From 24386bb56f5f625e5b0b646eacc8ccc246f8afb0 Mon Sep 17 00:00:00 2001
From: eric8810 <ericted8810@gmail.com>
Date: Mon, 19 Oct 2026 18:53:52 +0800
Subject: [PATCH] =?UTF-8?q?feat(kotlin):=20=E6=8F=92=E4=BB=B6=20API?=
 =?UTF-8?q?=E3=80=81=E7=BB=9F=E4=B8=80=E4=BA=8B=E4=BB=B6=E3=80=81=E6=B5=8B?=
 =?UTF-8?q?=E8=AF=95=E5=B7=A5=E5=85=B7=E4=B8=8E=E8=BF=90=E8=A1=8C=E6=97=B6?=
 =?UTF-8?q?=E5=A5=91=E7=BA=A6=EF=BC=88#390=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kotlin SDK K-P1 的第二部分：

- 插件 API 3：Rutis.define<C>(name, inject, provides?, schema?) { ctx, config -> }；
  配置是 @Serializable 类型，经 RutisFormat 解码，schema 由 SerialDescriptor 推出
  （可覆盖）；service<T>(sync = …) 声明方法种类（默认 async）；Ctx 是行的协程
  作用域（卸载时取消并等待），use<I>（@RutisClient 代理；同进程提供者实现 I 时
  得到对象本身）、provide（没声明的服务以 rows.announce 通告，方法全为 async；
  宿主比 0.12 旧时按契约提示一次）、effect（卸载时逆序）。
- 运行时：mount（features rows.v2、hosts、leaf、scopes、rows.announce；
  plugins、implementation、engine）、rows.schema / load / update / unload、
  hosts.provide / withdraw、release、get、dispose；调用方的行（每行按 isolate
  计算自己的服务 id）；插件 API 版本检查。
- 统一事件：on（prepend、global，监听器一律 kind sync）、emit / parallel / serial /
  waterfall / bail / filter；快速路径与经宿主的 events.dispatch（filter 为选择器
  函数引用、terminal）；events.on / off / elsewhere / call 在读线程上按帧序处理；
  emit 按监听器串行；作用域；卸载时拒绝该行的 events.call、撤下服务、取消并
  等待正在运行的监听器（RUTIS_SHUTDOWN_TIMEOUT）；rutis/* 只可监听；
  报告行原文；对没有 events-v2 的宿主握手后按原文拒绝。
- jvm 测试入口 Rutis.serve(args, plugins…)（unix: / 裸路径 / tcp: 加令牌）：
  会话结束卸载全部行，清理超过时限或旧宿主时以 1 退出。
- 测试工具 arcships.rutis.testing（RutisTest.load）：内存通道上的真实会话，
  测试一方是宿主（服务、总线、行与作用域）。
- rutis-conformance：weather 与 conformance-events 插件、Main（Rutis.serve）；
  测试工具对 weather.expected.json 与 events.expected.json 的检查（51 个用例）。
- 期望文件：weather 加 kotlin/* 样例值；events 的语言加 kotlin（Kotlin 监听器
  是同步的，两个 async-listener 用例除外），toolCases 加 kotlin 51；
  events.rs 记下 Kotlin 的取消（CancellationException）。
- Rust：session_matrix 加 Kotlin（回拨 socket 路径、loopback）；loader 的测试
  feature kotlin，events_conformance 以 Kotlin 为 X，并作其他语言的 Y。
- CI：runtimes-kotlin 加 session_matrix 与 events_conformance。
---
 .github/workflows/ci.yml                      |  22 +-
 .../src/runtime/testing/events.expected.json  |  14 +-
 .../src/runtime/testing/events.rs             |   6 +-
 .../src/runtime/testing/weather.expected.json |  15 +-
 crates/rutis-bridge/tests/events_expected.rs  |   2 +-
 crates/rutis-bridge/tests/session_matrix.rs   |  30 +
 crates/rutis-loader/Cargo.toml                |   3 +
 crates/rutis-loader/tests/common/runtimes.rs  |  41 ++
 .../rutis-loader/tests/events_conformance.rs  |  32 +-
 docs/ci.en.md                                 |   4 +
 docs/ci.md                                    |   4 +
 .../rutis/rutis-conformance/build.gradle.kts  |  21 +-
 .../kotlin/arcships/rutis/conformance/Main.kt |  12 +
 .../conformance/plugins/ConformanceEvents.kt  | 311 +++++++++
 .../rutis/conformance/plugins/Weather.kt      | 119 ++++
 .../conformance/EventsConformanceTest.kt      | 334 +++++++++
 .../conformance/WeatherConformanceTest.kt     | 116 ++++
 .../arcships/rutis/conformance/Written.kt     | 112 +++
 .../jvmMain/kotlin/arcships/rutis/Serve.kt    |  95 +++
 .../kotlin/arcships/rutis/GeneratedTest.kt    |   2 +
 .../kotlin/arcships/rutis/RuntimeTest.kt      | 143 ++++
 .../src/shared/kotlin/arcships/rutis/Ctx.kt   | 147 ++++
 .../shared/kotlin/arcships/rutis/Events.kt    |  84 +++
 .../src/shared/kotlin/arcships/rutis/Rutis.kt | 131 ++++
 .../kotlin/arcships/rutis/internal/Bus.kt     | 252 +++++++
 .../kotlin/arcships/rutis/internal/Control.kt | 102 +++
 .../arcships/rutis/internal/EventsRuntime.kt  | 453 ++++++++++++
 .../kotlin/arcships/rutis/internal/Runtime.kt | 457 +++++++++++++
 .../kotlin/arcships/rutis/internal/Schema.kt  |  96 +++
 .../arcships/rutis/internal/Sessions.kt       |  68 ++
 .../arcships/rutis/testing/RutisTest.kt       | 645 ++++++++++++++++++
 31 files changed, 3852 insertions(+), 21 deletions(-)
 create mode 100644 kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/Main.kt
 create mode 100644 kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/ConformanceEvents.kt
 create mode 100644 kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/Weather.kt
 create mode 100644 kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/EventsConformanceTest.kt
 create mode 100644 kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/WeatherConformanceTest.kt
 create mode 100644 kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/Written.kt
 create mode 100644 kotlin/rutis/rutis/src/jvmMain/kotlin/arcships/rutis/Serve.kt
 create mode 100644 kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/RuntimeTest.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Ctx.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Events.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Rutis.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Bus.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Control.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/EventsRuntime.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Runtime.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Schema.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Sessions.kt
 create mode 100644 kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/testing/RutisTest.kt

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a75197e18..3b84a31a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -850,7 +850,7 @@ jobs:
           java-version: '17'
           cache: ${{ runner.environment == 'github-hosted' && 'gradle' || '' }}
           cache-dependency-path: kotlin/rutis/**/*.gradle.kts
-      - name: gradle build (the SDK, the processor, the conformance programs)
+      - name: gradle build (the SDK, the processor, the testing tool, the conformance programs)
         working-directory: kotlin/rutis
         run: |
           # The downloads first, retried (the runners' networks); then the
@@ -862,10 +862,28 @@ jobs:
           done
           ./gradlew --no-daemon build
           echo "RUTIS_KOTLIN_JAR=$PWD/rutis-conformance/build/libs/rutis-conformance-all.jar" >> "$GITHUB_ENV"
+      # The other languages, as the far ends of the events conformance.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - run: npm --prefix node/rutis-runtime ci
+      - uses: actions/setup-python@v5
+        if: runner.environment == 'github-hosted' || runner.os != 'macOS'
+        with:
+          python-version: '3.10'
+      - run: python3 -m pip install "websockets==15.*"
       # Only the Kotlin tests of the contract suites: the other runtimes run
       # in their own jobs.
       - name: cargo test (the contract suites with Kotlin)
-        run: cargo test -p rutis-bridge --features testing,kotlin --test runtime_conformance --test value_roundtrip kotlin_
+        run: cargo test -p rutis-bridge --features testing,websocket,kotlin --test runtime_conformance --test value_roundtrip --test session_matrix kotlin_
+      # The events conformance with X Kotlin, and Kotlin as Y of the others
+      # (the written placements on pull requests, a sample in full runs).
+      - name: cargo test (events conformance with Kotlin)
+        env:
+          RUTIS_EVENTS_PLACEMENTS: ${{ needs.changes.outputs.all == 'true' && 'sampled' || 'written' }}
+          RUTIS_EVENTS_REQUIRE: node,python,kotlin
+          RUTIS_EVENTS_SETTLE_SCALE: '2'
+        run: cargo test -p rutis-loader --features node,python,kotlin --test events_conformance
       - name: self-hosted runner, end
         if: always() && runner.environment == 'self-hosted'
         env:
diff --git a/crates/rutis-bridge/src/runtime/testing/events.expected.json b/crates/rutis-bridge/src/runtime/testing/events.expected.json
index c3d5abd01..5144ebe5a 100644
--- a/crates/rutis-bridge/src/runtime/testing/events.expected.json
+++ b/crates/rutis-bridge/src/runtime/testing/events.expected.json
@@ -1,18 +1,18 @@
 {
   "about": [
     "Unified events conformance (#464): one list both the real runtimes and the SDK testing tools are checked against. Format: docs/design-events-protocol-2026-10-18.en.md §13; the cases of §13.3 come first, then the ones added to cover every rule.",
-    "Real runtimes: crates/rutis-loader/tests/events_conformance.rs (rows of one rutis host, its runtimes, and a second node). Testing tools, the cases without `tool: false`: node/rutis/test/events-conformance.test.mjs, python/rutis/tests/test_events_conformance.py, go/rutis/rutistest/events_conformance_test.go, bun/rutis-bun/test/events-conformance.test.ts, swift/rutis/Tests/RutisTests/EventsConformanceTests.swift (RutisTest). The file is checked for shape by crates/rutis-bridge/tests/events_expected.rs.",
-    "Languages (`only` / `except`): rust (the host's Rust plugin), node (a Cordis plugin in the Node runtime), node-leaf (a leaf plugin in the Node runtime), bun, python, go, swift. Fixtures: node/rutis-runtime/test/fixtures/conformance-events{,-e,-f}/ (Cordis) and conformance-events-leaf{,-e,-f}.mjs, bun/rutis-bun/test/fixtures/conformance-events{,-e,-f}.ts, python/rutis/tests/fixtures/conformance_events{,_e,_f}.py, go/rutis/internal/fixtures/plugins/conformance (served by go/rutis/internal/fixtures/runtime; one plugin provides every emitter undeclared, its sync method on the wire `dispatchSync`), swift/rutis/Sources/RutisFixturePlugins/ConformanceEvents.swift (served by RutisConformance; as Go), and the Rust plugin of crates/rutis-loader/tests/events_conformance.",
+    "Real runtimes: crates/rutis-loader/tests/events_conformance.rs (rows of one rutis host, its runtimes, and a second node). Testing tools, the cases without `tool: false`: node/rutis/test/events-conformance.test.mjs, python/rutis/tests/test_events_conformance.py, go/rutis/rutistest/events_conformance_test.go, bun/rutis-bun/test/events-conformance.test.ts, swift/rutis/Tests/RutisTests/EventsConformanceTests.swift (RutisTest), kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/EventsConformanceTest.kt. The file is checked for shape by crates/rutis-bridge/tests/events_expected.rs.",
+    "Languages (`only` / `except`): rust (the host's Rust plugin), node (a Cordis plugin in the Node runtime), node-leaf (a leaf plugin in the Node runtime), bun, python, go, swift, kotlin (the Kotlin SDK's jvm target). Fixtures: node/rutis-runtime/test/fixtures/conformance-events{,-e,-f}/ (Cordis) and conformance-events-leaf{,-e,-f}.mjs, bun/rutis-bun/test/fixtures/conformance-events{,-e,-f}.ts, python/rutis/tests/fixtures/conformance_events{,_e,_f}.py, go/rutis/internal/fixtures/plugins/conformance (served by go/rutis/internal/fixtures/runtime; one plugin provides every emitter undeclared, its sync method on the wire `dispatchSync`), swift/rutis/Sources/RutisFixturePlugins/ConformanceEvents.swift (served by RutisConformance; as Go), kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/ConformanceEvents.kt (likewise: one plugin provides every emitter undeclared, `dispatchSync`), and the Rust plugin of crates/rutis-loader/tests/events_conformance.",
     "Scopes: each scope path is one instance of its group, created once; t2's group is `team`, not `tenant`, so that rows placed in t1 are not copied into t2 (a loader instance copies its group's rows). The rule compares ids, so the group names do not matter to it.",
     "Additions to the format of §13.2: a listener's `fails` ({name, message}: its row's apply throws that error, after registering nothing); `typed: \"unit\"` (a Rust unit struct event); `observesDispatch` (a Cordis listener row that also logs `<label>:dispatch:<mode>` from its internal/dispatch for each dispatch of the case's name); the filter `{\"throws\": {name, message}}` (the predicate throws); the step `{\"update\": label}` (the row's config changes, so it registers again); and `expect` on a `load` step. Rust events cross by serde without a declaration, so there is no NoWire case.",
-    "Expectations, strictly: a step without `throws` or `cancelled` requires every dispatch that ends in it to succeed. `cancelled: true`: the dispatch ends with its emitter's language's cancellation (Python `CancelledError`, Go `Canceled`, Swift `CancellationError`, the Rust fixture's `Cancelled`). `reported` entries ({label, name, filter?}): exactly one §5.6 line about the step's event names that row (`in row <label>`, or the dispatcher's `in runtime <its runtime>` / `in node <peer>`) with that error name; `filter: true` for a filter's line (`rutis: filter of <name> from row <label>`). `logLacks` (and `reported`) are checked again a moment after the rest held. A `$` tag that does not parse is an error of the file. `toolCases`: how many cases each testing tool runs (crates/rutis-bridge/tests/events_expected.rs checks it against the cases; each tool checks it ran that many).",
+    "Expectations, strictly: a step without `throws` or `cancelled` requires every dispatch that ends in it to succeed. `cancelled: true`: the dispatch ends with its emitter's language's cancellation (Python `CancelledError`, Go `Canceled`, Swift `CancellationError`, Kotlin `CancellationException`, the Rust fixture's `Cancelled`). `reported` entries ({label, name, filter?}): exactly one §5.6 line about the step's event names that row (`in row <label>`, or the dispatcher's `in runtime <its runtime>` / `in node <peer>`) with that error name; `filter: true` for a filter's line (`rutis: filter of <name> from row <label>`). `logLacks` (and `reported`) are checked again a moment after the rest held. A `$` tag that does not parse is an error of the file. `toolCases`: how many cases each testing tool runs (crates/rutis-bridge/tests/events_expected.rs checks it against the cases; each tool checks it ran that many).",
     "The rows: plugin `conformance-events`, one row per participant, keyed by its label; its config is the participant as resolved by the runner (name, kind and log filled in). It injects `events-log`, a host service: add(entry) sync; filter(description) sync (logs `filter:<row>` and keeps the description for `filterSees`); wait(entry) async (resolves once entry is logged, for `cancel`). Emitter rows (labelled e or f) load the plugin `conformance-events-e` or `conformance-events-f` (Python `conformance_events_e` / `_f`): the same plugin, declaring only its own `emitter-<label>` (a declared service is exported whether the row provides it or not), with dispatch(spec) async and dispatch_sync(spec) sync (for bail and waterfall-sync). `conformance-events` itself declares nothing."
