:{formation_id}");
-    let current = get_config(&*state.store, &key).await?;
-    let is_enabled = !current.is_null();
+    let key = guard_key(formation_id);
+    let is_enabled = formation_guard_engaged(&*state.store, formation_id).await;
     if is_enabled {
         set_config(&*state.store, &key, Value::Null).await?;
     } else {
         set_config(&*state.store, &key, serde_json::json!({ "enabled": true })).await?;
     }
-    Ok(!is_enabled) // returns new state
+    let engaged = !is_enabled;
+    if let Ok(fid) = springtale_cooperation::types::FormationId::parse(formation_id) {
+        let _ = state
+            .formation_cmd_tx
+            .send(
+                springtale_cooperation::command::FormationCommand::SetGuard {
+                    formation_id: fid,
+                    engaged,
+                },
+            )
+            .await;
+    } else {
+        tracing::warn!(
+            formation = %formation_id,
+            "guard toggled on an unparseable formation id — live formation not updated"
+        );
+    }
+    Ok(engaged) // returns new state
 }
 
 #[cfg(test)]
diff --git a/crates/springtale-runtime/src/operations/connectors/chat.rs b/crates/springtale-runtime/src/operations/connectors/chat.rs
index d48ff317..c5f6c5a7 100644
--- a/crates/springtale-runtime/src/operations/connectors/chat.rs
+++ b/crates/springtale-runtime/src/operations/connectors/chat.rs
@@ -48,8 +48,12 @@ pub async fn wire_chat(state: &RuntimeState, name: &str) -> Result<(), Operation
     let bot_tx = state.chat_tx.clone();
     let trigger_registry = state.trigger_registry.clone();
     let fanout_name = name.to_owned();
+    // Inbound chat counts as user activity, so the auto-lock timer
+    // (plan 6.10) does not close the vault under an active conversation.
+    let activity = state.activity.clone();
     tokio::spawn(async move {
         while let Some(msg) = raw_rx.recv().await {
+            activity.touch();
             if !msg.rule_events.is_empty()
                 && let Some(registry) = trigger_registry.get()
             {
diff --git a/crates/springtale-runtime/src/operations/formations.rs b/crates/springtale-runtime/src/operations/formations.rs
index 0f55b380..5da68bfe 100644
--- a/crates/springtale-runtime/src/operations/formations.rs
+++ b/crates/springtale-runtime/src/operations/formations.rs
@@ -138,24 +138,16 @@ pub struct FormationInfo {
     /// Guard badge label derived from `guard_engaged`: "GUARD" when the
     /// guard toggle is engaged, "--" otherwise.
     pub guard_status: String,
-    /// True when guard mode is engaged for this formation. Read from the
-    /// `guard:{formation_id}` config row — the same key `toggle_formation_guard`
-    /// writes (finding 78 / plan 1.12). Gates Dissolve, ChangeIntent,
-    /// RemoveMember, and Rally in `commands.rs::is_enabled_for`.
+    /// True when guard mode is engaged for this formation. Read through
+    /// `config::formation_guard_engaged`, the single accessor for the
+    /// `guard:{formation_id}` config row that `toggle_formation_guard` writes
+    /// (finding 78 / plan 1.12). Gates Dissolve, ChangeIntent, RemoveMember,
+    /// and Rally in `commands.rs::is_enabled_for`.
     ///
-    /// KNOWN DIVERGENCE: this reads the config row, not the live formation's
-    /// `constraints.guard_mode`. The `formation:guard` toggle writes only the
-    /// config row; the live `Formation` in the bot tick loop (which
-    /// `tick_steps/handle_command.rs::guarded` checks) reads
-    /// `constraints.guard_mode`, set once at deploy/spawn time and never
-    /// refreshed from the config row afterward. `LiveFormationReader` has no
-    /// accessor for a live formation's `constraints.guard_mode` today, so
-    /// there is no way to source this field from the live formation without
-    /// extending that trait — out of scope for this change. The two can
-    /// therefore disagree: toggling guard on a formation whose bot process
-    /// already has it live-loaded updates the UI eligibility (this field)
-    /// immediately, but the live enforcement in `handle_command.rs` will not
-    /// see the change until the formation is redeployed.
+    /// The row and the live formation's `constraints.guard_mode` cannot
+    /// disagree: `toggle_formation_guard` writes the row and posts
+    /// `FormationCommand::SetGuard` in the same call, so live enforcement in
+    /// `handle_command.rs::guarded` sees a toggle without a redeploy.
     pub guard_engaged: bool,
     /// Rally tokens remaining (Monster Hunter carts, §15).
     pub rally_tokens: i64,
@@ -582,11 +574,8 @@ pub async fn list_formations(state: &RuntimeState) -> Result<Vec<FormationInfo>,
 
         let momentum_label = tier_label(&momentum_tier);
         let capabilities = tier_capabilities(&momentum_tier);
-        // See `guard_engaged` doc comment for the live-vs-config divergence.
-        let guard_engaged = !config::get_config(&*state.store, &format!("guard:{}", f.id))
-            .await
-            .unwrap_or(serde_json::Value::Null)
-            .is_null();
+        // Single accessor for the guard row — see `guard_engaged`.
+        let guard_engaged = config::formation_guard_engaged(&*state.store, &f.id).await;
         let guard_status = guard_status_label(guard_engaged).to_owned();
 
         // Operational count: prefer the live reader (accurate — reads
diff --git a/crates/springtale-runtime/src/operations/mod.rs b/crates/springtale-runtime/src/operations/mod.rs
index cbe98fb8..5b9ebefb 100644
--- a/crates/springtale-runtime/src/operations/mod.rs
+++ b/crates/springtale-runtime/src/operations/mod.rs
@@ -35,7 +35,6 @@ pub mod recipes;
 pub mod rules;
 pub mod safety;
 pub mod sessions;
-pub mod templates;
 pub mod test_step;
 pub mod travel;
 pub mod vault;
diff --git a/crates/springtale-runtime/src/operations/recipes/builtin/ai_assistant.rs b/crates/springtale-runtime/src/operations/recipes/builtin/ai_assistant.rs
index 5364ca1d..77668318 100644
--- a/crates/springtale-runtime/src/operations/recipes/builtin/ai_assistant.rs
+++ b/crates/springtale-runtime/src/operations/recipes/builtin/ai_assistant.rs
@@ -12,6 +12,7 @@ use super::super::types::{
 pub fn all() -> Vec<Recipe> {
     vec![
         llm_assistant(),
+        llm_swarm(),
         ai_translate_incoming(),
         ai_wellness_check_in(),
         ai_cw_classifier(),
@@ -101,6 +102,85 @@ fn llm_assistant() -> Recipe {
     }
 }
 
+// ── LLM swarm (researcher → writer → critic) ───────────────────
+
+fn llm_swarm() -> Recipe {
+    Recipe {
+        id: "llm-swarm".into(),
+        name: "LLM Swarm".into(),
+        description:
+            "Three AI passes — researcher, writer, critic — over a single prompt sent in chat."
+                .into(),
+        icon_id: "robot".into(),
+        category: RecipeCategory::AiAssistant,
+        tags: vec!["ai".into(), "swarm".into(), "chat".into()],
+        connectors_used: vec!["connector-telegram".into()],
+        ai_required: true,
+        difficulty: Difficulty::Power,
+        source: RecipeSource::Builtin,
+        inputs: vec![
+            InputField {
+                id: "telegram_token".into(),
+                label: "Telegram bot token".into(),
+                kind: FieldKind::Secret,
+                visibility: FieldVisibility::Required,
+                default: None,
+                hint: Some("From @BotFather. The swarm answers messages in this chat.".into()),
+            },
+            InputField {
+                id: "topic".into(),
+                label: "Subject the swarm is briefed on".into(),
+                kind: FieldKind::Text,
+                visibility: FieldVisibility::Optional,
+                default: Some(json!("the message it is given")),
+                hint: Some("Steers all three passes; leave as-is for a general assistant.".into()),
+            },
+        ],
+        blueprint: RecipeBlueprint {
+            connector_configs: vec![ConnectorConfigStep {
+                connector_name: "connector-telegram".into(),
+                config: json!({ "bot_token": "${telegram_token}" }),
+            }],
+            rules: vec![RuleStep {
+                toml: r#"name = "llm-swarm"
+
+[trigger]
+type = "ConnectorEvent"
+connector = "connector-telegram"
+event = "message"
+
+[[actions]]
+type = "AiComplete"
+prompt = "You are the researcher. Gather the facts that matter about ${topic}, given this request. Reply with notes only, no prose.\n\n${trigger.text}"
+
+[[actions]]
+type = "AiComplete"
+prompt = "You are the writer. Turn these research notes into a clear, direct answer.\n\n${last_ai_output}"
+
+[[actions]]
+type = "AiComplete"
+prompt = "You are the critic. Correct anything wrong or unsupported in this draft and return the improved final answer only.\n\n${last_ai_output}"
+
+[[actions]]
+type = "RunConnector"
+connector = "connector-telegram"
+action = "send_message"
+
+[actions.params]
+chat_id = "${trigger.chat_id}"
+text = "${last_ai_output}"
+"#
+                .into(),
+            }],
+            ai_config: None,
+            summary: Some(
+                "Every chat message runs through three AI passes — research, draft, critique — before the reply is sent.".into(),
+            ),
+            derived_inputs: vec![],
+        },
+    }
+}
+
 // ── AI translate incoming ─────────────────────────────────────
 
 fn ai_translate_incoming() -> Recipe {
diff --git a/crates/springtale-runtime/src/operations/recipes/builtin/coding.rs b/crates/springtale-runtime/src/operations/recipes/builtin/coding.rs
index ac8ef5c7..f302c80c 100644
--- a/crates/springtale-runtime/src/operations/recipes/builtin/coding.rs
+++ b/crates/springtale-runtime/src/operations/recipes/builtin/coding.rs
@@ -20,6 +20,7 @@ use super::super::types::{
 pub fn all() -> Vec<Recipe> {
     vec![
         github_pr_watcher(),
+        github_monitor(),
         code_review(),
         github_push_discord(),
         github_issue_telegram(),
@@ -98,6 +99,96 @@ text = "New PR in ${repo}: ${trigger.title} (#${trigger.number})"
     }
 }
 