   ],
   "plugin": "conformance-events",
-  "languages": ["rust", "node", "node-leaf", "bun", "python", "go", "swift"],
+  "languages": ["rust", "node", "node-leaf", "bun", "python", "go", "swift", "kotlin"],
   "scopes": {"t1": "tenant", "t1/s1": "session", "t2": "team"},
   "locations": ["X", "Y", "host", "node"],
-  "toolCases": {"node-leaf": 53, "bun": 53, "python": 54, "go": 50, "swift": 50},
+  "toolCases": {"node-leaf": 53, "bun": 53, "python": 54, "go": 50, "swift": 50, "kotlin": 51},
   "cases": [
     { "case": "emit/reaches-all", "rule": "5.4 emit", "name": "t/emit", "vary": ["a", "b", "c", "e"],
       "listeners": [
@@ -202,7 +202,7 @@
         {"emit": {"from": "X", "mode": "bail", "args": []}, "expect": {"returns": "B", "log": ["a", "b"]}}
       ] },
 
-    { "case": "bail/async-listener", "rule": "5.4 kinds", "name": "t/bail-async", "vary": ["a", "e"], "except": [{"a": ["go", "swift"], "why": "Go and Swift listeners are synchronous"}],
+    { "case": "bail/async-listener", "rule": "5.4 kinds", "name": "t/bail-async", "vary": ["a", "e"], "except": [{"a": ["go", "swift", "kotlin"], "why": "Go, Swift and Kotlin listeners are synchronous"}],
       "listeners": [
         {"label": "a", "at": "Y", "kind": "async", "does": {"returns": "A"}}
       ],
@@ -563,7 +563,7 @@
         {"emit": {"from": "host", "mode": "waterfall-sync", "args": [], "terminal": "t"}, "expect": {"throws": {"name": "WaterfallNext", "message": "was already called"}}}
       ] },
 
-    { "case": "waterfall-sync/async-listener", "rule": "5.4 kinds", "name": "t/wfs-async", "tool": false, "vary": ["a"], "except": [{"a": ["go", "swift"], "why": "Go and Swift listeners are synchronous"}],
+    { "case": "waterfall-sync/async-listener", "rule": "5.4 kinds", "name": "t/wfs-async", "tool": false, "vary": ["a"], "except": [{"a": ["go", "swift", "kotlin"], "why": "Go, Swift and Kotlin listeners are synchronous"}],
       "listeners": [
         {"label": "a", "at": "Y", "kind": "async", "does": {"next": "a"}}
       ],
diff --git a/crates/rutis-bridge/src/runtime/testing/events.rs b/crates/rutis-bridge/src/runtime/testing/events.rs
index b10b8e30b..6133e5889 100644
--- a/crates/rutis-bridge/src/runtime/testing/events.rs
+++ b/crates/rutis-bridge/src/runtime/testing/events.rs
@@ -1430,14 +1430,16 @@ async fn joined(handle: tokio::task::JoinHandle<Outcome>, settles: bool) -> Outc
 /// emitter's language (§5.7: "the emitter's call ends with its own
 /// language's cancellation"): Python's `asyncio.CancelledError`, Go's
 /// `context.Canceled` (an `Error` saying `context canceled` on the wire),
-/// and for Rust (a dropped future ends with nothing) the fixture's own
-/// `Cancelled`.
+/// Kotlin's `CancellationException`, and for Rust (a dropped future ends
+/// with nothing) the fixture's own `Cancelled`.
 /// JavaScript cannot give up a dispatch.
 pub fn cancellation(language: &str) -> Option<Json> {
     match language {
         "python" => Some(json!({ "name": "CancelledError" })),
         // A plain Go error crosses named `Error`.
         "go" => Some(json!({ "name": "Error", "message": "context canceled" })),
+        // A cancelled coroutine's CancellationException.
+        "kotlin" => Some(json!({ "name": "CancellationException" })),
         // Swift's own: a cancelled Task throws CancellationError.
         "swift" => Some(json!({ "name": "CancellationError" })),
         "rust" => Some(json!({ "name": "Cancelled" })),
diff --git a/crates/rutis-bridge/src/runtime/testing/weather.expected.json b/crates/rutis-bridge/src/runtime/testing/weather.expected.json
index dbe0f24dc..0e3b5ad59 100644
--- a/crates/rutis-bridge/src/runtime/testing/weather.expected.json
+++ b/crates/rutis-bridge/src/runtime/testing/weather.expected.json
@@ -1,7 +1,7 @@
 {
   "about": [
     "What calls on the runtime conformance plugin (conformance-weather) return: one list that both the real runtimes and the SDK testing tools are checked against (issue #206, risk A1, Q6.7.2).",
-    "Real runtimes: rutis_bridge::runtime::testing::runtime (crates/rutis-bridge/tests/session_matrix.rs). Testing tools: node/rutis/test/conformance.test.mjs (@arcships/rutis/testing) and python/rutis/tests/test_conformance.py (rutis.testing), in strict mode, go/rutis/rutistest/conformance_test.go (rutistest) and swift/rutis/Tests/RutisTests/WeatherConformanceTests.swift (RutisTest).",
+    "Real runtimes: rutis_bridge::runtime::testing::runtime (crates/rutis-bridge/tests/session_matrix.rs). Testing tools: node/rutis/test/conformance.test.mjs (@arcships/rutis/testing) and python/rutis/tests/test_conformance.py (rutis.testing), in strict mode, go/rutis/rutistest/conformance_test.go (rutistest), kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/WeatherConformanceTest.kt (arcships.rutis.testing) and swift/rutis/Tests/RutisTests/WeatherConformanceTests.swift (RutisTest).",
     "The plugin injects `clock`, whose `now()` returns 0, 1, 2, ... one per call, and provides `service` with `methods`.",
     "A call: `call` (method), `args` (JSON; {\"$callback\": ...} is a function the caller passes: \"upper\" returns its argument upper-cased; {\"throws\": {name, message, fields}} throws an error with that name and message and extra `fields`), and what it does: `returns` (a JSON value; keys in `ignore` are not compared; `copied`: it is not the object passed in), `throws` ({} for any error, or the `name` and `message` the caller receives; the thrown error's extra `fields` do not cross) or `exits` (the plugin's process exits with this status).",
     "`samples` are values one language makes: the plugin's `samples()` names the ones it has, `sample(name)` returns one; a runtime whose plugin has no `samples` method has none.",
@@ -109,6 +109,17 @@
     { "sample": "swift/value-constructed", "returns": [{ "$datetime": "2026-10-15T14:30:05.25" }, { "$date": "2026-10-15" }, { "$time": "14:30:05.25" }, { "$decimal": "-12.34" }, { "$uuid": "0f8fad5b-d9cb-469f-a165-70867728950e" }], "why": "Rutis.DateTime, CalendarDate and TimeOfDay, a Decimal and a UUID (in lowercase) arrive as a datetime, date, time, decimal and uuid" },
     { "sample": "swift/nan", "throws": {}, "why": "a Double that is not finite does not cross" },
     { "sample": "swift/value-date-key", "throws": {}, "why": "a Dictionary keyed by Date does not cross: a point in time is no map key (design §5)" },
-    { "sample": "swift/error-value", "returns": { "name": "Overdrawn", "message": "out of range" }, "why": "an Error returned as a value arrives as data: its name (its type's) and message (its errorDescription)" }
+    { "sample": "swift/error-value", "returns": { "name": "Overdrawn", "message": "out of range" }, "why": "an Error returned as a value arrives as data: its name (its type's) and message (its errorDescription)" },
+    { "sample": "kotlin/value-instant", "returns": { "$instant": "2026-10-15T03:22:15.123456789Z" }, "why": "a java.time.Instant (made from 05:22:15.123456789+02:00) arrives as an instant in UTC, to the nanosecond" },
+    { "sample": "kotlin/value-kotlin-instant-uuid", "returns": [{ "$instant": "2026-10-15T03:22:15.5Z" }, { "$uuid": "0f8fad5b-d9cb-469f-a165-70867728950e" }], "why": "kotlin.time.Instant and kotlin.uuid.Uuid arrive as an instant and a uuid, as their java counterparts" },
+    { "sample": "kotlin/value-data-class", "returns": { "raw": { "$bytes": "aGVsbG8=" }, "at": { "$instant": "2026-10-15T03:22:15Z" }, "n": null }, "why": "a ByteArray and an Instant inside a @Serializable class arrive as bytes and an instant, not as a list of numbers or text (RutisFormat, never JSON's default encoding)" },
+    { "sample": "kotlin/value-int-keys", "returns": { "$map": [[1, "a"], [2, "b"]] }, "why": "a Map with Int keys arrives as a map, its keys in order" },
+    { "sample": "kotlin/value-set", "returns": { "$set": ["a", "b"] }, "why": "a Set arrives as a set, its elements in order" },
+    { "sample": "kotlin/value-bigint", "returns": { "$bigint": "-123456789012345678901" }, "why": "a BigInteger arrives as a big integer" },
+    { "sample": "kotlin/value-constructed", "returns": [{ "$datetime": "2026-10-15T14:30:05.25" }, { "$date": "2026-10-15" }, { "$time": "14:30:05.25" }, { "$decimal": "1.10" }, { "$uuid": "0f8fad5b-d9cb-469f-a165-70867728950e" }], "why": "LocalDateTime, LocalDate, LocalTime, BigDecimal and UUID arrive as a datetime, date, time, decimal and uuid; the decimal keeps its trailing zero (its scale)" },
+    { "sample": "kotlin/big-long", "returns": { "raw": null, "at": null, "n": { "$bigint": "1152921504606846976" } }, "why": "a Long beyond ±(2^53−1), here inside a @Serializable class, arrives as a big integer (V6): no BigInteger needed" },
+    { "sample": "kotlin/big-long-keys", "returns": { "$map": [[1, "one"], [{ "$bigint": "9223372036854775807" }, "max"]] }, "why": "map keys beyond ±(2^53−1) arrive as big integers, the others as numbers (V6)" },
+    { "sample": "kotlin/nan", "throws": {}, "why": "a Double that is not finite does not cross" },
+    { "sample": "kotlin/exception-value", "returns": { "name": "IllegalStateException", "message": "bad" }, "why": "an exception returned as a value arrives as data: its name and message" }
   ]
 }
diff --git a/crates/rutis-bridge/tests/events_expected.rs b/crates/rutis-bridge/tests/events_expected.rs
index fee72dadd..20420d5ae 100644
--- a/crates/rutis-bridge/tests/events_expected.rs
+++ b/crates/rutis-bridge/tests/events_expected.rs
@@ -116,7 +116,7 @@ fn every_case_runs_somewhere() {
     let tools: Vec<&str> = expected.tool_cases.keys().map(String::as_str).collect();
     assert_eq!(
         tools,
-        ["bun", "go", "node-leaf", "python", "swift"],
+        ["bun", "go", "kotlin", "node-leaf", "python", "swift"],
         "toolCases"
     );
     let counted: std::collections::BTreeMap<String, usize> = tools
diff --git a/crates/rutis-bridge/tests/session_matrix.rs b/crates/rutis-bridge/tests/session_matrix.rs
index bfb62fbf2..6905ac234 100644
--- a/crates/rutis-bridge/tests/session_matrix.rs
+++ b/crates/rutis-bridge/tests/session_matrix.rs
@@ -30,8 +30,16 @@ enum Runtime {
     /// Unix only: Bun on Windows is not a declared platform.