+// ── GitHub monitor → Telegram ──────────────────────────────────
+
+fn github_monitor() -> Recipe {
+    Recipe {
+        id: "github-monitor".into(),
+        name: "GitHub Monitor".into(),
+        description: "Push notifications from a GitHub repository land in a Telegram chat.".into(),
+        icon_id: "github".into(),
+        category: RecipeCategory::Coding,
+        tags: vec!["github".into(), "telegram".into(), "notification".into()],
+        connectors_used: vec!["connector-github".into(), "connector-telegram".into()],
+        ai_required: false,
+        difficulty: Difficulty::Standard,
+        source: RecipeSource::Builtin,
+        inputs: vec![
+            InputField {
+                id: "github_token".into(),
+                label: "GitHub personal access token".into(),
+                kind: FieldKind::Secret,
+                visibility: FieldVisibility::Required,
+                default: None,
+                hint: Some("Create at github.com/settings/tokens with repo scope.".into()),
+            },
+            InputField {
+                id: "repo".into(),
+                label: "Repository (owner/name)".into(),
+                kind: FieldKind::Text,
+                visibility: FieldVisibility::Required,
+                default: None,
+                hint: Some("e.g. octocat/hello-world".into()),
+            },
+            InputField {
+                id: "telegram_token".into(),
+                label: "Telegram bot token".into(),
+                kind: FieldKind::Secret,
+                visibility: FieldVisibility::Required,
+                default: None,
+                hint: Some("From @BotFather.".into()),
+            },
+            InputField {
+                id: "chat_id".into(),
+                label: "Telegram chat ID".into(),
+                kind: FieldKind::Text,
+                visibility: FieldVisibility::Required,
+                default: None,
+                hint: Some("The chat the notifications are posted to.".into()),
+            },
+        ],
+        blueprint: RecipeBlueprint {
+            connector_configs: vec![
+                ConnectorConfigStep {
+                    connector_name: "connector-github".into(),
+                    config: json!({
+                        "access_token": "${github_token}",
+                        "watched_repos": ["${repo}"]
+                    }),
+                },
+                ConnectorConfigStep {
+                    connector_name: "connector-telegram".into(),
+                    config: json!({ "bot_token": "${telegram_token}" }),
+                },
+            ],
+            rules: vec![RuleStep {
+                toml: r#"name = "github-push-notify"
+
+[trigger]
+type = "ConnectorEvent"
+connector = "connector-github"
+event = "push"
+
+[[actions]]
+type = "RunConnector"
+connector = "connector-telegram"
+action = "send_message"
+
+[actions.params]
+chat_id = "${chat_id}"
+text = "Push to ${repo} by ${trigger.pusher}: ${trigger.head_commit_message}"
+"#
+                .into(),
+            }],
+            ai_config: None,
+            summary: Some(
+                "Watches a GitHub repository and posts every push to a Telegram chat.".into(),
+            ),
+            derived_inputs: vec![],
+        },
+    }
+}
+
 // ── Code review (AI) ───────────────────────────────────────────
 