     #[cfg(all(unix, feature = "bun"))]
     Bun,
+    /// The Kotlin SDK's jvm target (`Rutis.serve`), started by the generic
+    /// launcher: a socket path it dials back, and loopback (K-P1; the
+    /// WebSocket column comes with K-P2).
+    #[cfg(feature = "kotlin")]
+    Kotlin,
 }
 
+#[cfg(feature = "kotlin")]
+mod kotlin;
+
 #[derive(Clone, Copy, Debug, PartialEq)]
 enum Via {
     /// `fd:3`. Not on Windows, which hands no descriptor over.
@@ -127,6 +135,12 @@ async fn start(runtime: Runtime, via: Via, dir: &Path, ctx: &Ctx) -> (Arc<Proces
             launcher.inherit_fd = false;
             (launcher, dir.to_owned(), entry)
         }
+        #[cfg(feature = "kotlin")]
+        Runtime::Kotlin => (
+            kotlin::launcher().cwd(dir),
+            dir.to_owned(),
+            PathBuf::from("weather"),
+        ),
     };
     match via {
         Via::WebSocket => return (listening(launcher, &anchor, ctx).await, entry),
@@ -479,3 +493,19 @@ async fn bun_dialing_a_socket_path() {
 async fn bun_listening_on_a_websocket() {
     semantics(Runtime::Bun, Via::WebSocket).await;
 }
+
+#[cfg(feature = "kotlin")]
+#[tokio::test(flavor = "multi_thread")]
+#[cfg_attr(
+    windows,
+    ignore = "socket path column: Windows has no Unix sockets (loopback handover only)"
+)]
+async fn kotlin_dialing_a_socket_path() {
+    semantics(Runtime::Kotlin, Via::DialBack).await;
+}
+
+#[cfg(feature = "kotlin")]
+#[tokio::test(flavor = "multi_thread")]
+async fn kotlin_dialing_a_loopback_address() {
+    semantics(Runtime::Kotlin, Via::Loopback).await;
+}
diff --git a/crates/rutis-loader/Cargo.toml b/crates/rutis-loader/Cargo.toml
index 1369bcbab..c26e9f3ff 100644
--- a/crates/rutis-loader/Cargo.toml
+++ b/crates/rutis-loader/Cargo.toml
@@ -32,6 +32,9 @@ go = ["binary", "rutis-bridge/go"]
 swift = ["binary", "rutis-bridge/swift"]
 # JavaScript/TypeScript leaf plugins in Bun (`bun:<module>` rows).
 bun = ["runtimes", "rutis-bridge/bun"]
+# Tests only: Kotlin plugins (kotlin/rutis, the jvm target) as rows of a
+# runtime started through the generic `Launcher`.
+kotlin = ["runtimes", "rutis-bridge/kotlin"]
 # What every language shares; enabled by the language features.
 runtimes = ["dep:rutis-bridge"]
 # What compiled languages (one runtime per program: Go, Swift)
diff --git a/crates/rutis-loader/tests/common/runtimes.rs b/crates/rutis-loader/tests/common/runtimes.rs
index 77ab20c7b..61914ec9a 100644
--- a/crates/rutis-loader/tests/common/runtimes.rs
+++ b/crates/rutis-loader/tests/common/runtimes.rs
@@ -206,3 +206,44 @@ pub struct NoConfig {}
 pub fn active(entry: &EntryInfo) -> bool {
     matches!(&entry.status, EntryStatus::Running(s) if s.state == FiberState::Active)
 }
+
+// ── Kotlin ──────────────────────────────────────────────────────
+
+/// The Kotlin SDK's conformance jar (`kotlin/rutis/rutis-conformance`,
+/// Gradle task `fatJar`: the test plugins served by `Rutis.serve` on the
+/// jvm target), built once with the Gradle wrapper, or the one
+/// `RUTIS_KOTLIN_JAR` names.
+#[cfg(feature = "kotlin")]
+pub fn kotlin_jar() -> &'static Path {
+    static JAR: OnceLock<PathBuf> = OnceLock::new();
+    JAR.get_or_init(|| {
+        if let Some(jar) = std::env::var_os("RUTIS_KOTLIN_JAR") {
+            return PathBuf::from(jar);
+        }
+        let project = repo().join("kotlin/rutis");
+        let wrapper = project.join(if cfg!(windows) {
+            "gradlew.bat"
+        } else {
+            "gradlew"
+        });
+        let status = std::process::Command::new(wrapper)
+            .args(["--quiet", ":rutis-conformance:fatJar"])
+            .current_dir(&project)
+            .status()
+            .expect("the Gradle wrapper runs (a JDK 17 on PATH or JAVA_HOME)");
+        assert!(status.success(), "gradlew :rutis-conformance:fatJar");
+        project.join("rutis-conformance/build/libs/rutis-conformance-all.jar")
+    })
+}
+
+/// The Kotlin runtime serving the test plugins, as the generic launcher
+/// starts it (design K-P1: no Kotlin runtime in rutis-host), in `project`.
+#[cfg(feature = "kotlin")]
+pub fn kotlin_launcher(project: &Path) -> rutis_bridge::runtime::Launcher {
+    rutis_bridge::runtime::Launcher::new("java")
+        .arg("-XX:TieredStopAtLevel=1")
+        .arg("-XX:+UseSerialGC")
+        .arg("-jar")
+        .arg(kotlin_jar())
+        .cwd(project)
+}
diff --git a/crates/rutis-loader/tests/events_conformance.rs b/crates/rutis-loader/tests/events_conformance.rs
index f3c5375b0..132ee7650 100644
--- a/crates/rutis-loader/tests/events_conformance.rs
+++ b/crates/rutis-loader/tests/events_conformance.rs
@@ -16,7 +16,8 @@
 //! some for X (a language it needs is not available here).
 //! `RUTIS_EVENTS_CASE=<prefix>[,<prefix>...]` runs only the cases whose id
 //! starts with one of them (each must match a case).
-//! `RUTIS_EVENTS_REQUIRE=<language>[,...]` (CI: `node,python,go,bun`)
+//! `RUTIS_EVENTS_REQUIRE=<language>[,...]` (CI: `node,python,go,bun`; the
+//! Kotlin job adds `kotlin`)
 //! fails instead of skipping when one of them cannot run here.
 //!
 //! The suite runs one test at a time (each starts every runtime; a lock
@@ -54,8 +55,8 @@ use serde_json::{json, Value as Json};
 
 // ── Languages ───────────────────────────────────────────────────
 
-/// Whether `language` can run here: Bun and Go need their features and
-/// their programs on PATH.
+/// Whether `language` can run here: Bun, Go and Kotlin need their features
+/// and their programs on PATH (Kotlin: `java`).
 fn available(language: &str) -> bool {
     let on_path = |program: &str| {
         std::process::Command::new(program)
@@ -69,6 +70,7 @@ fn available(language: &str) -> bool {
         "node" | "node-leaf" | "python" => true,
         "bun" => cfg!(feature = "bun") && on_path("bun"),
         "go" => cfg!(feature = "go") && on_path("go"),
+        "kotlin" => cfg!(feature = "kotlin") && on_path("java"),
         "swift" => cfg!(all(feature = "swift", target_os = "macos")) && on_path("swift"),
         _ => false,
     }
@@ -191,6 +193,23 @@ fn runtime(language: &str, name: &str, dir: &Path) -> (LocalRuntime, Modules) {
                 .collect();
             (Launcher::go(go_binary(), &project), project, modules)
         }
+        // The Kotlin runtime (`Rutis.serve` on the jvm target), started by
+        // the generic launcher; one plugin provides every emitter undeclared
+        // (its sync method on the wire: `dispatchSync`), as in Go.
+        #[cfg(feature = "kotlin")]
+        "kotlin" => {
+            let project = dir.join(format!("{name}-project"));
+            std::fs::create_dir_all(&project).unwrap();
+            let modules = variants
+                .iter()
+                .map(|v| (*v, "conformance-events".to_owned()))
+                .collect();
+            (
+                common::runtimes::kotlin_launcher(&project),
+                project,
+                modules,
+            )
+        }
         #[cfg(all(feature = "swift", target_os = "macos"))]
         "swift" => {
             let project = dir.join(format!("{name}-project"));
@@ -1243,6 +1262,13 @@ async fn events_with_x_a_go_plugin() {
     conformance("go").await;
 }
 
+/// guarantee: events/one-bus, X a Kotlin plugin (the SDK's jvm target).
+#[cfg(feature = "kotlin")]
+#[tokio::test(flavor = "multi_thread")]
+async fn events_with_x_a_kotlin_plugin() {
+    conformance("kotlin").await;
+}
+
 /// guarantee: events/one-bus, X a Swift plugin.
 #[cfg(all(feature = "swift", target_os = "macos"))]
 #[tokio::test(flavor = "multi_thread")]
diff --git a/docs/ci.en.md b/docs/ci.en.md
index 5c8f48fc4..022cfc738 100644
--- a/docs/ci.en.md
+++ b/docs/ci.en.md
@@ -146,6 +146,10 @@ The runtime contract (`runtime::testing::runtime`, `tests/session_matrix.rs`):
 | Bun | `fd:3`, socket path dialed back | Runs; `runtimes-bun` reruns with `RUTIS_LOCAL_HANDOVER=loopback` | Runs | Not compiled: as above |
 | Bun | loopback TCP | No column of its own: the rerun of the row above covers it | As Linux | Not compiled: as above |
 | Bun | WebSocket (the runtime listens, Rust dials) | Runs | Runs | Not compiled: as above |
+| Kotlin (the jvm target's `Rutis.serve`, started by the generic `Launcher` as `java -jar`) | socket path dialed back | Runs | Runs | Skipped: Windows has loopback only |
+| Kotlin | loopback TCP | Runs | Runs | Runs |
+| Kotlin | `fd:3` | Not run: the JDK has no public API to wrap an inherited descriptor (design §4.3) | As Linux | As Linux |
+| Kotlin | WebSocket | Not run: listening is K-P2 | As Linux | As Linux |
 | A Node package without `fd` falls back to dialing back | — | Runs | Runs | Skipped: Windows has loopback only |
 
 The first two columns and the last row start the process through the `Process` facade, and the contract also checks the exit status after the crash; the loopback and WebSocket columns attach to a channel and check only that the crash ends the session. On Windows, `python_runtime.rs`, `go_runtime.rs` and others cover the facade's loopback start.