 fn code_review() -> Recipe {
diff --git a/crates/springtale-runtime/src/operations/templates.rs b/crates/springtale-runtime/src/operations/templates.rs
deleted file mode 100644
index bb463cd7..00000000
--- a/crates/springtale-runtime/src/operations/templates.rs
+++ /dev/null
@@ -1,828 +0,0 @@
-//! Starter project templates — shared across CLI, desktop wizard, and web.
-//!
-//! `springtale new <template>` in the CLI and the "Create from template"
-//! flow in the Tauri wizard both call this module. No frontend duplicates
-//! template content.
-//!
-//! Security notes:
-//!   - Template files are static, embedded constants. No user content is
-//!     interpolated before writing to disk.
-//!   - [`write_to`] validates that the destination directory is either
-//!     empty or missing, and refuses to overwrite existing files. This
-//!     prevents accidentally clobbering an in-progress project.
-//!   - Templates never include real secrets — they ship with explicit
-//!     `YOUR_*` placeholders and pair with guidance pointing the user at
-//!     the vault UI, per the product model rule "don't tell users to edit
-//!     a TOML file."
-
-use specta::Type;
-use std::io;
-use std::path::{Path, PathBuf};
-
-use chrono::Utc;
-use serde::Serialize;
-
-/// A static starter template.
-#[derive(Debug, Clone, Serialize, Type, utoipa::ToSchema)]
-pub struct Template {
-    pub name: &'static str,
-    pub description: &'static str,
-    /// Relative files the template writes into the destination dir.
-    pub files: &'static [TemplateFile],
-}
-
-#[derive(Debug, Clone, Serialize, Type, utoipa::ToSchema)]
-pub struct TemplateFile {
-    pub relative_path: &'static str,
-    pub contents: &'static str,
-}
-
-/// Outcome of writing a template to disk.
-#[derive(Debug, Clone, Serialize, Type, utoipa::ToSchema)]
-pub struct WriteReport {
-    pub template: &'static str,
-    #[schema(value_type = String)]
-    pub dir: PathBuf,
-    #[schema(value_type = Vec<String>)]
-    pub created: Vec<PathBuf>,
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum TemplateError {
-    #[error("unknown template: {0}")]
-    Unknown(String),
-    #[error("destination exists and is not empty: {0}")]
-    DestinationNotEmpty(PathBuf),
-    #[error("refusing to overwrite existing file: {0}")]
-    WouldOverwrite(PathBuf),
-    #[error("io error: {0}")]
-    Io(#[from] io::Error),
-}
-
-/// List every available template.
-pub fn list() -> &'static [Template] {
-    TEMPLATES
-}
-
-/// Look up one template by name.
-pub fn get(name: &str) -> Option<&'static Template> {
-    TEMPLATES.iter().find(|t| t.name == name)
-}
-
-/// Write a template's files into a daemon-chosen directory.
-///
-/// The daemon picks the destination path under `$DATA_DIR/projects/`
-/// to prevent path-traversal attacks (OWASP ASVS §12.3). The caller
-/// (CLI or API) never supplies a destination — only the template name.
-/// Writes go through `cap_std::fs::Dir` so even a symlink race can't
-/// escape the sandbox.
-pub fn write_to(name: &str) -> Result<WriteReport, TemplateError> {
-    let template = get(name).ok_or_else(|| TemplateError::Unknown(name.to_owned()))?;
-
-    let projects_dir = springtale_store::paths::data_dir().join("projects");
-    std::fs::create_dir_all(&projects_dir)?;
-
-    let slug = format!("{}-{}", name, Utc::now().format("%Y%m%d-%H%M%S"));
-    let dest = projects_dir.join(&slug);
-    if dest.exists() {
-        return Err(TemplateError::DestinationNotEmpty(dest));
-    }
-    std::fs::create_dir_all(&dest)?;
-
-    let sandbox = cap_std::fs::Dir::open_ambient_dir(&dest, cap_std::ambient_authority())
-        .map_err(TemplateError::Io)?;
-
-    let mut created = Vec::with_capacity(template.files.len());
-    for file in template.files {
-        if let Some(parent) = Path::new(file.relative_path).parent()
-            && !parent.as_os_str().is_empty()
-        {
-            sandbox.create_dir_all(parent).map_err(TemplateError::Io)?;
-        }
-        sandbox
-            .write(file.relative_path, file.contents)
-            .map_err(TemplateError::Io)?;
-        created.push(dest.join(file.relative_path));
-    }
-
-    Ok(WriteReport {
-        template: template.name,
-        dir: dest,
-        created,
-    })
-}
-
-// ---------- Template contents ----------
-//
-// Each starter:
-//   - Uses `YOUR_*` placeholders for secrets.
-//   - Points users at `springtale vault set` (or the dashboard) rather
-//     than asking them to edit TOML secrets by hand.
-//   - Ships with a working rule they can see fire immediately.
-
-const TELEGRAM_BOT_TOML: &str = r#"# Springtale — Telegram Bot Starter.
-# After running `springtale new telegram-bot`, store your bot token in the
-# vault with: springtale vault set telegram.bot_token
-# (Do NOT paste real secrets into this file.)
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-[telegram]
-bot_token = "YOUR_BOT_TOKEN"   # placeholder — set via `springtale vault set`
-update_mode = "polling"
-"#;
-
-const TELEGRAM_WELCOME_RULE: &str = r#"# Example rule: greet new users on /start.
-[rule]
-name = "welcome"
-
-[trigger]
-type = "ConnectorEvent"
-connector = "connector-telegram"
-event = "command_received"
-
-[trigger.conditions]
-field_equals = { field = "command", value = "/start" }
-
-[[actions]]
-type = "RunConnector"
-connector = "connector-telegram"
-action = "send_message"
-
-[actions.params]
-chat_id = "${trigger.chat.id}"
-text = "Welcome to Springtale! Type /help for available commands."
-"#;
-
-const GITHUB_MONITOR_TOML: &str = r#"# Springtale — GitHub Monitor Starter.
-# Store tokens in the vault, not here:
-#   springtale vault set telegram.bot_token
-#   springtale vault set github.token
-#   springtale vault set github.webhook_secret
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-[telegram]
-bot_token = "YOUR_TELEGRAM_BOT_TOKEN"
-update_mode = "polling"
-
-[github]
-token = "YOUR_GITHUB_PAT"
-webhook_secret = "YOUR_WEBHOOK_SECRET"
-"#;
-
-const GITHUB_PUSH_RULE: &str = r#"# Rule: GitHub push → Telegram notification.
-[rule]
-name = "github-push-notify"
-
-[trigger]
-type = "ConnectorEvent"
-connector = "connector-github"
-event = "push"
-
-[[actions]]
-type = "RunConnector"
-connector = "connector-telegram"
-action = "send_message"
-
-[actions.params]
-chat_id = "YOUR_TELEGRAM_CHAT_ID"
-text = "Push to ${trigger.repository.full_name}: ${trigger.head_commit.message}"
-"#;
-
-const CRON_RUNNER_TOML: &str = r#"# Springtale — Cron Runner Starter.
-# Runs scheduled tasks with no chat connector required.
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-"#;
-
-const CRON_HEARTBEAT_RULE: &str = r#"# Rule: heartbeat every 5 minutes.
-[rule]
-name = "heartbeat"
-
-[trigger]
-type = "Cron"
-expression = "0 */5 * * * *"
-
-[[actions]]
-type = "SendMessage"
-text = "Heartbeat: system is alive at ${trigger.fired_at}"
-"#;
-
-const LLM_ASSISTANT_TOML: &str = r#"# Springtale — LLM Assistant Starter.
-# AI-powered chat bot. Uncomment ONE provider section, and store the key
-# in the vault rather than pasting it inline:
-#   springtale vault set openai.api_key
-#   springtale vault set anthropic.api_key
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-[telegram]
-bot_token = "YOUR_TELEGRAM_BOT_TOKEN"
-update_mode = "polling"
-
-# [ollama]
-# base_url = "http://localhost:11434"
-# model = "llama3.2"
-
-# [openai]
-# base_url = "https://api.openai.com"
-# api_key = "YOUR_OPENAI_KEY"
-# model = "gpt-4o"
-
-# [anthropic]
-# api_key = "YOUR_ANTHROPIC_KEY"
-# model = "claude-sonnet-4-6"
-"#;
-
-// ── Templates added to satisfy COOPERATION_IMPLEMENTATION_PLAN.md §8 ──────
-// Minimum 10 starter templates (§16.9). Plan §8 table names the full set;
-// the constants below implement the remaining entries.
-
-const BLANK_BOT_TOML: &str = r#"# Springtale — Blank Bot Starter.
-# Empty skeleton for experts. Add connectors, rules, and vault entries by hand.
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-"#;
-
-const CLI_RUNNER_TOML: &str = r#"# Springtale — CLI Task Runner Starter.
-# Headless CLI that spawns a formation for a one-shot task.
-# See COOPERATION_IMPLEMENTATION_PLAN.md §7.1 for the full design.
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-"#;
-
-const CLI_RUNNER_RULE: &str = r#"# Rule: kick off a task when /run is fired via `springtale send`.
-[rule]
-name = "cli-run-task"
-
-[trigger]
-type = "Cron"
-# Once per minute — the real trigger is `springtale send` / `springtale run`.
-expression = "0 * * * * *"
-
-[[actions]]
-type = "SendMessage"
-text = "Formation is idle. Run `springtale send <text>` to drive a task."
-"#;
-
-const LLM_SWARM_TOML: &str = r#"# Springtale — LLM Swarm Starter.
-# Three cooperating agents on a single prompt (researcher, writer, critic).
-# Full cooperation module exercised. See plan §7.2.
-# Store the AI provider key in the vault:
-#   springtale vault set openai.api_key
-#   (or anthropic.api_key / configure ollama base_url)
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-# Pick ONE AI provider section:
-
-# [ollama]
-# base_url = "http://localhost:11434"
-# model = "llama3.2"
-
-# [openai]
-# base_url = "https://api.openai.com"
-# api_key = "YOUR_OPENAI_KEY"
-# model = "gpt-4o"
-
-# [anthropic]
-# api_key = "YOUR_ANTHROPIC_KEY"
-# model = "claude-sonnet-4-6"
-"#;
-
-const DISCORD_BOT_TOML: &str = r#"# Springtale — Discord Bot Starter.
-# Store the bot token in the vault rather than pasting it inline:
-#   springtale vault set discord.bot_token
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-[discord]
-bot_token = "YOUR_DISCORD_BOT_TOKEN"
-"#;
-
-const DISCORD_WELCOME_RULE: &str = r#"# Rule: greet new members on !start.
-[rule]
-name = "discord-welcome"
-
-[trigger]
-type = "ConnectorEvent"
-connector = "connector-discord"
-event = "command_received"
-
-[trigger.conditions]
-field_equals = { field = "command", value = "!start" }
-
-[[actions]]
-type = "RunConnector"
-connector = "connector-discord"
-action = "send_message"
-
-[actions.params]
-channel_id = "${trigger.channel_id}"
-content = "Welcome to the Discord bot. Type !help for available commands."
-"#;
-
-const MATRIX_BOT_TOML: &str = r#"# Springtale — Matrix Bot Starter.
-# Matrix/Element chatbot. Matrix connector is planned; the template is
-# ready so the moment `connector-matrix` ships this starter just works.
-# Store the Matrix token in the vault:
-#   springtale vault set matrix.access_token
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-[matrix]
-homeserver = "https://matrix.org"
-user_id = "@YOUR_BOT:matrix.org"
-access_token = "YOUR_MATRIX_ACCESS_TOKEN"
-"#;
-
-const WEBHOOK_RECEIVER_TOML: &str = r#"# Springtale — Webhook Receiver Starter.
-# Turn any inbound HTTP webhook into a cooperation formation that
-# fans out to one or more actions. No chat connector required.
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-"#;
-
-const WEBHOOK_RECEIVER_RULE: &str = r#"# Rule: any inbound POST on /webhook/custom-event → SendMessage + log.
-[rule]
-name = "webhook-fanout"
-
-[trigger]
-type = "Webhook"
-path = "custom-event"
-
-[[actions]]
-type = "SendMessage"
-text = "Webhook received: ${trigger.body}"
-
-[[actions]]
-type = "Notify"
-title = "webhook-receiver"
-body  = "payload received — check logs"
-"#;
-
-const FILE_WATCHER_TOML: &str = r#"# Springtale — File Watcher Starter.
-# Filesystem event → cooperation formation. Set the watched path via
-#   springtale config set filesystem.watch_path /absolute/path
-# and the notification scheme via the rule below.
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-"#;
-
-const FILE_WATCHER_RULE: &str = r#"# Rule: any filesystem change → Notify.
-[rule]
-name = "file-watcher-alert"
-
-[trigger]
-type = "FilesystemEvent"
-path = "${config.filesystem.watch_path}"
-
-[[actions]]
-type = "Notify"
-title = "file changed"
-body  = "${trigger.path} (${trigger.kind})"
-"#;
-
-const RESEARCH_ASSISTANT_TOML: &str = r#"# Springtale — Research Assistant Starter.
-# Multi-source research LLM swarm with cited output. Spawns a formation of
-# three agents (collect → synthesize → cite) on each user query.
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-[telegram]
-bot_token = "YOUR_TELEGRAM_BOT_TOKEN"
-update_mode = "polling"
-
-# Pick ONE provider:
-
-# [ollama]
-# base_url = "http://localhost:11434"
-# model = "llama3.2"
-
-# [openai]
-# base_url = "https://api.openai.com"
-# api_key = "YOUR_OPENAI_KEY"
-# model = "gpt-4o"
-"#;
-
-const CODE_REVIEW_SWARM_TOML: &str = r#"# Springtale — Code Review Swarm Starter.
-# Git-diff → 3-agent review (readability, correctness, security). Runs on
-# GitHub pull-request webhook. Store tokens in vault:
-#   springtale vault set github.token
-#   springtale vault set github.webhook_secret
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-[github]
-token = "YOUR_GITHUB_PAT"
-webhook_secret = "YOUR_WEBHOOK_SECRET"
-
-# Pick ONE provider:
-
-# [ollama]
-# base_url = "http://localhost:11434"
-# model = "llama3.2"
-
-# [anthropic]
-# api_key = "YOUR_ANTHROPIC_KEY"
-# model = "claude-sonnet-4-6"
-"#;
-
-const CODE_REVIEW_RULE: &str = r#"# Rule: pull_request opened → post review comment (stub).
-[rule]
-name = "code-review-pr"
-
-[trigger]
-type = "ConnectorEvent"
-connector = "connector-github"
-event = "pull_request"
-
-[trigger.conditions]
-field_equals = { field = "action", value = "opened" }
-
-[[actions]]
-type = "RunConnector"
-connector = "connector-github"
-action = "create_review_comment"
-
-[actions.params]
-repo = "${trigger.repository.full_name}"
-pr_number = "${trigger.pull_request.number}"
-body = "Automated review in progress — see formation logs."
-"#;
-
-const MEETING_SUMMARIZER_TOML: &str = r#"# Springtale — Meeting Summarizer Starter.
-# Audio / transcript → structured summary via an LLM swarm of three roles
-# (transcript_cleaner, key_point_extractor, summary_writer). The bot runs
-# locally by default; no audio ever leaves the device.
-#
-# Store any provider credentials in the vault:
-#   springtale vault set openai.api_key     # optional
-#   springtale vault set anthropic.api_key  # optional
-
-[store]
-path = "springtale.db"
-
-[crypto]
-vault_path = "vault.bin"
-
-[api]
-bind = "127.0.0.1:8080"
-
-# Watch a transcripts directory — drop a .txt / .vtt / .srt and a formation
-# is spawned per file. The three roles coordinate via the cooperation
-# module: role-scoped capabilities, shared cadence, handoff between stages.
-[[filesystem.watch]]
-path = "./transcripts"
-events = ["create", "modify"]
-
-# Pick ONE LLM provider (or none — NoopAdapter produces a canned summary).
-
-# [ollama]
-# base_url = "http://localhost:11434"
-# model = "llama3.2"
-
-# [openai]
-# api_key = "YOUR_OPENAI_KEY"
-# model = "gpt-4o-mini"
-
-# [anthropic]
-# api_key = "YOUR_ANTHROPIC_KEY"
-# model = "claude-sonnet-4-6"
-"#;
-
-const MEETING_SUMMARIZER_RULE: &str = r#"# Rule: new transcript file → spawn a meeting-summarizer formation.
-[rule]
-name = "meeting-summarizer"
-
-[trigger]
-type = "FileWatch"
-path = "./transcripts"
-event = "create"
-
-[[actions]]
-type = "AiComplete"
-prompt = "Summarize the meeting transcript at ${trigger.path}. Output sections: attendees, decisions, action items, open questions."
-"#;
-
-static TEMPLATES: &[Template] = &[
-    Template {
-        name: "telegram-bot",
-        description: "Telegram bot with a /start welcome rule",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: TELEGRAM_BOT_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/welcome.toml",
-                contents: TELEGRAM_WELCOME_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "github-monitor",
-        description: "GitHub webhook → Telegram push notifications",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: GITHUB_MONITOR_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/github-push-notify.toml",
-                contents: GITHUB_PUSH_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "cron-runner",
-        description: "Scheduled task automation (no chat connector)",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: CRON_RUNNER_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/heartbeat.toml",
-                contents: CRON_HEARTBEAT_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "llm-assistant",
-        description: "AI-powered chat assistant (Ollama/OpenAI/Anthropic)",
-        files: &[TemplateFile {
-            relative_path: "springtale.toml",
-            contents: LLM_ASSISTANT_TOML,
-        }],
-    },
-    Template {
-        name: "blank-bot",
-        description: "Empty skeleton for experts — no connectors, no rules",
-        files: &[TemplateFile {
-            relative_path: "springtale.toml",
-            contents: BLANK_BOT_TOML,
-        }],
-    },
-    Template {
-        name: "cli-runner",
-        description: "Headless CLI task runner — spawns a formation per task (plan §7.1)",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: CLI_RUNNER_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/idle-heartbeat.toml",
-                contents: CLI_RUNNER_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "llm-swarm",
-        description: "3-agent LLM swarm (researcher/writer/critic) on a single prompt (plan §7.2)",
-        files: &[TemplateFile {
-            relative_path: "springtale.toml",
-            contents: LLM_SWARM_TOML,
-        }],
-    },
-    Template {
-        name: "discord-bot",
-        description: "Discord bot with a !start welcome rule",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: DISCORD_BOT_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/welcome.toml",
-                contents: DISCORD_WELCOME_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "matrix-bot",
-        description: "Matrix/Element chatbot skeleton — ready for connector-matrix",
-        files: &[TemplateFile {
-            relative_path: "springtale.toml",
-            contents: MATRIX_BOT_TOML,
-        }],
-    },
-    Template {
-        name: "webhook-receiver",
-        description: "HTTP webhook → cooperation formation fan-out",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: WEBHOOK_RECEIVER_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/webhook-fanout.toml",
-                contents: WEBHOOK_RECEIVER_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "file-watcher",
-        description: "Filesystem event → cooperation formation",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: FILE_WATCHER_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/file-changed-alert.toml",
-                contents: FILE_WATCHER_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "research-assistant",
-        description: "Multi-source research LLM swarm with cited output",
-        files: &[TemplateFile {
-            relative_path: "springtale.toml",
-            contents: RESEARCH_ASSISTANT_TOML,
-        }],
-    },
-    Template {
-        name: "code-review-swarm",
-        description: "Git diff → 3-agent code review (readability / correctness / security)",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: CODE_REVIEW_SWARM_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/pr-opened.toml",
-                contents: CODE_REVIEW_RULE,
-            },
-        ],
-    },
-    Template {
-        name: "meeting-summarizer",
-        description: "Audio/transcript → structured summary LLM swarm",
-        files: &[
-            TemplateFile {
-                relative_path: "springtale.toml",
-                contents: MEETING_SUMMARIZER_TOML,
-            },
-            TemplateFile {
-                relative_path: "rules/new-transcript.toml",
-                contents: MEETING_SUMMARIZER_RULE,
-            },
-        ],
-    },
-];
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn list_contains_every_known_template() {
-        let names: Vec<_> = list().iter().map(|t| t.name).collect();
-        for expected in [
-            // Existing templates
-            "telegram-bot",
-            "github-monitor",
-            "cron-runner",
-            "llm-assistant",
-            // Added for plan §8 coverage (≥10 starters)
-            "blank-bot",
-            "cli-runner",
-            "llm-swarm",
-            "discord-bot",
-            "matrix-bot",
-            "webhook-receiver",
-            "file-watcher",
-            "research-assistant",
-            "code-review-swarm",
-            "meeting-summarizer",
-        ] {
-            assert!(
-                names.contains(&expected),
-                "template list missing `{expected}`"
-            );
-        }
-    }
-
-    #[test]
-    fn template_count_meets_plan_minimum() {
-        // Plan §16.9 requires ≥10 starter templates.
-        assert!(
-            list().len() >= 10,
-            "expected ≥10 templates per plan §16.9, got {}",
-            list().len()
-        );
-    }
-
-    #[test]
-    fn get_returns_none_for_unknown() {
-        assert!(get("does-not-exist").is_none());
-    }
-
-    #[test]
-    fn write_to_creates_all_files() {
-        // write_to now picks its own path under $DATA_DIR/projects/,
-        // so we just verify it works with a known template.
-        let report = write_to("telegram-bot").unwrap();
-        assert_eq!(report.template, "telegram-bot");
-        assert!(report.dir.join("springtale.toml").exists());
-        assert!(report.dir.join("rules/welcome.toml").exists());
-        // Clean up
-        let _ = std::fs::remove_dir_all(&report.dir);
-    }
-}
diff --git a/crates/springtale-runtime/src/state.rs b/crates/springtale-runtime/src/state.rs
index 95891632..58f1d357 100644
--- a/crates/springtale-runtime/src/state.rs
+++ b/crates/springtale-runtime/src/state.rs
@@ -59,6 +59,18 @@ pub struct RuntimeState {
     /// `ArcSwap` so the chat hot path reads them lock-free and a `PUT
     /// /bot/settings` takes effect on the next message, with no restart.
     pub bot_settings: Arc<ArcSwap<crate::operations::bot_settings::BotSettings>>,
+    /// Every long-lived background task spawned for this runtime —
+    /// `init`'s sweepers and tickers, the embedded job consumer and
+    /// trigger event loop. Each of them captured an `Arc` clone of the
+    /// store or the whole state, so locking the daemon (plan 6.10) has
+    /// to `shutdown()` this before it can drop the `RuntimeState` and
+    /// have the SQLite handle actually close and the key zeroize.
+    pub tasks: crate::tasks::TaskHandles,
+    /// When this runtime last handled something a person asked for —
+    /// an authenticated API request or an inbound chat message. The
+    /// daemon's auto-lock timer (plan 6.10) reads it; the chat fan-out
+    /// and the API's request path write it.
+    pub activity: crate::activity::ActivityClock,
     /// Sentinel behavioral monitor.
     pub sentinel: Arc<springtale_sentinel::Sentinel>,
     /// Shared WASM engine for community connectors.
diff --git a/crates/springtale-runtime/src/tasks.rs b/crates/springtale-runtime/src/tasks.rs
new file mode 100644
index 00000000..7b621116
--- /dev/null
+++ b/crates/springtale-runtime/src/tasks.rs
@@ -0,0 +1,130 @@
+//! Handles to the background tasks one [`RuntimeState`] owns.
+//!
+//! [`RuntimeState`]: crate::state::RuntimeState
+//!
+//! Locking the daemon (plan 6.10) drops the `RuntimeState` so the SQLite
+//! handle closes and the database key zeroizes. That only works if
+//! nothing else is still holding a clone — and `init` plus
+//! `bootstrap_embedded` spawn a dozen long-lived tasks that each captured
+//! `store`, `registry` or the whole state. Every one of them registers
+//! here, so [`TaskHandles::shutdown`] can abort them *and wait for the
+//! abort to land* before the caller drops its own clone.
+//!
+//! Awaiting matters: `JoinHandle::abort` only marks a task for
+//! cancellation. The captured `Arc`s are released when the executor
+//! actually drops the task, and awaiting the handle is the one
+//! synchronisation point that guarantees it happened.
+
+use std::future::Future;
+use std::sync::{Arc, Mutex};
+
+use tokio::task::JoinHandle;
+
+/// A shared, cloneable set of spawned background tasks.
+///
+/// Cheap to clone — every clone refers to the same list, so a task
+/// spawned through any clone is aborted by `shutdown` on any other.
+#[derive(Clone, Default)]
+pub struct TaskHandles {
+    inner: Arc<Mutex<Vec<JoinHandle<()>>>>,
+}
+
+impl TaskHandles {
+    /// An empty registry.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Register an already-spawned task.
+    pub fn push(&self, handle: JoinHandle<()>) {
+        // A poisoned mutex means some other thread panicked while
+        // holding it. The list itself is still structurally sound (a
+        // `Vec<JoinHandle>` push cannot leave a torn value), and losing
+        // track of a task would defeat the whole point of this type, so
+        // recover rather than propagate.
+        match self.inner.lock() {
+            Ok(mut list) => list.push(handle),
+            Err(poisoned) => poisoned.into_inner().push(handle),
+        }
+    }
+
+    /// `tokio::spawn` the future and register the handle in one step.
+    pub fn spawn<F>(&self, future: F)
+    where
+        F: Future<Output = ()> + Send + 'static,
+    {
+        self.push(tokio::spawn(future));
+    }
+
+    /// How many tasks are currently registered.
+    pub fn len(&self) -> usize {
+        match self.inner.lock() {
+            Ok(list) => list.len(),
+            Err(poisoned) => poisoned.into_inner().len(),
+        }
+    }
+
+    /// Whether no task is registered.
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Abort every registered task and wait for each to stop.
+    ///
+    /// Returns how many were aborted. Idempotent — the list is drained,
+    /// so a second call is a no-op.
+    pub async fn shutdown(&self) -> usize {
+        let handles: Vec<JoinHandle<()>> = match self.inner.lock() {
+            Ok(mut list) => std::mem::take(&mut *list),
+            Err(poisoned) => std::mem::take(&mut *poisoned.into_inner()),
+        };
+        for handle in &handles {
+            handle.abort();
+        }
+        let count = handles.len();
+        for handle in handles {
+            // `Err(JoinError::Cancelled)` is the expected outcome; what
+            // matters is that awaiting returns only once the task has
+            // been dropped and its captured state released.
+            let _ = handle.await;
+        }
+        count
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, clippy::expect_used)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_shutdown_aborts_and_releases_captured_state() {
+        let tasks = TaskHandles::new();
+        let captured = Arc::new(());
+        let held = captured.clone();
+        tasks.spawn(async move {
+            let _keep = held;
+            // Never completes — only an abort ends this task.
+            std::future::pending::<()>().await;
+        });
+        assert_eq!(tasks.len(), 1);
+        assert_eq!(Arc::strong_count(&captured), 2);
+
+        assert_eq!(tasks.shutdown().await, 1);
+
+        assert!(tasks.is_empty());
+        assert_eq!(
+            Arc::strong_count(&captured),
+            1,
+            "aborted task must have released its captured Arc"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_shutdown_is_idempotent() {
+        let tasks = TaskHandles::new();
+        tasks.spawn(async {});
+        assert_eq!(tasks.shutdown().await, 1);
+        assert_eq!(tasks.shutdown().await, 0);
+    }
+}
diff --git a/docs/current-arch/ARCHITECTURE.md b/docs/current-arch/ARCHITECTURE.md
index 54a7589b..bb2dc837 100644
--- a/docs/current-arch/ARCHITECTURE.md
+++ b/docs/current-arch/ARCHITECTURE.md
@@ -2316,7 +2316,6 @@ local encrypted store, or local files:
 ```
 # offline (daemon may be stopped)
 springtale init
-springtale new <template>
 springtale doctor
 springtale fix <error-id>
 springtale vault duress-setup
diff --git a/docs/guide/architecture.md b/docs/guide/architecture.md
index a101e24f..31e2ff4b 100644
--- a/docs/guide/architecture.md
+++ b/docs/guide/architecture.md
@@ -274,7 +274,7 @@ The headless daemon that runs the show. Boot is a 9-step ordered pipeline split
 
 *Fig. 5. Daemon boot sequence. See [`docs/arch/ARCHITECTURE.md`](../arch/ARCHITECTURE.md) §3 for file:line refs.*
 
-Exposes ~80 REST endpoints for connector management, rule CRUD, formation lifecycle (deploy / pause / resume / dissolve / rally / intent / members / toggle-guard / cycle-autonomy), canvas updates, event streaming, configuration, webhook ingestion, diagnostics, onboarding, templates, fixes, per-agent autonomy, author keys, bot admin, memory audit/compact, data export, and send/execute. See [reference/api.md](../reference/api.md) for the full endpoint catalogue.
+Exposes ~80 REST endpoints for connector management, rule CRUD, formation lifecycle (deploy / pause / resume / dissolve / rally / intent / members / toggle-guard / cycle-autonomy), canvas updates, event streaming, configuration, webhook ingestion, diagnostics, onboarding, recipes, fixes, per-agent autonomy, author keys, bot admin, memory audit/compact, data export, and send/execute. See [reference/api.md](../reference/api.md) for the full endpoint catalogue.
 
 ### 5.2. springtale-cli (Terminal)
 
@@ -282,7 +282,6 @@ The CLI for local configuration and management:
 