diff --git a/docs/ci.md b/docs/ci.md
index e3be14dff..f83c6cc2a 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -146,6 +146,10 @@ bridge 的一致性套件在哪些实现、哪些通道、哪些平台上运行
 | Bun | `fd:3`、回拨 socket 路径 | 运行；`runtimes-bun` 用 `RUTIS_LOCAL_HANDOVER=loopback` 重跑 | 运行 | 不编译：同上 |
 | Bun | loopback TCP | 不跑单独的列：由上一行的重跑覆盖 | 同 Linux | 不编译：同上 |
 | Bun | WebSocket（运行时监听，Rust 拨入） | 运行 | 运行 | 不编译：同上 |
+| Kotlin（jvm target 的 `Rutis.serve`，经通用 `Launcher` 以 `java -jar` 启动） | 回拨 socket 路径 | 运行 | 运行 | 跳过：Windows 只有 loopback |
+| Kotlin | loopback TCP | 运行 | 运行 | 运行 |
+| Kotlin | `fd:3` | 不跑：JDK 没有包装继承描述符的公开 API（设计 §4.3） | 同 Linux | 同 Linux |
+| Kotlin | WebSocket | 不跑：监听属于 K-P2 | 同 Linux | 同 Linux |
 | 不声明 `fd` 的 Node 包回退到回拨 | — | 运行 | 运行 | 跳过：Windows 只有 loopback |
 
 前两列和最后一行经 `Process` 门面启动进程，契约还检查崩溃后的退出状态；loopback、WebSocket 两列接到通道上，只检查崩溃结束会话。Windows 上 `Process` 门面的 loopback 启动由 `python_runtime.rs`、`go_runtime.rs` 等覆盖。
diff --git a/kotlin/rutis/rutis-conformance/build.gradle.kts b/kotlin/rutis/rutis-conformance/build.gradle.kts
index ebadbc333..5943aff67 100644
--- a/kotlin/rutis/rutis-conformance/build.gradle.kts
+++ b/kotlin/rutis/rutis-conformance/build.gradle.kts
@@ -1,7 +1,9 @@
 // The programs the Rust conformance tests start (design §九), on the jvm
-// target: the session fixture (`arcships.rutis.conformance.SessionKt`), in
-// one jar with every dependency, `build/libs/rutis-conformance-all.jar`:
-// `java -cp <jar> arcships.rutis.conformance.SessionKt <channel>`.
+// target, in one jar with every dependency, build/libs/rutis-conformance-all.jar:
+// the runtime serving the test plugins through Rutis.serve (`java -jar <jar>
+// <channel> <project>`) and the session fixture (`java -cp <jar>
+// arcships.rutis.conformance.SessionKt <channel>`). Its tests check the
+// testing tool against the expectations the real runtimes meet.
 plugins {
     kotlin("jvm")
     kotlin("plugin.serialization")
@@ -24,13 +26,24 @@ dependencies {
     // The session fixture serves the session layer directly: its data is JSON.
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.9.0")
     ksp(project(":rutis-ksp"))
+    testImplementation(kotlin("test"))
+    testImplementation("org.junit.jupiter:junit-jupiter:5.11.4")
+    testRuntimeOnly("org.junit.platform:junit-platform-launcher:1.11.4")
+    kspTest(project(":rutis-ksp"))
+}
+
+// The testing tool against the expectations the real runtimes are checked
+// against (crates/rutis-bridge/src/runtime/testing/*.expected.json).
+tasks.test {
+    useJUnitPlatform()
+    systemProperty("rutis.repo", rootProject.projectDir.resolve("../..").canonicalPath)
 }
 
 val fatJar by tasks.registering(Jar::class) {
     archiveClassifier.set("all")
     archiveVersion.set("")
     duplicatesStrategy = DuplicatesStrategy.EXCLUDE
-    manifest { attributes["Main-Class"] = "arcships.rutis.conformance.SessionKt" }
+    manifest { attributes["Main-Class"] = "arcships.rutis.conformance.MainKt" }
     from(sourceSets.main.get().output)
     dependsOn(configurations.runtimeClasspath)
     from({ configurations.runtimeClasspath.get().filter { it.name.endsWith(".jar") }.map { zipTree(it) } })
diff --git a/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/Main.kt b/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/Main.kt
new file mode 100644
index 000000000..51b2e3dca
--- /dev/null
+++ b/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/Main.kt
@@ -0,0 +1,12 @@
+// The test plugins in one runtime, served by the desktop test entry
+// (Rutis.serve): `java -jar rutis-conformance-all.jar <channel> <project>`.
+package arcships.rutis.conformance
+
+import arcships.rutis.Rutis
+import arcships.rutis.conformance.plugins.conformanceEvents
+import arcships.rutis.conformance.plugins.weather
+import arcships.rutis.serve
+
+fun main(args: Array<String>) {
+    Rutis.serve(args, weather, conformanceEvents)
+}
diff --git a/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/ConformanceEvents.kt b/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/ConformanceEvents.kt
new file mode 100644
index 000000000..08208ee5f
--- /dev/null
+++ b/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/ConformanceEvents.kt
@@ -0,0 +1,311 @@
+// The plugin conformance-events (#464, docs/design-events-protocol-2026-10-18.md
+// §13.1): each row is one participant of an event expectation, a listener or
+// an emitter, and logs what it does through the host's synchronous service
+// events-log. One plugin provides every emitter undeclared (announced: its
+// methods `async` on the wire), its synchronous method named `dispatchSync`.
+package arcships.rutis.conformance.plugins
+
+import arcships.rutis.Ctx
+import arcships.rutis.EventArgs
+import arcships.rutis.Emitter
+import arcships.rutis.Listener
+import arcships.rutis.RemoteFunction
+import arcships.rutis.Rutis
+import arcships.rutis.RutisClient
+import arcships.rutis.RutisException
+import arcships.rutis.RutisFormat
+import arcships.rutis.RutisService
+import kotlinx.coroutines.NonCancellable
+import kotlinx.coroutines.async
+import kotlinx.coroutines.awaitCancellation
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.Contextual
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.booleanOrNull
+import kotlinx.serialization.json.jsonArray
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
+import kotlinx.serialization.json.longOrNull
+
+@Serializable
+data class Thrown(val name: String = "Error", val message: String = "")
+
+@Serializable
+data class ListenOptions(val prepend: Boolean = false, val global: Boolean = false)
+
+/** A row's configuration: a listener, or an emitter. */
+@Serializable
+data class Participant(
+    val label: String = "",
+    val emitter: Boolean = false,
+    val name: String = "",
+    val log: JsonElement? = null,
+    val does: JsonElement? = null,
+    val options: ListenOptions = ListenOptions(),
+    /** A service of this name the row provides besides (rutis/service). */
+    val provides: String = "",
+    /** The row's apply fails with this error, having registered nothing. */
+    val fails: Thrown? = null,
+)
+
+@Serializable
+data class FilterSpec(val keep: List<String> = emptyList(), val throws: Thrown? = null)
+
+@Serializable
+data class CancelSpec(val `when`: String)
+
+/** An emission (§13.2). */
+@Serializable
+data class Spec(
+    val mode: String,
+    val name: String = "",
+    val args: List<@Contextual Any?> = emptyList(),
+    val filter: FilterSpec? = null,
+    /** A text it returns, or {"echo": true}: its first argument. */
+    val terminal: JsonElement? = null,
+    val cancel: CancelSpec? = null,
+)
+
+@RutisClient
+interface EventsLog {
+    fun add(entry: String)
+
+    /** Logs `filter:<row>` and keeps the description (filterSees). */
+    fun filter(description: Map<String, @Contextual Any?>)
+}
+
+/** The host's events-log.wait, where it has one: an emitter waits for a listener of another process to log. */
+@RutisClient
+interface EventsLogWait {
+    suspend fun wait(entry: String)
+}
+
+/** What this process logged, so that an emitter of it can wait for a listener of it. */
+private object Logged {
+    private val entries = ArrayList<String>()
+    private val lock = Object()
+
+    fun note(entry: String) = synchronized(lock) {
+        entries.add(entry)
+        lock.notifyAll()
+    }
+
+    suspend fun waitFor(entry: String) {
+        while (synchronized(lock) { entry !in entries }) delay(5)
+    }
+}
+
+/** The service emitter-<label>. */
+@RutisService
+class EventEmitter internal constructor(private val row: ParticipantRow) {
+    /** Emits `spec` from the row, natively, and returns the result. */
+    suspend fun dispatch(spec: Spec): Any? = row.dispatch(spec)
+
+    /** [dispatch] for `bail` and `waterfall-sync`. */
+    suspend fun dispatchSync(spec: Spec): Any? = row.dispatch(spec)
+}
+
+/** The service a row provides with `provides`. */
+@RutisService
+class Present {
+    fun ping(): String = "pong"
+}
+
+class ParticipantRow internal constructor(
+    private val ctx: Ctx,
+    private val p: Participant,
+    private val log: EventsLog,
+    private val wait: EventsLogWait?,
+) {
+    /** Logs `entry`, whatever cancelled the code that logs it. */
+    suspend fun add(entry: String) {
+        Logged.note(entry)
+        withContext(NonCancellable) {
+            // An interrupted thread (its call was cancelled) still logs.