 ```
   springtale init                         create vault + database
-  springtale new <template>               scaffold a project from a template
   springtale server start                 start daemon inline
   springtale doctor                       run diagnostic checks
   springtale fix <error-id>               apply an auto-repair suggestion
diff --git a/docs/guide/first-bot.md b/docs/guide/first-bot.md
index ede28ddb..d5a3bb3e 100644
--- a/docs/guide/first-bot.md
+++ b/docs/guide/first-bot.md
@@ -14,34 +14,18 @@ curl -sSL https://springtale.run/install.sh | sh
 (Single static binary. No Python env, no Node modules, no runtime
 dependencies.)
 
-## Pick a template
-
-`springtale new <template>` scaffolds a starter project you can run
-right away. Pick one of:
-
-| Template | What it does | Connector tokens needed |
-|----------|--------------|-------------------------|
-| `blank-bot` | Empty skeleton for experts | None |
-| `cli-runner` | Headless task runner, no chat | None |
-| `telegram-bot` | Telegram bot with `/start` welcome | Telegram bot token |
-| `discord-bot` | Discord bot with `!start` welcome | Discord bot token |
-| `matrix-bot` | Matrix/Element chatbot skeleton | Matrix access token |
-| `cron-runner` | Scheduled task with heartbeat | None |
-| `webhook-receiver` | HTTP webhook → formation fan-out | None |
-| `file-watcher` | Filesystem event → formation | None |
-| `llm-assistant` | AI-powered chat assistant | Ollama or API key |
-| `llm-swarm` | 3-agent AI swarm on a prompt | Ollama or API key |
-| `research-assistant` | Multi-source research LLM swarm | Ollama or API key |
-| `code-review-swarm` | PR → 3-agent code review | GitHub PAT + AI key |
-| `meeting-summarizer` | Audio / transcript → structured summary | Filesystem path + AI key |
-| `github-monitor` | GitHub webhook → Telegram push | GitHub + Telegram tokens |
-
-Run the one closest to what you want:
+## Start the project
+
+`springtale init` creates the data directory, the vault and the
+database — that is the whole of the setup. Everything after it comes
+from a recipe: browse the library in the colony UI, or apply one from
+the command line. See [`recipes.md`](recipes.md) for the catalogue.
 
 ```bash
-springtale new telegram-bot
+springtale init
 ```
 
+
 This writes a timestamped project directory under the data dir's
 `projects/` (XDG default: `~/.local/share/springtale/projects/`).
 Springtale picks the path itself — there's nothing to edit. The CLI
@@ -55,7 +39,7 @@ setup flow: open the connector's card in the dashboard (or call the
 connector setup API) and paste the token there. It never goes through
 argv or env.
 
-Every connector the template uses lists the vault keys it needs in a
+Every connector the recipe uses lists the vault keys it needs in a
 comment at the top of `springtale.toml`. The vault keeps tokens at rest
 with authenticated encryption; you never re-type them after this.
 
@@ -73,8 +57,8 @@ shows every bot, every tick, live.
 
 - Send your bot a message. `/start` triggers the welcome rule.
 - Add a second rule: `springtale rule add my-rule.toml`.
-- Add a second connector with another `springtale new <other-template>`
-  in the same project directory (the rules engine merges them).
+- Add a second connector by deploying another recipe (the rules
+  engine merges them).
 - Read [architecture.md](architecture.md) once the bot is real enough
   that you want to know what's happening underneath.
 
diff --git a/docs/guide/formations.md b/docs/guide/formations.md
index c8b5b67c..298f1a56 100644
--- a/docs/guide/formations.md
+++ b/docs/guide/formations.md
@@ -138,6 +138,13 @@ dissolve runs through the cadence tick loop once more to persist final
 state, then drops. Members that were exclusively in this formation
 become free; members in multiple formations keep running.
 
+The dissolve also publishes a terminal outcome — on the formation gossip
+bus and, when one is wired, into the cross-formation knowledge store. Both
+carry `success_count` (the momentum FSM's `consecutive_successes`) and
+`failure_count`, which is the momentum FSM's lifetime `interference_total`.
+Retrieval scores priors on `success_count / (success_count + failure_count)`,
+so the failure side has to be the real count.
+
 ## Persistence
 
 Formation *state* persists — membership, intent, guard state, momentum,
@@ -168,9 +175,9 @@ three concrete formation shapes:
 - **Telegram bot** (§7.3) — responder + memory-keeper + moderator,
   formation per incoming message. Showcases consensus gating.
 
-Each ships as a `springtale new <template>` starter: `cli-runner`,
-`llm-swarm`, `telegram-bot`. See [`templates.md`](templates.md) for the
-full 14-template menu.
+Each ships as a recipe: browse the library in the colony UI or see
+[`recipes.md`](recipes.md). `springtale init` gives you the bare
+project; a recipe fills it in.
 
 ## Advanced topics
 
@@ -270,12 +277,15 @@ refuses synthesized actions classified `Destructive`
 badge on the formation detail card and is toggled via
 `POST /formations/{id}/toggle-guard`.
 
-**Known defect.** The toggle writes a `guard:{formation_id}` config row,
-but live enforcement reads `formation.constraints.guard_mode`, which is
-set once at deploy and never refreshed. Toggling guard on an
-already-running formation updates the API and the badge but does **not**
-change what the running formation refuses until it is redeployed. The
-divergence is noted in `crates/springtale-runtime/src/operations/formations.rs`.
+The toggle is live. `operations::config::toggle_formation_guard` writes
+the durable `guard:{formation_id}` config row *and* posts
+`FormationCommand::SetGuard`, which the bot applies to the running
+formation's `constraints.guard_mode` on its next command drain — the same
+channel dissolve, pause and intent change ride. Deploy seeds the live flag
+from the same row (`lifecycle::spawn_formation`), and every reader of the
+row goes through `config::formation_guard_engaged`, so the badge, the API
+and what the running formation actually refuses cannot disagree, with or
+without a redeploy.
 
 The intent is to make accidental destruction harder: a formation that
 just hit Fever and is producing useful output is exactly the one you
diff --git a/docs/guide/recipes.md b/docs/guide/recipes.md
index 9213ea00..cc56bf76 100644
--- a/docs/guide/recipes.md
+++ b/docs/guide/recipes.md
@@ -5,23 +5,19 @@ bot. Pick one from the library, fill in the required inputs, hit
 Deploy, get a running automation. No TOML editing, no connector
 setup wizards, no LLM-adapter plumbing.
 
-If templates ([`templates.md`](templates.md)) are "start from a
-working scaffold and edit it", recipes are "fill in 3 fields and run".
+Recipes are the only starter system. There is one way to start a
+Springtale install — `springtale init` — and everything past the bare
+project comes from a recipe. There is no second scaffold generator and
+no `springtale new`.
 
-## When to use a recipe vs. a template
-
-| Recipe | Template |
+| Recipe | |
 |---|---|
-| Browseable library, filterable by category / tags / difficulty | One-shot scaffold per `springtale new <name>` |
-| Backend decides which fields are required vs optional vs advanced | All fields exposed in the generated TOML |
-| Deployed via UI (or `POST /recipes/{id}/apply`); no shell needed | Generated on disk; you edit and run |
-| Best for first-time deploys + non-technical users | Best for power users + heavy customisation |
-| Survives daemon restarts as a tracked deploy | Decoupled from the daemon after scaffold |
+| Browseable library, filterable by category / tags / difficulty | Backend declares which fields are required vs optional vs advanced |
+| Deployed via UI (or `POST /recipes/{id}/apply`); no shell needed | Survives daemon restarts as a tracked deploy |
 
 A recipe is a wrapper around the same primitives (connectors,
 rules, AI config) — internally it composes the existing
-`upsert_connector_config`, `create_rule`, and AI-config ops. Use
-either; they coexist.
+`upsert_connector_config`, `create_rule`, and AI-config ops.
 
 ## Anatomy of a recipe
 
diff --git a/docs/guide/templates.md b/docs/guide/templates.md
deleted file mode 100644
index e39b31e8..00000000
--- a/docs/guide/templates.md
+++ /dev/null
@@ -1,96 +0,0 @@
-# Starting from a template
-
-Springtale ships with 14 starter templates. `springtale new <name>` drops
-a working scaffold into the current directory — no blank page, no TOML
-spelunking.
-
-```
-                            springtale new
-                                  │
-  ┌─────────────────┬─────────────┼─────────────┬──────────────────┐
-  │                 │             │             │                  │
-  v                 v             v             v                  v
-blank-bot     cli-runner     cron-runner   research-assistant   …etc
-```
-
-## The full menu
-
-| Template | What it ships | When to pick it |
-|---|---|---|
-| `blank-bot` | empty skeleton | you want control from line 1 |
-| `cli-runner` | headless task runner, no AI | smallest working bot |
-| `llm-swarm` | 3-role researcher/writer/critic pipeline | OpenClaw replacement demo |
-| `llm-assistant` | single-agent LLM bot | chat + rules, one persona |
-| `telegram-bot` | Telegram DM bot | messaging-first workflow |
-| `discord-bot` | Discord guild bot | community ops |
-| `matrix-bot` | Matrix / Element bot | federated chat, Element app |
-| `cron-runner` | scheduled triggers | heartbeats, nightly tasks |
-| `webhook-receiver` | inbound HTTP → rules | incoming integrations |
-| `file-watcher` | filesystem events → rules | dropbox-style workflows |
-| `github-monitor` | push / PR events | CI/CD bridges |
-| `research-assistant` | multi-source LLM research | cited writeups |
-| `code-review-swarm` | git diff → 3-agent review | PR review automation |
-| `meeting-summarizer` | transcript → structured summary | notes pipelines |
-
-## From zero to running
-
-```bash
-springtale new cli-runner
-# Creating cli-runner project in ~/.local/share/springtale/projects/cli-runner-20260610-091500
-cd ~/.local/share/springtale/projects/cli-runner-*/
-springtale init                # create vault + DB + config
-springtale run                 # start the daemon
-```
-
-The CLI picks the destination itself — a timestamped directory under
-the data dir's `projects/` — and prints the full path. You never pass
-a path, which keeps the scaffold free of path-traversal surprises.
-
-`springtale init` handles vault creation, passphrase setup, DB key
-derivation, and any platform-specific onboarding (Telegram bot token,
-Discord app credentials, etc.). The template's `springtale.toml` has the
-right shape already — `init` fills in the encrypted pieces.
-
-## What's in a template
-
-Every template produces **at minimum** a `springtale.toml` at the project
-root. Templates that ship a working trigger also drop one or more rule
-files under `rules/` — they're plain TOML, editable by hand.
-
-For example, `springtale new cron-runner` produces:
-
-```
-cron-runner-<timestamp>/
-├── springtale.toml
-└── rules/
-    └── heartbeat.toml
-```
-
-Other templates add connector-specific stubs (see the table above for
-what each ships). No template ships secrets — every credential goes
-through the connector setup flow (the connector's card in the dashboard,
-or the connector setup API) into the vault, never the TOML.
-
-## AI adapters are optional
-
-Templates that mention an LLM (`llm-swarm`, `research-assistant`,
-`code-review-swarm`, `meeting-summarizer`, `llm-assistant`) ship with
-**commented-out** provider blocks for Ollama / OpenAI / Anthropic.
-Uncomment the one you want. If none are configured, `NoopAdapter` runs
-— the bot still works, actions that need an LLM return canned text.
-That's the product-model constraint: **every bot works without AI**
-([product-model.md](../../.claude/rules/shared/product-model.md)).
-
-## When no template fits
-
-`springtale new blank-bot` gives you the empty skeleton — a
-`springtale.toml` with the paths wired up, no rules, no connectors. Add
-what you need by hand, or crib from a closer template and delete the
-parts that don't apply.
-
-## Next steps
-
-- [first-bot.md](first-bot.md) — 60-second walk-through of `cli-runner`
-- [rules.md](rules.md) — rule format in detail
-- [cooperation.md](cooperation.md) — how formations cooperate inside a bot
-- [connectors.md](connectors.md) — what a connector is + how to add one
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index c14b28f6..f8b90a60 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -6,7 +6,6 @@
    springtale
      │
      ├── init                         create vault + DB, optional onboarding
-     ├── new TEMPLATE                 scaffold from starter template
      ├── server start                 run springtaled inline
      ├── run                          alias for `server start`
      ├── healthcheck [--url]          probe /health, exit 0 on healthy
@@ -153,40 +152,6 @@ HEALTHCHECK --interval=30s --timeout=5s CMD ["/usr/local/bin/springtale", "healt
 