+            val interrupted = Thread.interrupted()
+            try {
+                log.add(entry)
+            } finally {
+                if (interrupted) Thread.currentThread().interrupt()
+            }
+        }
+    }
+
+    private suspend fun waitFor(entry: String) {
+        if (wait != null) wait.wait(entry) else Logged.waitFor(entry)
+    }
+
+    /** Reports a description the filter is called with to events-log's filter, whole (§4.2). */
+    private fun sees(listener: Listener) {
+        Logged.note("filter:${listener.row}")
+        log.filter(
+            linkedMapOf(
+                "name" to listener.name, "prefix" to listener.prefix, "plugin" to listener.plugin, "row" to listener.row,
+                "runtime" to listener.runtime, "node" to listener.node,
+                "scope" to listener.scope.map { linkedMapOf("id" to it.id, "group" to it.group) }, "global" to listener.global,
+            ),
+        )
+    }
+
+    suspend fun dispatch(spec: Spec): Any? {
+        val cancel = spec.cancel ?: return emit(spec)
+        return coroutineScope {
+            val dispatching = async { emit(spec) }
+            val watcher = launch {
+                waitFor(cancel.`when`)
+                dispatching.cancel()
+            }
+            try {
+                dispatching.await()
+            } finally {
+                watcher.cancel()
+            }
+        }
+    }
+
+    private suspend fun emit(spec: Spec): Any? {
+        val name = spec.name.ifEmpty { p.name }
+        val filter = spec.filter
+        val emitter: Emitter = if (filter == null) {
+            ctx
+        } else {
+            ctx.filter { listener ->
+                filter.throws?.let { throw RutisException(it.name, it.message) }
+                sees(listener)
+                listener.row in filter.keep
+            }
+        }
+        val args = spec.args.toTypedArray()
+        return when (spec.mode) {
+            "emit" -> {
+                emitter.emit(name, *args)
+                null
+            }
+            "parallel" -> {
+                emitter.parallel(name, *args)
+                null
+            }
+            "serial" -> emitter.serial(name, *args)
+            "bail" -> emitter.bail(name, *args)
+            "waterfall" -> {
+                val terminal = spec.terminal
+                val last: (suspend (EventArgs) -> Any?)? = when {
+                    terminal is JsonPrimitive && terminal.isString -> { _ ->
+                        add("terminal")
+                        terminal.content
+                    }
+                    terminal is JsonObject && terminal["echo"]?.jsonPrimitive?.booleanOrNull == true -> { a ->
+                        add("terminal")
+                        a.firstOrNull()
+                    }
+                    else -> null
+                }
+                emitter.waterfall(name, *args, terminal = last)
+            }
+            else -> throw IllegalArgumentException("conformance-events: mode ${spec.mode} is not the Kotlin runtime's to emit")
+        }
+    }
+
+    /** What a listener logs when it starts (§13.2 `log`), or null. */
+    private fun entry(args: EventArgs): String? {
+        val label = p.label
+        return when (val log = p.log) {
+            null, JsonNull -> label
+            is JsonPrimitive -> when {
+                log.isString && log.content == "label" -> label
+                log.isString && log.content == "arg" -> "$label:${text(args.firstOrNull())}"
+                !log.isString && log.content == "false" -> null
+                else -> label
+            }
+            is JsonArray -> {
+                @Suppress("UNCHECKED_CAST")
+                val record = args.firstOrNull() as? Map<String, Any?> ?: emptyMap()
+                label + ":" + log.joinToString(",") { text(record[it.jsonPrimitive.content]) }
+            }
+            else -> label
+        }
+    }
+
+    suspend fun listen(args: EventArgs): Any? {
+        entry(args)?.let { add(it) }
+        return does(p.does ?: JsonObject(emptyMap()), args)
+    }
+
+    private suspend fun does(spec: JsonElement, args: EventArgs): Any? {
+        val does = spec as? JsonObject ?: throw IllegalArgumentException("conformance-events: does $spec")
+        fun next() = args.next ?: throw IllegalStateException("conformance-events: ${p.label} has no next in this dispatch")
+        return when {
+            "returns" in does -> arcships.rutis.Generated.toNative(does["returns"])
+            "returnsNothing" in does -> null
+            "echo" in does -> args.firstOrNull()
+            "throws" in does -> {
+                val thrown = does["throws"]!!.jsonObject
+                throw RutisException(thrown["name"]?.jsonPrimitive?.content ?: "Error", thrown["message"]?.jsonPrimitive?.content ?: "")
+            }
+            "after" in does -> {
+                delay(does["after"]!!.jsonPrimitive.longOrNull ?: 0)
+                does(does["then"] ?: JsonObject(emptyMap()), args)
+            }
+            "next" in does -> {
+                val prefix = does["next"]!!.jsonPrimitive.content
+                val rest = next()()
+                prefix + (if (rest == null) "" else text(rest))
+            }
+            "veto" in does -> arcships.rutis.Generated.toNative(does["veto"])
+            "nextTwice" in does -> {
+                val n = next()
+                n()
+                n()
+            }
+            "waits" in does -> try {
+                awaitCancellation()
+            } finally {
+                add("${p.label}:cancelled")
+            }
+            "calls" in does -> {
+                val fn = args.firstOrNull() as? RemoteFunction
+                    ?: throw IllegalArgumentException("conformance-events: ${p.label} needs a function, got ${args.firstOrNull()}")
+                fn("x")
+            }
+            "emits" in does -> {
+                val emitted = RutisFormat.decode(Spec.serializer(), does["emits"])
+                dispatch(if (emitted.name.isEmpty()) emitted.copy(name = p.name) else emitted)
+            }
+            else -> throw IllegalArgumentException("conformance-events: unknown does $does")
+        }
+    }
+
+    /** A logged value: numbers without a fraction as integers. */
+    private fun text(value: Any?): String = when (value) {
+        null -> "null"
+        is Double -> if (value == Math.floor(value) && !value.isInfinite()) value.toLong().toString() else value.toString()
+        else -> value.toString()
+    }
+}
+
+val conformanceEvents = Rutis.define<Participant>(
+    name = "conformance-events",
+    inject = listOf("events-log"),
+) { ctx, p ->
+    p.fails?.let { throw RutisException(it.name, it.message) }
+    val wait = try {
+        ctx.use<EventsLogWait>("events-log")
+    } catch (_: IllegalArgumentException) {
+        null
+    }
+    val row = ParticipantRow(ctx, p, ctx.use<EventsLog>("events-log"), wait)
+    if (p.emitter) {
+        ctx.provide("emitter-${p.label}", EventEmitter(row))
+    } else {
+        ctx.on(p.name, prepend = p.options.prepend, global = p.options.global) { args -> row.listen(args) }
+    }
+    if (p.provides.isNotEmpty()) ctx.provide(p.provides, Present())
+}
diff --git a/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/Weather.kt b/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/Weather.kt
new file mode 100644
index 000000000..77064ebda
--- /dev/null
+++ b/kotlin/rutis/rutis-conformance/src/main/kotlin/arcships/rutis/conformance/plugins/Weather.kt
@@ -0,0 +1,119 @@
+// The runtime conformance plugin (rutis_bridge::runtime::testing::runtime)
+// for the Kotlin SDK: it injects `clock` and provides `weather`. What calls on
+// it return is in crates/rutis-bridge/src/runtime/testing/weather.expected.json.
+package arcships.rutis.conformance.plugins
+
+import arcships.rutis.Rutis
+import arcships.rutis.RutisClient
+import arcships.rutis.RutisService
+import arcships.rutis.service
+import kotlinx.coroutines.delay
+import kotlinx.serialization.Contextual
+import kotlinx.serialization.Serializable
+import java.math.BigDecimal
+import java.math.BigInteger
+import java.time.Instant
+import java.time.LocalDate
+import java.time.LocalDateTime
+import java.time.LocalTime
+import java.time.OffsetDateTime
+import java.time.ZoneOffset
+import java.util.UUID
+import kotlin.system.exitProcess
+
+@Serializable
+data class WeatherConfig(val city: String = "")
+
+@RutisClient
+interface Clock {
+    fun now(): Long
+}
+
+/** A data class with fields JSON would have turned into text: they cross as their values (V9). */
+@Serializable
+data class Reading(
+    val raw: ByteArray? = null,
+    @Contextual val at: Instant? = null,
+    val n: Long? = null,
+)
+
+private val oslo = ZoneOffset.ofHours(2)
+
+/** Values only Kotlin makes, by name (`samples` in the expectations). */
+private val samples: Map<String, () -> Any?> = linkedMapOf(
+    "kotlin/value-instant" to { OffsetDateTime.of(2026, 10, 15, 5, 22, 15, 123456789, oslo).toInstant() },
+    "kotlin/value-kotlin-instant-uuid" to {
+        listOf(kotlin.time.Instant.parse("2026-10-15T03:22:15.5Z"), kotlin.uuid.Uuid.parse("0f8fad5b-d9cb-469f-a165-70867728950e"))
+    },
+    "kotlin/value-data-class" to { Reading(raw = "hello".toByteArray(), at = OffsetDateTime.of(2026, 10, 15, 5, 22, 15, 0, oslo).toInstant()) },
+    "kotlin/value-int-keys" to { linkedMapOf(1 to "a", 2 to "b") },
+    "kotlin/value-set" to { linkedSetOf("a", "b") },
+    "kotlin/value-bigint" to { BigInteger("-123456789012345678901") },
+    "kotlin/value-constructed" to {
+        listOf(
+            LocalDateTime.of(2026, 10, 15, 14, 30, 5, 250_000_000),
+            LocalDate.of(2026, 10, 15),
+            LocalTime.of(14, 30, 5, 250_000_000),
+            BigDecimal("1.10"),
+            UUID.fromString("0f8fad5b-d9cb-469f-a165-70867728950e"),
+        )
+    },
+    "kotlin/big-long" to { Reading(n = 1L shl 60) },
+    "kotlin/big-long-keys" to { linkedMapOf(1L to "one", Long.MAX_VALUE to "max") },
+    "kotlin/nan" to { Double.NaN },
+    "kotlin/exception-value" to { IllegalStateException("bad") },
+)
+
+@RutisService
+class Weather(private val clock: Clock, @Volatile var city: String) {
+    fun today(): String = "$city at ${clock.now()}"
+
+    suspend fun later(): String {
+        delay(10)
+        return "$city later"
+    }
+
+    /** Calls back during the call. */
+    fun each(callback: (String) -> String): List<String> = listOf("mon", "tue").map(callback)
+
+    /** Returns the value it was given. */
+    fun echo(value: Any?): Any? = value
+
+    fun crash() {
+        exitProcess(17)
+    }
+
+    /** The values only Kotlin makes. */
+    fun samples(): List<String> = samples.keys.toList()
+
+    /** The value `name`. */
+    fun sample(name: String): Any? = (samples[name] ?: throw IllegalArgumentException("no sample $name"))()
+}
+
+/** `undeclared` in the expectations: provided without a declaration, with a method inherited. */
+open class Days {
+    fun week(n: Int): List<String> = listOf("mon", "tue", "wed").take(n)
+}
+
+@RutisService
+class Forecast(private val city: String) : Days() {
+    fun tomorrow(): String = "$city tomorrow"
+
+    @Suppress("unused")
+    private fun hidden(): String = "not a method rutis sees"
+}
+
+val weather = Rutis.define<WeatherConfig>(
+    name = "weather",
+    inject = listOf("clock"),
+    provides = mapOf("weather" to service<Weather>(sync = setOf("today", "each", "echo", "crash", "samples", "sample"))),
+) { ctx, config ->
+    val w = Weather(ctx.use<Clock>("clock"), config.city.ifEmpty { "Oslo" })
+    ctx.provide("weather", w)
+    ctx.provide("forecast", Forecast("Oslo"))
+    ctx.on("weather/city") { args ->
+        w.city = args.singleOrNull() as? String ?: throw IllegalArgumentException("weather/city needs one city")
+        null
+    }
+    ctx.effect { println("weather: bye") }
+}
diff --git a/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/EventsConformanceTest.kt b/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/EventsConformanceTest.kt
new file mode 100644
index 000000000..4e5bd233a
--- /dev/null
+++ b/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/EventsConformanceTest.kt
@@ -0,0 +1,334 @@
+package arcships.rutis.conformance
+
+import arcships.rutis.RutisException
+import arcships.rutis.RutisService
+import arcships.rutis.conformance.plugins.conformanceEvents
+import arcships.rutis.testing.Loaded
+import arcships.rutis.testing.RutisTest
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.booleanOrNull
+import kotlinx.serialization.json.jsonArray
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
+import java.util.concurrent.CompletableFuture
+import java.util.concurrent.TimeUnit
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.fail
+
+/** The language of the Kotlin testing tool in the file. */
+private const val LANGUAGE = "kotlin"
+
+/** How long a log expectation may take to hold (events.rs SETTLE). */
+private const val SETTLE = 5_000L
+
+/** How long `logLacks` / `reported` wait after the rest held (events.rs LACKS). */
+private const val LACKS = 300L
+
+/** events-log, as the test gives it: add(entry) and filter(description), both sync. */
+@RutisService
+class EventLog {
+    private val entries = ArrayList<String>()
+
+    fun add(entry: String) {
+        synchronized(entries) { entries.add(entry) }
+    }
+
+    /** Logs `filter:<row>` of the description. */
+    fun filter(description: Map<String, Any?>) = add("filter:" + description["row"])
+
+    internal fun list(): List<String> = synchronized(entries) { entries.toList() }
+}
+
+private class Case(val raw: JsonObject) {
+    val case: String = raw["case"]!!.jsonPrimitive.content
+    val name: String = raw["name"]!!.jsonPrimitive.content
+    val listeners: List<JsonObject> = raw["listeners"]?.jsonArray?.map { it.jsonObject } ?: emptyList()
+    val steps: List<JsonObject> = raw["steps"]?.jsonArray?.map { it.jsonObject } ?: emptyList()
+    private val only: List<JsonObject> = raw["only"]?.jsonArray?.map { it.jsonObject } ?: emptyList()
+    private val except: List<JsonObject> = raw["except"]?.jsonArray?.map { it.jsonObject } ?: emptyList()
+    private val tool: Boolean = (raw["tool"] as? JsonPrimitive)?.booleanOrNull ?: true
+
+    /** The emitter rows of a step: its emit's, or its concurrent ones'. */
+    private fun emitRows(step: JsonObject): List<String> {
+        (step["emit"] as? JsonObject)?.let { return listOf((it["row"] as? JsonPrimitive)?.content ?: "e") }
+        return step["concurrent"]?.jsonArray?.flatMap { emitRows(it.jsonObject) } ?: emptyList()
+    }
+
+    /** The labels of the case (events.rs `places`): its listeners, loaded participants and emitter rows. */
+    private fun labels(): Set<String> {
+        val labels = HashSet<String>()
+        listeners.forEach { labels.add(it["label"]!!.jsonPrimitive.content) }
+        for (step in steps) {
+            (step["load"] as? JsonObject)?.let { labels.add(it["label"]!!.jsonPrimitive.content) }
+            labels.addAll(emitRows(step))
+        }
+        return labels
+    }
+
+    /** Whether a limit (an only / except item) holds with every label at X in Kotlin (events.rs `limit_holds`). */
+    private fun holds(limit: JsonObject, labels: Set<String>): Boolean = limit.entries.filter { it.key != "why" }.all { (key, list) ->
+        (key == "X" || key == "Y" || key in labels) && list.jsonArray.any { it.jsonPrimitive.content == LANGUAGE }
+    }
+
+    /** Whether the case runs on the Kotlin testing tool, and why not (events.rs `tool_combo`). */
+    fun forKotlin(): String? {
+        if (!tool) return "tool: false"
+        val labels = labels()
+        only.firstOrNull { !holds(it, labels) }?.let { return "only: ${it["why"]}" }
+        except.firstOrNull { holds(it, labels) }?.let { return "except: ${it["why"]}" }
+        return null
+    }
+}
+
+/** One case on one harness. */
+private class Run(val c: Case, val groups: Map<String, String>, val log: EventLog, val problems: MutableList<String>) {
+    lateinit var root: Loaded
+    val rows = HashMap<String, Loaded>()
+    val participants = HashMap<String, Map<String, Any?>>()
+    var generation = 0
+    var pending: CompletableFuture<Result<Any?>>? = null
+    var reported = 0
+
+    fun scopeOf(path: String?): List<arcships.rutis.Scope> {
+        if (path == null || path == "" || path == "root") return emptyList()
+        val segments = path.split("/")
+        return RutisTest.scope(path, *segments.indices.map { groups[segments.subList(0, it + 1).joinToString("/")] ?: segments[it] }.toTypedArray())
+    }
+
+    /** Loads a listener row. */
+    fun load(raw: JsonObject) {
+        @Suppress("UNCHECKED_CAST")
+        val listener = (arcships.rutis.internal.Native.toNative(raw) as Map<String, Any?>).toMutableMap()
+        if ("name" !in listener) listener["name"] = c.name
+        val label = listener["label"] as String
+        rows[label] = root.load(listener, row = label, scope = scopeOf(listener["scope"] as? String))
+        participants[label] = listener
+    }
+
+    /** Changes the row `label`'s config (a new generation), so it registers its listeners again. */
+    fun update(label: String) {
+        val participant = participants[label] ?: fail("no listener row $label to update")
+        generation++
+        val config = participant + ("generation" to generation.toLong())
+        rows[label]!!.update(config)
+        participants[label] = config
+    }
+
+    /** The emitter row of `label` in `scope`, created on first use. */
+    fun emitter(label: String, scope: String?): Pair<Loaded, String> {
+        val key = if (scope == null || scope == "" || scope == "root") label else label + "-" + scope.replace("/", "-")
+        val row = rows.getOrPut(key) { root.load(mapOf("label" to key, "emitter" to true), row = key, scope = scopeOf(scope)) }
+        return row to key
+    }
+
+    fun emit(spec: JsonObject): Result<Any?> {
+        val row = (spec["row"] as? JsonPrimitive)?.content ?: "e"
+        val (loaded, key) = emitter(row, (spec["scope"] as? JsonPrimitive)?.content)
+        val mode = spec["mode"]!!.jsonPrimitive.content
+        val request = linkedMapOf<String, Any?>(
+            "mode" to JsonPrimitive(mode),
+            "name" to JsonPrimitive((spec["name"] as? JsonPrimitive)?.content ?: c.name),
+            "args" to (spec["args"]?.jsonArray?.map(::fromWritten) ?: emptyList()),
+        )
+        spec["filter"]?.let { request["filter"] = it }
+        spec["terminal"]?.let { request["terminal"] = it }
+        spec["cancel"]?.let { request["cancel"] = it }
+        val method = if (mode == "bail" || mode == "waterfall-sync") "dispatchSync" else "dispatch"
+        return runBlocking {
+            runCatching { withTimeout(10_000) { loaded.service("emitter-$key").raw(method, listOf(request)) } }
+        }
+    }
+
+    private fun matches(error: Throwable, want: JsonObject): String? {
+        if (error !is RutisException) return "not an error of the plugin: $error"
+        val name = (want["name"] as? JsonPrimitive)?.content
+        val message = (want["message"] as? JsonPrimitive)?.content
+        if (!name.isNullOrEmpty() && error.name != name) return "name ${error.name}, want $name ($error)"
+        if (!message.isNullOrEmpty() && !error.message.contains(message)) return "message ${error.message}, want $message"
+        val errors = want["errors"] as? JsonArray ?: return null
+        if (error.errors.size != errors.size) return "errors of $error, want ${errors.size}"
+        for ((i, child) in errors.withIndex()) matches(error.errors[i], child.jsonObject)?.let { return "errors[$i]: $it" }
+        return null
+    }
+
+    /** `returns` and `throws` against the dispatches that end in a step (events.rs `check_outcomes`). */
+    fun checkOutcomes(where: String, e: JsonObject, outcomes: List<Result<Any?>>) {
+        if ((e["cancelled"] as? JsonPrimitive)?.booleanOrNull == true) {
+            problems.add("$where: cancelled: the testing tool does not give up a dispatch")
+            return
+        }
+        val returns = e["returns"]
+        val throws = e["throws"] as? JsonObject
+        if ((returns != null || throws != null) && outcomes.isEmpty()) {
+            problems.add("$where: expects a result, but no dispatch ends in this step")
+            return
+        }
+        for (got in outcomes) {
+            if (throws == null && got.isFailure) {
+                problems.add("$where: expected the dispatch to succeed, it threw ${got.exceptionOrNull()}")
+                continue
+            }
+            if (returns != null && got.isSuccess) {
+                val have = written(got.getOrNull())
+                if (have != normalized(returns)) problems.add("$where: got $have, want $returns")
+            }
+        }
+        if (throws != null) {
+            var problem: String? = "expected an error, got $outcomes"
+            for (got in outcomes) {
+                val error = got.exceptionOrNull() ?: continue
+                problem = matches(error, throws)
+                if (problem == null) break
+            }
+            if (problem != null) problems.add("$where: $problem")
+        }
+    }
+
+    /** The error name of a §5.6 report `line` about `event` naming `row`, or null (events.rs `reports`). */
+    private fun reports(line: String, event: String, filter: Boolean, row: String): String? {
+        val (kind, at) = if (filter) "filter" to "from" else "listener" to "in"
+        val prefix = "rutis: $kind of $event $at row $row failed: "
+        if (!line.startsWith(prefix)) return null
+        val rest = line.removePrefix(prefix)
+        val colon = rest.indexOf(": ")
+        return if (colon < 0) null else rest.substring(0, colon)
+    }
+
+    private fun strings(e: JsonObject, key: String): List<String>? = (e[key] as? JsonArray)?.map { it.jsonPrimitive.content }
+
+    /** What of a step's log expectations does not hold now, or null (events.rs `log_holds`). */
+    fun logProblems(e: JsonObject, event: String): String? {
+        val log = this.log.list()
+        val out = ArrayList<String>()
+        strings(e, "log")?.let { if (log != it) out.add("log $log, want $it") }
+        strings(e, "logUnordered")?.let { if (log.sorted() != it.sorted()) out.add("log $log, want in any order $it") }
+        strings(e, "logContains")?.let { want ->
+            var i = 0
+            for (entry in log) if (i < want.size && entry == want[i]) i++
+            if (i != want.size) out.add("log $log, want it to contain $want")
+        }
+        strings(e, "logLacks")?.forEach { if (it in log) out.add("log $log has $it") }
+        strings(e, "filterSees")?.let { want ->
+            val seen = log.filter { it.startsWith("filter:") }.map { it.removePrefix("filter:") }
+            if (seen != want) out.add("the filter saw $seen, want $want")
+        }
+        val lines = root.reported().drop(reported)
+        for (want in (e["reported"] as? JsonArray)?.map { it.jsonObject } ?: emptyList()) {
+            val label = want["label"]!!.jsonPrimitive.content
+            val name = want["name"]!!.jsonPrimitive.content
+            val filter = (want["filter"] as? JsonPrimitive)?.booleanOrNull ?: false
+            val about = lines.filter { reports(it, event, filter, label) != null }
+            when {
+                about.size != 1 -> out.add("reported $lines: want one line for $label about $event, got ${about.size}")
+                reports(about[0], event, filter, label) != name -> out.add("reported ${about[0]}: $label should fail with $name")
+            }
+        }
+        return if (out.isEmpty()) null else out.joinToString("; ")
+    }
+
+    /** Checks a step's log expectations until they hold; with `logLacks` or `reported`, once more a moment later. */
+    fun checkLog(where: String, e: JsonObject, event: String) {
+        val deadline = System.currentTimeMillis() + SETTLE
+        while (true) {
+            val problem = logProblems(e, event) ?: break
+            if (System.currentTimeMillis() > deadline) {
+                problems.add("$where: $problem")
+                return
+            }
+            Thread.sleep(10)
+        }
+        if (e["logLacks"] != null || e["reported"] != null) {
+            Thread.sleep(LACKS)
+            logProblems(e, event)?.let { problems.add("$where: $it (after the step had settled)") }
+        }
+    }
+
+    fun waitFor(label: String) {
+        val deadline = System.currentTimeMillis() + SETTLE
+        while (label !in log.list()) {
+            if (System.currentTimeMillis() > deadline) fail("$label did not start: ${log.list()}")
+            Thread.sleep(5)
+        }
+    }
+
+    fun step(i: Int, step: JsonObject) {
+        val where = "${c.case} step $i"
+        val e = step["expect"] as? JsonObject ?: JsonObject(emptyMap())
+        if ((e["viaHost"] as? JsonPrimitive)?.booleanOrNull == true) problems.add("$where: the testing tool always dispatches on the fast path")
+        val emit = step["emit"] as? JsonObject
+        val event = (emit?.get("name") as? JsonPrimitive)?.content ?: c.name
+        val outcomes = ArrayList<Result<Any?>>()
+        val started = System.currentTimeMillis()
+        when {
+            emit != null && (step["background"] as? JsonPrimitive)?.booleanOrNull == true -> {
+                pending = CompletableFuture.supplyAsync { emit(emit) }
+                checkLog(where, e, event)
+                return
+            }
+            emit != null -> outcomes.add(emit(emit))
+            step["load"] != null -> load(step["load"]!!.jsonObject)
+            step["update"] != null -> update(step["update"]!!.jsonPrimitive.content)
+            step["unload"] != null -> {
+                (step["when"] as? JsonPrimitive)?.content?.let(::waitFor)
+                rows[step["unload"]!!.jsonPrimitive.content]!!.unload()
+                pending?.let {
+                    pending = null
+                    try {
+                        outcomes.add(it.get(SETTLE, TimeUnit.MILLISECONDS))
+                    } catch (_: Exception) {
+                        problems.add("$where: the background dispatch did not settle within ${SETTLE}ms")
+                    }
+                }
+                if ((e["settles"] as? JsonPrimitive)?.booleanOrNull == true && System.currentTimeMillis() - started >= SETTLE) {
+                    problems.add("$where: did not settle within ${SETTLE}ms")
+                }
+            }
+            else -> fail("$where: a step the testing tool cannot take: $step")
+        }
+        checkOutcomes(where, e, outcomes)
+        checkLog(where, e, event)
+    }
+}
+
+/**
+ * The testing tool against the event expectations (#464 §13): the real
+ * runtimes and the testing tools are checked against the same list.
+ */
+class EventsConformanceTest {
+    @Test
+    fun theTestingToolMeetsTheEventExpectations() {
+        val expected = expectations("events.expected.json")
+        val groups = expected["scopes"]!!.jsonObject.mapValues { it.value.jsonPrimitive.content }
+        val toolCases = expected["toolCases"]!!.jsonObject[LANGUAGE]?.jsonPrimitive?.content?.toInt()
+        var ran = 0
+        val failures = ArrayList<String>()
+        for (raw in expected["cases"]!!.jsonArray) {
+            val c = Case(raw.jsonObject)
+            if (c.forKotlin() != null) continue
+            ran++
+            val log = EventLog()
+            val problems = ArrayList<String>()
+            val run = Run(c, groups, log, problems)
+            try {
+                RutisTest.load(conformanceEvents, mapOf("label" to "e", "emitter" to true), mapOf("events-log" to log), row = "e").use { root ->
+                    run.root = root
+                    run.rows["e"] = root
+                    run.reported = root.reported().size
+                    c.listeners.forEach(run::load)
+                    c.steps.forEachIndexed(run::step)
+                }
+            } catch (e: Throwable) {
+                problems.add("${c.case}: $e")
+            }
+            if (problems.isNotEmpty()) failures.add(problems.joinToString("\n"))
+        }
+        if (failures.isNotEmpty()) fail("${failures.size} cases failed:\n" + failures.joinToString("\n"))
+        // The skip logic agrees with events.rs `tool_combo`.