 ---
 
-## 3.1. `springtale new <template>`
-
-Scaffold a project from a starter template. 14 templates ship; pick whichever is closest to what you need and edit from there. Definitions live in `crates/springtale-runtime/src/operations/templates.rs`.
-
-**TABLE I. STARTER TEMPLATES**
-
-| Template | Description |
-|---|---|
-| `telegram-bot` | Telegram bot with a `/start` welcome rule |
-| `github-monitor` | GitHub webhook → Telegram push notifications |
-| `cron-runner` | Scheduled task automation (no chat connector) |
-| `llm-assistant` | AI-powered chat assistant (Ollama / OpenAI / Anthropic) |
-| `blank-bot` | Empty skeleton for experts — no connectors, no rules |
-| `cli-runner` | Headless CLI task runner — spawns a formation per task |
-| `llm-swarm` | 3-agent LLM swarm (researcher / writer / critic) on a single prompt |
-| `discord-bot` | Discord bot with a `!start` welcome rule |
-| `matrix-bot` | Matrix / Element chatbot skeleton — ready for `connector-matrix` |
-| `webhook-receiver` | HTTP webhook → cooperation formation fan-out |
-| `file-watcher` | Filesystem event → cooperation formation |
-| `research-assistant` | Multi-source research LLM swarm with cited output |
-| `code-review-swarm` | Git diff → 3-agent code review (readability / correctness / security) |
-| `meeting-summarizer` | Audio / transcript → structured summary LLM swarm |
-
-```
-$ springtale new telegram-bot
-Scaffolded telegram-bot project.
-  rules/     — starter rules
-  config/    — connector config skeleton
-Next: edit config/connector-telegram.toml with your bot token.
-```
-
-See [`../guide/templates.md`](../guide/templates.md) for worked walkthroughs and prerequisites per template.
-
----
 
 ## 3.2. `springtale doctor`
 
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index 34916680..638212af 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -21,7 +21,7 @@ A minimal config is **empty** — every section has safe defaults. You only writ
   │
   │   (AI adapters are not TOML — per colony/formation/agent, §7)
   │
-  ├── [bot]                context_window, vault_timeout_secs  ─── §8
+  ├── [bot]                (settings, not TOML — see §8)   ─── §8
   │     └── [bot.persona]  name, tone, prefix          ─── §8.1
   │
   ├── [sentinel]           rate limits, breaker, dead-man ─── §9
@@ -143,7 +143,7 @@ Bot runtime configuration. If absent, the bot is disabled — rules and connecto
 | Key | Type | Default | Description |
 |---|---|---|---|
 | `context_window` | `usize` | `50` | Conversation context window size (entries kept in memory for AI fallback) |
-| `vault_timeout_secs` | `u64` | `300` | Auto-lock timeout in seconds |
+| ~~`vault_timeout_secs`~~ | — | — | **Removed (plan 6.10).** Auto-lock is now the `auto_lock_secs` bot setting (`GET|PUT /bot/settings`, default `300`, `0` = never) — a setting the UI can change, not a file you edit and restart for. |
 | `tool_policy` | `ToolPolicy` | default mode | Which connector actions the AI may invoke as tools (OWASP LLM06). Fields: `allow` (glob list, e.g. `["connector-github__read_*"]`), `deny` (glob list, always wins), `max_iterations` (0 = default 5), `writes_with_approval` (bool). With `allow` empty (**default mode**), only `read_only` actions are callable — mutating actions stay invisible unless `writes_with_approval = true`, which routes each through the blocking approval gate. A non-empty `allow` switches to explicit mode: exactly the listed tools. |
 | `[bot.persona]` | table | (defaults) | Persona block |
 
@@ -405,7 +405,6 @@ update_mode = "polling"
 
 [bot]
 context_window = 50
-vault_timeout_secs = 300
 persona.name = "Spring"
 persona.tone = "neutral"
 persona.prefix = "/"
diff --git a/docs/visual-gallery.md b/docs/visual-gallery.md
index 9e2d771f..72a06a36 100644
--- a/docs/visual-gallery.md
+++ b/docs/visual-gallery.md
@@ -203,7 +203,7 @@ If you want to contribute screenshots:
 
 1. Run the daemon + desktop in a clean state (`SPRINGTALE_DATA_DIR=
    /tmp/clean-springtale`).
-2. Scaffold a `telegram-bot` or `llm-swarm` template to populate
+2. Deploy the `telegram-bot-echo` or `llm-swarm` recipe to populate
    the canvas with real-looking data.
 3. **Use placeholder values** for connector tokens. Never include
    real tokens or real chat IDs in screenshots.
diff --git a/scripts/surface-exemptions.txt b/scripts/surface-exemptions.txt
index 88ddadd3..6dff1b07 100644
--- a/scripts/surface-exemptions.txt
+++ b/scripts/surface-exemptions.txt
@@ -87,8 +87,6 @@
 /sessions                        provider
 /stream                          cli provider
 /stream/ticket                   provider
-/templates                       cli
-/templates/{}                    cli provider
 /travel/prepare                  cli provider
 /travel/restore                  cli provider
 /ui                              cli provider
diff --git a/tauri/packages/types/openapi.json b/tauri/packages/types/openapi.json
index e5bdc19c..9cca88d9 100644
--- a/tauri/packages/types/openapi.json
+++ b/tauri/packages/types/openapi.json
@@ -4169,63 +4169,6 @@
         }
       }
     },
-    "/templates": {
-      "get": {
-        "tags": [
-          "templates"
-        ],
-        "summary": "GET /templates — every available starter.",
-        "operationId": "templates_list",
-        "responses": {
-          "200": {
-            "description": "Scaffolding templates",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object"
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/templates/{name}": {
-      "post": {
-        "tags": [
-          "templates"
-        ],
-        "summary": "POST /templates/{name} — write the named template.",
-        "description": "The daemon picks the destination directory and returns the path in\nthe response. No `dir` field accepted — the caller cannot influence\nwhere files land (OWASP ASVS §12.3).",
-        "operationId": "templates_write",
-        "parameters": [
-          {
-            "name": "name",
-            "in": "path",
-            "description": "Template name",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Files written",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/WriteReport"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
     "/travel/prepare": {
       "post": {
         "tags": [
@@ -4770,6 +4713,12 @@
         "type": "object",
         "description": "The user-editable bot settings.",
         "properties": {
+          "auto_lock_secs": {
+            "type": "integer",
+            "format": "int64",
+            "description": "Idle seconds before the daemon locks itself: drops the runtime,\ncloses the database and zeroizes the vault key (plan 6.10).\n`0` disables auto-lock. Default: 300.\n\nMoved here from `springtale_bot::BotConfig::vault_timeout_secs`,\nwhich nothing read and which could only be changed by editing a\nTOML file and restarting — exactly what the product model\nforbids of a setting.",
+            "minimum": 0
+          },
           "context_window": {
             "type": "integer",
             "description": "Conversation context window size. Default: 50.",
@@ -6741,45 +6690,6 @@
         },
         "additionalProperties": false
       },
-      "Template": {
-        "type": "object",
-        "description": "A static starter template.",
-        "required": [
-          "name",
-          "description",
-          "files"
-        ],
-        "properties": {
-          "description": {
-            "type": "string"
-          },
-          "files": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/TemplateFile"
-            },
-            "description": "Relative files the template writes into the destination dir."
-          },
-          "name": {
-            "type": "string"
-          }
-        }
-      },
-      "TemplateFile": {
-        "type": "object",
-        "required": [
-          "relative_path",
-          "contents"
-        ],
-        "properties": {
-          "contents": {
-            "type": "string"
-          },
-          "relative_path": {
-            "type": "string"
-          }
-        }
-      },
       "TestStepBody": {
         "type": "object",
         "description": "Body for `POST /recipes/{id}/test-step`.",
@@ -6998,29 +6908,6 @@
             "type": "string"
           }
         }
-      },
-      "WriteReport": {
-        "type": "object",
-        "description": "Outcome of writing a template to disk.",
-        "required": [
-          "template",
-          "dir",
-          "created"
-        ],
-        "properties": {
-          "created": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
-          },
-          "dir": {
-            "type": "string"
-          },
-          "template": {
-            "type": "string"
-          }
-        }
       }
     }
   },
@@ -7106,9 +6993,6 @@
     {
       "name": "stream"
     },
-    {
-      "name": "templates"
-    },
     {
       "name": "utterances"
     },
diff --git a/tauri/packages/types/src/api.ts b/tauri/packages/types/src/api.ts
index feb0cb8e..6d9e1c87 100644
--- a/tauri/packages/types/src/api.ts
+++ b/tauri/packages/types/src/api.ts
@@ -2101,45 +2101,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/templates": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** GET /templates — every available starter. */
-        get: operations["templates_list"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/templates/{name}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * POST /templates/{name} — write the named template.
-         * @description The daemon picks the destination directory and returns the path in
-         *     the response. No `dir` field accepted — the caller cannot influence
-         *     where files land (OWASP ASVS §12.3).
-         */
-        post: operations["templates_write"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/travel/prepare": {
         parameters: {
             query?: never;
@@ -2397,6 +2358,18 @@ export interface components {
         };
         /** @description The user-editable bot settings. */
         BotSettings: {
+            /**
+             * Format: int64
+             * @description Idle seconds before the daemon locks itself: drops the runtime,
+             *     closes the database and zeroizes the vault key (plan 6.10).
+             *     `0` disables auto-lock. Default: 300.
+             *
+             *     Moved here from `springtale_bot::BotConfig::vault_timeout_secs`,
+             *     which nothing read and which could only be changed by editing a
+             *     TOML file and restarting — exactly what the product model
+             *     forbids of a setting.
+             */
+            auto_lock_secs?: number;
             /** @description Conversation context window size. Default: 50. */
             context_window?: number;
             /** @description Persona (name, tone, command prefix). */
@@ -3212,17 +3185,6 @@ export interface components {
             intent: string;
             name: string;
         };
-        /** @description A static starter template. */
-        Template: {
-            description: string;
-            /** @description Relative files the template writes into the destination dir. */
-            files: components["schemas"]["TemplateFile"][];
-            name: string;
-        };
-        TemplateFile: {
-            contents: string;
-            relative_path: string;
-        };
         /** @description Body for `POST /recipes/{id}/test-step`. */
         TestStepBody: {
             inputs: components["schemas"]["RecipeInputs"];
@@ -3316,12 +3278,6 @@ export interface components {
             provenance_json: string;
             workspace_key: string;
         };
-        /** @description Outcome of writing a template to disk. */
-        WriteReport: {
-            created: string[];
-            dir: string;
-            template: string;
-        };
     };
     responses: never;
     parameters: never;
@@ -6249,49 +6205,6 @@ export interface operations {
             };
         };
     };
-    templates_list: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Scaffolding templates */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": Record<string, never>[];
-                };
-            };
-        };
-    };
-    templates_write: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Template name */
-                name: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Files written */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["WriteReport"];
-                };
-            };
-        };
-    };
     safety_travel_prepare: {
         parameters: {
             query?: never;
diff --git a/tauri/packages/types/src/index.ts b/tauri/packages/types/src/index.ts
index c6992300..22b84341 100644
--- a/tauri/packages/types/src/index.ts
+++ b/tauri/packages/types/src/index.ts
@@ -52,9 +52,6 @@ export type {
   SendOutcome,
   SendRequest,
   Severity,
-  Template,
-  TemplateFile,
-  WriteReport,
 } from "./operations";
 export type { Rule, RuleId, RuleStatus } from "./rule";
 export type { Session } from "./session";
diff --git a/tauri/packages/types/src/operations.ts b/tauri/packages/types/src/operations.ts
index 1f8d5290..f8afd99c 100644
--- a/tauri/packages/types/src/operations.ts
+++ b/tauri/packages/types/src/operations.ts
@@ -73,30 +73,6 @@ export interface ApplyReport {
   fields_stored: string[];
 }
 