+        assertEquals(toolCases, ran, "the cases the file gives $LANGUAGE")
+    }
+}
diff --git a/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/WeatherConformanceTest.kt b/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/WeatherConformanceTest.kt
new file mode 100644
index 000000000..1caca2578
--- /dev/null
+++ b/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/WeatherConformanceTest.kt
@@ -0,0 +1,116 @@
+package arcships.rutis.conformance
+
+import arcships.rutis.RutisException
+import arcships.rutis.RutisService
+import arcships.rutis.conformance.plugins.weather
+import arcships.rutis.testing.RutisTest
+import arcships.rutis.testing.TestService
+import kotlinx.coroutines.runBlocking
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.jsonArray
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
+import java.util.concurrent.atomic.AtomicLong
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue
+import kotlin.test.fail
+
+@RutisService
+class TestClock {
+    private val n = AtomicLong()
+
+    fun now(): Long = n.getAndIncrement()
+}
+
+/**
+ * The testing tool against the expectations the real runtimes are checked
+ * against (rutis_bridge::runtime::testing::runtime, weather.expected.json):
+ * the same list (#206, design K16).
+ */
+class WeatherConformanceTest {
+    private val problems = ArrayList<String>()
+
+    private fun check(what: String, entry: JsonObject, outcome: Result<Any?>) {
+        val why = (entry["why"] as? JsonPrimitive)?.content ?: ""
+        val returns = entry["returns"]
+        val throws = entry["throws"] as? JsonObject
+        when {
+            returns != null -> {
+                val value = outcome.getOrElse {
+                    problems.add("$what ($why): expected $returns, got $it")
+                    return
+                }
+                var got = written(value)
+                val ignore = (entry["ignore"] as? JsonArray)?.map { it.jsonPrimitive.content } ?: emptyList()
+                if (got is JsonObject) got = JsonObject(got.filterKeys { it !in ignore })
+                if (got != normalized(returns)) problems.add("$what ($why): got $got, want $returns")
+            }
+            throws != null -> {
+                val error = outcome.exceptionOrNull() ?: run {
+                    problems.add("$what ($why): expected an error, got ${outcome.getOrNull()}")
+                    return
+                }
+                val name = (throws["name"] as? JsonPrimitive)?.content
+                val message = (throws["message"] as? JsonPrimitive)?.content
+                if (name == null && message == null) return
+                if (error !is RutisException) {
+                    problems.add("$what ($why): expected an error from the plugin, got $error")
+                    return
+                }
+                if (name != null && error.name != name) problems.add("$what ($why): the error's name ${error.name}, want $name")
+                if (message != null && error.message != message) problems.add("$what ($why): the error's message ${error.message}, want $message")
+            }
+            else -> fail("$what: the expectations say neither returns nor throws")
+        }
+    }
+
+    private suspend fun call(service: TestService, method: String, args: List<JsonElement>): Result<Any?> =
+        runCatching { service.raw(method, args.map(::argument)) }
+
+    @Test
+    fun theTestingToolMeetsTheRuntimeExpectations() = runBlocking<Unit> {
+        val expected = expectations("weather.expected.json")
+        RutisTest.load(weather, services = mapOf("clock" to TestClock())).use { loaded ->
+            val service = loaded.service(expected["service"]!!.jsonPrimitive.content)
+            for ((method, kind) in expected["methods"]!!.jsonObject) {
+                assertEquals(kind.jsonPrimitive.content, service.methods[method], "${service.name}.$method")
+            }
+            for ((i, entry) in expected["calls"]!!.jsonArray.withIndex()) {
+                entry as JsonObject
+                if (entry["allowed"] != null) continue
+                val method = entry["call"]!!.jsonPrimitive.content
+                check("calls[$i] $method", entry, call(service, method, entry["args"]!!.jsonArray))
+            }
+            // Values only Kotlin makes.
+            @Suppress("UNCHECKED_CAST")
+            val names = service.call("samples") as List<String>
+            assertTrue(names.isNotEmpty(), "the Kotlin plugin names its samples")
+            for (name in names) {
+                val entry = expected["samples"]!!.jsonArray.map { it.jsonObject }.firstOrNull { it["sample"]?.jsonPrimitive?.content == name }
+                    ?: fail("the expectations list no sample $name")
+                check("sample $name", entry, call(service, "sample", listOf(JsonPrimitive(name))))
+            }
+            for (event in expected["events"]!!.jsonArray.map { it.jsonObject }) {
+                val then = event["then"] as? JsonObject ?: continue
+                // As a host plugin emits: parallel waits for the listeners.
+                loaded.parallel(event["emit"]!!.jsonPrimitive.content, *event["args"]!!.jsonArray.map { arcships.rutis.internal.Native.toNative(argument(it)) }.toTypedArray())
+                val entry = JsonObject(then + ("why" to (event["why"] ?: JsonPrimitive(""))))
+                check("after ${event["emit"]}", entry, call(service, then["call"]!!.jsonPrimitive.content, then["args"]!!.jsonArray))
+            }
+            // A service the plugin does not declare: its methods inferred, all async.
+            val undeclared = expected["undeclared"]!!.jsonObject
+            val forecast = loaded.service(undeclared["service"]!!.jsonPrimitive.content)
+            assertEquals(undeclared["methods"]!!.jsonObject.mapValues { it.value.jsonPrimitive.content }, forecast.methods, "the undeclared service's methods")
+            for ((i, entry) in undeclared["calls"]!!.jsonArray.withIndex()) {
+                entry as JsonObject
+                val method = entry["call"]!!.jsonPrimitive.content
+                check("undeclared.calls[$i] $method", entry, call(forecast, method, entry["args"]!!.jsonArray))
+            }
+        }
+        if (problems.isNotEmpty()) fail(problems.joinToString("\n"))
+    }
+}
diff --git a/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/Written.kt b/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/Written.kt
new file mode 100644
index 000000000..b6bb8fcb4
--- /dev/null
+++ b/kotlin/rutis/rutis-conformance/src/test/kotlin/arcships/rutis/conformance/Written.kt
@@ -0,0 +1,112 @@
+package arcships.rutis.conformance
+
+import arcships.rutis.RutisException
+import arcships.rutis.internal.Native
+import arcships.rutis.internal.peer.Decimal
+import arcships.rutis.internal.peer.Undefined
+import arcships.rutis.internal.peer.WireMap
+import arcships.rutis.internal.peer.WireSet
+import arcships.rutis.internal.peer.formatBigInt
+import arcships.rutis.internal.peer.formatBytes
+import arcships.rutis.internal.peer.formatDate
+import arcships.rutis.internal.peer.formatDateTime
+import arcships.rutis.internal.peer.formatInstant
+import arcships.rutis.internal.peer.formatTime
+import arcships.rutis.internal.peer.parseTagged
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.jsonArray
+import kotlinx.serialization.json.jsonPrimitive
+import java.io.File
+import java.math.BigInteger
+import java.time.Instant
+import java.time.LocalDate
+import java.time.LocalDateTime
+import java.time.LocalTime
+import java.util.UUID
+
+/** An expectation file of crates/rutis-bridge/src/runtime/testing. */
+fun expectations(name: String): JsonObject {
+    val repo = System.getProperty("rutis.repo") ?: "../.."
+    return Json.parseToJsonElement(File(repo, "crates/rutis-bridge/src/runtime/testing/$name").readText()) as JsonObject
+}
+
+/** A session value as the expectations write it: data as JSON, a tagged value as {"$<tag>": <its wire text>}. */
+fun written(value: Any?): JsonElement {
+    fun tagged(tag: String, inner: JsonElement) = JsonObject(mapOf("$$tag" to inner))
+    return when (value) {
+        null, Undefined -> JsonNull
+        is JsonElement -> normalized(value)
+        is List<*> -> JsonArray(value.map(::written))
+        is Map<*, *> -> JsonObject(value.entries.associate { (k, v) -> k as String to written(v) })
+        is WireMap -> tagged("map", JsonArray(value.entries.map { (k, v) -> JsonArray(listOf(written(k), written(v))) }))
+        is WireSet -> tagged("set", JsonArray(value.elements.map(::written)))
+        is Instant -> tagged("instant", JsonPrimitive(formatInstant(value)))
+        is LocalDateTime -> tagged("datetime", JsonPrimitive(formatDateTime(value)))
+        is LocalDate -> tagged("date", JsonPrimitive(formatDate(value)))
+        is LocalTime -> tagged("time", JsonPrimitive(formatTime(value)))
+        is ByteArray -> tagged("bytes", JsonPrimitive(formatBytes(value)))
+        is BigInteger -> tagged("bigint", JsonPrimitive(formatBigInt(value)))
+        is Decimal -> tagged("decimal", JsonPrimitive(value.text))
+        is UUID -> tagged("uuid", JsonPrimitive(value.toString()))
+        is String -> JsonPrimitive(value)
+        is Boolean -> JsonPrimitive(value)
+        is Long -> JsonPrimitive(value)
+        is Double -> normalized(JsonPrimitive(value))
+        else -> throw AssertionError("not data: $value (${value.javaClass})")
+    }
+}
+
+/** JSON numbers compared by value: `1.0` is `1`. */
+fun normalized(value: JsonElement): JsonElement = when (value) {
+    is JsonArray -> JsonArray(value.map(::normalized))
+    is JsonObject -> JsonObject(value.mapValues { normalized(it.value) })
+    is JsonPrimitive -> if (!value.isString && value != JsonNull && value.content != "true" && value.content != "false") {
+        val number = value.content.toBigDecimal()
+        val whole = try {
+            number.toBigIntegerExact()
+        } catch (_: ArithmeticException) {
+            null
+        }
+        if (whole != null) JsonPrimitive(whole) else JsonPrimitive(number.toDouble())
+    } else {
+        value
+    }
+}
+
+/** An argument as the expectations write it: data, or a callback ({"$callback": ...}). */
+fun argument(raw: JsonElement): Any? {
+    val callback = (raw as? JsonObject)?.get("\$callback") ?: return raw
+    if (callback is JsonPrimitive && callback.content == "upper") {
+        return Native.fromNative({ day: Any? -> (day as String).uppercase() })
+    }
+    val thrown = (callback as JsonObject)["throws"] as JsonObject
+    return Native.fromNative({ _: Any? ->
+        throw RutisException(thrown["name"]!!.jsonPrimitive.content, thrown["message"]!!.jsonPrimitive.content)
+    })
+}
+
+/**
+ * A value as the expectations write it, as the session carries it: tagged
+ * values from {"$<tag>": …}, a callback from {"$callback": "upper"}, lists
+ * of them as lists, other data as it is.
+ */
+fun fromWritten(raw: JsonElement): Any? {
+    if (raw is JsonObject && raw.size == 1) {
+        val (key, inner) = raw.entries.first()
+        if (key.startsWith("$")) {
+            return when (val tag = key.substring(1)) {
+                "callback" -> Native.fromNative({ text: Any? -> (text as String).uppercase() })
+                "map" -> WireMap(inner.jsonArray.map { pair -> fromWritten(pair.jsonArray[0]) to fromWritten(pair.jsonArray[1]) })
+                "set" -> WireSet(inner.jsonArray.map(::fromWritten))
+                else -> parseTagged(tag, inner.jsonPrimitive.content)
+            }
+        }
+    }
+    if (raw is JsonArray) return raw.map(::fromWritten)
+    return raw
+}
diff --git a/kotlin/rutis/rutis/src/jvmMain/kotlin/arcships/rutis/Serve.kt b/kotlin/rutis/rutis/src/jvmMain/kotlin/arcships/rutis/Serve.kt
new file mode 100644
index 000000000..681cbc3e5
--- /dev/null
+++ b/kotlin/rutis/rutis/src/jvmMain/kotlin/arcships/rutis/Serve.kt
@@ -0,0 +1,95 @@
+package arcships.rutis
+
+import arcships.rutis.internal.RuntimeSession
+import arcships.rutis.internal.peer.LocalChannels
+import arcships.rutis.internal.refusedLine
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import kotlin.system.exitProcess
+
+private const val USAGE = "usage: <program> --rutis-manifest | <channel> [--id <endpoint>] [--peer <endpoint>] <project>"
+
+@Volatile
+private var projectDir: String = ""
+
+/** The project directory the host gave this runtime (its last argument). */
+val Rutis.project: String get() = projectDir
+
+/**
+ * The desktop test entry (jvm target): runs `plugins` as a rutis runtime as
+ * the command line says, and exits the process. `<channel> <project>`: the
+ * channel is `unix:<path>` (or a bare path) or `tcp:127.0.0.1:<port>`;
+ * `--rutis-manifest` prints what the plugins declare. Exit status 0 when the
+ * session ended and the rows unloaded; 1 when the host was refused (it does
+ * not declare events-v2) or cleanups did not finish within
+ * `RUTIS_SHUTDOWN_TIMEOUT`.