-// --- Templates (templates.rs) ---
-
-/** A file within a starter template. Matches `TemplateFile` struct. */
-export interface TemplateFile {
-  relative_path: string;
-  contents: string;
-}
-
-/** A static starter template. Matches `Template` struct. */
-export interface Template {
-  name: string;
-  description: string;
-  files: TemplateFile[];
-}
-
-/** Outcome of writing a template to disk. Matches `WriteReport` struct. */
-export interface WriteReport {
-  template: string;
-  /** Absolute path to the directory created. */
-  dir: string;
-  /** Absolute paths to all files created. */
-  created: string[];
-}
-
 // --- Cross-channel (cross_channel.rs) ---
 
 /** Request to send a message through a specific connector. Matches `SendRequest` struct. */
diff --git a/tauri/packages/ui/src/colony/panel/DetailPanel.tsx b/tauri/packages/ui/src/colony/panel/DetailPanel.tsx
index 25e177b9..6b3ab9b5 100644
--- a/tauri/packages/ui/src/colony/panel/DetailPanel.tsx
+++ b/tauri/packages/ui/src/colony/panel/DetailPanel.tsx
@@ -8,6 +8,7 @@ import type {
   ColonySelection,
 } from "../types";
 import {
+  AUTONOMY_COLORS,
   MOMENTUM_COLORS,
   MOMENTUM_NAMES,
   MOMENTUM_UNLOCKS,
@@ -152,13 +153,11 @@ export const DetailPanel: Component<{
                           class={`colony-autonomy-pip ${a.autonomy === level ? "font-bold" : ""}`}
                           classList={{ "is-active": a.autonomy === level }}
                           style={{
-                            "--colony-color": [
-                              "var(--color-status-ok)",
-                              "var(--color-role-scout)",
-                              "var(--color-status-warn)",
-                              "var(--color-status-error)",
-                              "var(--color-role-analyst)",
-                            ][level],
+                            // One colour per `AUTONOMY_LABELS` entry:
+                            // observe → suggest → approve → autonomous.
+                            // A fifth colour outlived the SELF-DIRECT level
+                            // that was cut from the label list.
+                            "--colony-color": AUTONOMY_COLORS[level],
                           }}
                         >
                           {level}
diff --git a/tauri/packages/ui/src/colony/types.ts b/tauri/packages/ui/src/colony/types.ts
index 2cc959b3..b18e79b1 100644
--- a/tauri/packages/ui/src/colony/types.ts
+++ b/tauri/packages/ui/src/colony/types.ts
@@ -256,6 +256,14 @@ export const ROLE_COLORS: Record<string, string> = {
 /** The four levels the backend actually has (`AutonomyLevel`): observe →
  *  suggest → approve → autonomous. No fifth level exists. */
 export const AUTONOMY_LABELS = ["OBSERVE", "SUGGEST", "APPROVE", "AUTONOMOUS"];
+/** Pip colour per autonomy level — one entry per `AUTONOMY_LABELS` entry,
+ *  indexed by the backend's `AutonomyLevel` ordinal. */
+export const AUTONOMY_COLORS = [
+  "var(--color-status-ok)",
+  "var(--color-role-scout)",
+  "var(--color-status-warn)",
+  "var(--color-status-error)",
+];
 export const MOMENTUM_NAMES = ["COLD", "WARM", "HOT", "FEVER"];
 export const MOMENTUM_COLORS = [
   "var(--color-momentum-cold)",
diff --git a/tauri/packages/ui/src/dashboard/types.ts b/tauri/packages/ui/src/dashboard/types.ts
index fb107070..4ed3ea08 100644
--- a/tauri/packages/ui/src/dashboard/types.ts
+++ b/tauri/packages/ui/src/dashboard/types.ts
@@ -28,8 +28,6 @@ import type {
   Report,
   SendOutcome,
   SendRequest,
-  Template,
-  WriteReport,
 } from "@springtale/types";
 import type { ConditionDef } from "../ConditionEditor";
 import type { BotSettingsValue } from "../colony/AppSettingsPanel";
@@ -621,10 +619,6 @@ export interface DataProvider {
   exportRecipeToml(recipeId: string): Promise<string>;
   importRecipeToml(toml: string): Promise<Recipe>;
 
-  // Templates
-  listTemplates(): Promise<Template[]>;
-  writeTemplate(name: string): Promise<WriteReport>;
-
   // Error fixes
   listFixes(): Promise<FixGuide[]>;
   getFix(id: string): Promise<FixGuide>;
diff --git a/tauri/packages/ui/src/web/provider.ts b/tauri/packages/ui/src/web/provider.ts
index bcf62325..df2bfc10 100644
--- a/tauri/packages/ui/src/web/provider.ts
+++ b/tauri/packages/ui/src/web/provider.ts
@@ -15,8 +15,6 @@ import type {
   PlatformForm,
   Report,
   SendOutcome,
-  Template,
-  WriteReport,
 } from "@springtale/types";
 import type {
   ApprovalInfo,
@@ -514,15 +512,6 @@ export function createWebProvider(): DataProvider {
     exportRecipeToml,
     importRecipeToml,
 
-    // Templates
-    async listTemplates() {
-      const data = await get<{ templates: Template[] }>("/templates");
-      return data.templates ?? [];
-    },
-    async writeTemplate(name) {
-      return post<WriteReport>("/templates/write", { name });
-    },
-
     // Error fixes
     async listFixes() {
       const data = await get<{ guides: FixGuide[] }>("/fixes");