+ */
+fun Rutis.serve(args: Array<String>, vararg plugins: Plugin): Nothing {
+    val status = try {
+        serveArgs(args.toList(), plugins.toList())
+    } catch (e: Exception) {
+        System.err.println("rutis: ${e.message}")
+        1
+    }
+    System.out.flush()
+    System.err.flush()
+    exitProcess(status)
+}
+
+/** What the plugins declare, as `--rutis-manifest` prints it. */
+fun Rutis.manifest(vararg plugins: Plugin): String {
+    RuntimeSession.checkPlugins(plugins.toList())
+    val state = arcships.rutis.internal.RuntimeState(plugins.toList())
+    val manifest = buildJsonObject {
+        put("manifest", 1)
+        put("sdk", VERSION)
+        put("pluginApi", PLUGIN_API)
+        put("runtime", "rutis-kotlin-runtime:1")
+        put("platform", "jvm")
+        put("plugins", JsonObject(plugins.associate { it.name to jsonOf(state.describe(it)) }))
+    }
+    return Json.encodeToString(JsonElement.serializer(), manifest)
+}
+
+private fun jsonOf(value: Any?): JsonElement = arcships.rutis.internal.peer.plain(value)
+
+/** Serves the session `args` name; returns the exit status. */
+private fun serveArgs(args: List<String>, plugins: List<Plugin>): Int {
+    RuntimeSession.checkPlugins(plugins)
+    if (args.size == 1 && args[0] == "--rutis-manifest") {
+        println(Rutis.manifest(*plugins.toTypedArray()))
+        return 0
+    }
+    if (args.isEmpty()) throw IllegalArgumentException(USAGE)
+    val channel = args[0]
+    var rest = args.drop(1)
+    val flags = HashMap<String, String>()
+    while (rest.isNotEmpty() && rest[0].startsWith("--")) {
+        val flag = rest[0].removePrefix("--")
+        if (rest.size < 2) throw IllegalArgumentException("--$flag needs a value")
+        if (flag != "id" && flag != "peer") throw IllegalArgumentException("unknown flag --$flag; $USAGE")
+        flags[flag] = rest[1]
+        rest = rest.drop(2)
+    }
+    if (rest.size != 1) throw IllegalArgumentException(USAGE)
+    projectDir = rest[0]
+    if (channel.startsWith("listen:") || channel.startsWith("dial:") || channel.startsWith("ws:") || channel.startsWith("wss:")) {
+        throw IllegalArgumentException("network channels come with the Kotlin SDK's next phase (K-P2): $channel")
+    }
+    val session = RuntimeSession.start(LocalChannels.open(channel), null, plugins)
+    session.peer.closedFuture.join()
+    val ended = session.end()
+    session.refusal?.let {
+        System.err.println("rutis: " + refusedLine(it))
+        return 1
+    }
+    if (!ended) {
+        System.err.println("rutis: cleanups did not finish within the shutdown deadline after the session ended")
+        return 1
+    }
+    return 0
+}
+
diff --git a/kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/GeneratedTest.kt b/kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/GeneratedTest.kt
index 255397192..d3941bb8f 100644
--- a/kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/GeneratedTest.kt
+++ b/kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/GeneratedTest.kt
@@ -64,6 +64,8 @@ class GeneratedTest {
     @Test
     fun theTableListsPublicMemberFunctions() {
         assertEquals(setOf("inherited", "area", "later", "each", "echo", "adder", "touch"), table.methods.toSet())
+        assertEquals(mapOf("area" to "sync", "later" to "async"), service<Shapes>(sync = setOf("area")).kinds.filterKeys { it in setOf("area", "later") })
+        assertFailsWith<IllegalArgumentException> { Rutis.define<Rutis.NoConfig>("p", provides = mapOf("s" to service<Shapes>(sync = setOf("nope")))) { _, _ -> } }
     }
 
     @Test
diff --git a/kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/RuntimeTest.kt b/kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/RuntimeTest.kt
new file mode 100644
index 000000000..a9a4f266f
--- /dev/null
+++ b/kotlin/rutis/rutis/src/jvmTest/kotlin/arcships/rutis/RuntimeTest.kt
@@ -0,0 +1,143 @@
+package arcships.rutis
+
+import arcships.rutis.internal.Schema
+import arcships.rutis.testing.RutisTest
+import kotlinx.coroutines.runBlocking
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+import java.util.Collections
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertFailsWith
+import kotlin.test.assertTrue
+
+@Serializable
+data class Settings(
+    val city: String,
+    val days: Int = 3,
+    val units: Units = Units.Metric,
+    val alerts: List<String> = emptyList(),
+    val home: Place? = null,
+)
+
+@Serializable
+enum class Units { Metric, Imperial }
+
+@Serializable
+data class Place(val lat: Double, val lon: Double)
+
+@RutisClient
+interface Greeter {
+    fun greet(name: String): String
+
+    suspend fun greetLater(name: String): String
+}
+
+@RutisService
+class Hello(private val prefix: String) : Greeter {
+    override fun greet(name: String): String = "$prefix $name"
+
+    override suspend fun greetLater(name: String): String = "$prefix $name, later"
+}
+
+/** A test service the plugin injects. */
+@RutisService
+class Journal {
+    val lines: MutableList<String> = Collections.synchronizedList(ArrayList())
+
+    fun record(line: String) {
+        lines.add(line)
+    }
+}
+
+@RutisClient
+interface JournalClient {
+    fun record(line: String)
+}
+
+/** The plugin API (design §3) through the testing tool: a real session, the test as host. */
+class RuntimeTest {
+    @Test
+    fun theSchemaIsDerivedFromTheConfigType() {
+        val schema = Json.parseToJsonElement(Schema.of(Settings.serializer().descriptor).toString())
+        val expected = Json.parseToJsonElement(
+            """{"type":"object","properties":{"city":{"type":"string"},"days":{"type":"integer"},
+            "units":{"type":"string","enum":["Metric","Imperial"]},"alerts":{"type":"array","items":{"type":"string"}},
+            "home":{"type":["object","null"],"properties":{"lat":{"type":"number"},"lon":{"type":"number"}},"required":["lat","lon"]}},
+            "required":["city"]}""",
+        )
+        assertEquals(expected, schema)
+    }
+
+    @Test
+    fun aPluginProvidesUsesAndCleansUp() = runBlocking<Unit> {
+        val journal = Journal()
+        val plugin = Rutis.define<Settings>(
+            name = "hello",
+            inject = listOf("journal"),
+            provides = mapOf("hello" to service<Hello>(sync = setOf("greet"))),
+        ) { ctx, config ->
+            val log = ctx.use<JournalClient>("journal")
+            val hello = Hello("hi from ${config.city}")
+            ctx.provide("hello", hello)
+            ctx.provide("extra", Hello("extra"))
+            assertFailsWith<IllegalArgumentException> { ctx.use<Greeter>("undeclared") }
+            ctx.effect { log.record("first cleanup") }
+            ctx.effect { log.record("second cleanup") }
+            log.record("applied ${config.days}")
+        }
+        RutisTest.load(plugin, Settings("Oslo"), services = mapOf("journal" to journal)).use { loaded ->
+            val hello = loaded.service("hello")
+            assertEquals(mapOf("greet" to "sync", "greetLater" to "async"), hello.methods)
+            assertEquals("hi from Oslo Kim", hello.call("greet", "Kim"))
+            assertEquals("hi from Oslo Kim, later", hello.bind<Greeter>().greetLater("Kim"))
+            // Not declared: announced, every method async.
+            assertEquals(mapOf("greet" to "async", "greetLater" to "async"), loaded.service("extra").methods)
+        }
+        assertEquals(listOf("applied 3", "second cleanup", "first cleanup"), journal.lines)
+    }
+
+    @Test
+    fun listenersHearEmissionsInEveryMode() = runBlocking<Unit> {
+        val plugin = Rutis.define<Rutis.NoConfig>(name = "events") { ctx, _ ->
+            ctx.on("t/greet") { args -> "${args[0]}!" }
+            ctx.on("t/format") { args -> "<" + (args.next!!() ?: args[0]) + ">" }
+            ctx.on("t/check", prepend = true) { args -> if (args[0] == 42L) "yes" else null }
+            ctx.on("t/check") { _ -> "fallback" }
+            ctx.on("t/ask") { _ -> ctx.serial("t/greet", "inner") }
+            assertFailsWith<RutisException> { ctx.emit("rutis/row", 1) }.also { assertEquals(RutisException.RESERVED_EVENT, it.name) }
+        }
+        RutisTest.load(plugin).use { loaded ->
+            assertEquals("hi!", loaded.serial("t/greet", "hi"))
+            assertEquals("<HI>", loaded.waterfall("t/format", "hi", terminal = { args -> (args[0] as String).uppercase() }))
+            // No terminal: `next` has no result.
+            assertEquals("<hi>", loaded.waterfall("t/format", "hi"))
+            assertEquals("yes", loaded.bail("t/check", 42))
+            assertEquals("fallback", loaded.bail("t/check", 1))
+            assertEquals("inner!", loaded.serial("t/ask"))
+            val seen = Collections.synchronizedList(ArrayList<String>())
+            val off = loaded.on("t/greet") { args -> seen.add(args[0] as String); null }
+            loaded.parallel("t/greet", "all")
+            assertEquals(listOf("all"), seen)
+            off()
+            // A filter that keeps none: no listener runs.
+            assertEquals(null, loaded.filter { false }.serial("t/greet", "x"))
+            assertTrue(loaded.reported().isEmpty(), "${loaded.reported()}")
+        }
+    }
+
+    @Test
+    fun failuresOfParallelAggregateInRegistrationOrder() = runBlocking<Unit> {
+        val plugin = Rutis.define<Rutis.NoConfig>(name = "failing") { ctx, _ ->
+            ctx.on("t/fail") { _ -> throw IllegalStateException("one") }
+            ctx.on("t/fail") { _ -> throw RutisException("Custom", "two", code = "E2") }
+        }
+        RutisTest.load(plugin).use { loaded ->
+            val error = assertFailsWith<RutisException> { loaded.parallel("t/fail") }
+            assertEquals(RutisException.AGGREGATE_ERROR, error.name)
+            assertEquals("2 listeners of t/fail failed", error.message)
+            assertEquals(listOf("IllegalStateException", "Custom"), error.errors.map { (it as RutisException).name })
+            assertEquals("E2", (error.errors[1] as RutisException).code)
+        }
+    }
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Ctx.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Ctx.kt
new file mode 100644
index 000000000..4b65a06b1
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Ctx.kt
@@ -0,0 +1,147 @@
+package arcships.rutis
+
+import arcships.rutis.internal.EventsRuntime
+import arcships.rutis.internal.Mode
+import arcships.rutis.internal.Row
+import arcships.rutis.internal.RuntimeState
+import arcships.rutis.internal.peer.CallChain
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.runBlocking
+import kotlin.coroutines.CoroutineContext
+
+/**
+ * What `apply` receives: the row's services, events and lifetime. It is the
+ * row's coroutine scope, cancelled when the row unloads (`isActive`,
+ * `ensureActive()`); coroutines started in it ([launch]) keep the call
+ * chain and are waited for when the row unloads.
+ */
+class Ctx internal constructor(private val rt: RuntimeState, internal val row: Row) : CoroutineScope, Emitter {
+    override val coroutineContext: CoroutineContext = row.job + Dispatchers.Default + CallChain.element(row.chain)
+
+    /** This row's scope chain, outermost first; empty at the root. */
+    val scope: List<Scope> get() = row.scope.toList()
+
+    /** The service `name` (which `inject` lists) through the `@RutisClient` interface `I`. */
+    inline fun <reified I : Any> use(name: String): I = use(name, I::class.java)
+
+    /**
+     * The service `name` through the `@RutisClient` interface `type`. A
+     * provider in this process whose object implements `type` gives the
+     * object itself; any other gives a proxy (calls cross as values do, by the
+     * service's own id of this row). Every method of `type` must be one the
+     * service has.
+     */
+    fun <I : Any> use(name: String, type: Class<I>): I {
+        if (name !in row.plugin.inject) throw IllegalArgumentException("the plugin uses $name without declaring it in inject")
+        val factory = Tables.clientFactory(type)
+            ?: throw IllegalArgumentException("${type.name} has no proxy: annotate it @RutisClient and apply the rutis-ksp processor")
+        val id = row.id(name)
+        val (local, host) = synchronized(rt.lock) { rt.services[id] to rt.hosts[id] }
+        val handle: ServiceHandle = when {
+            local != null -> {
+                if (type.isInstance(local.value)) return type.cast(local.value)
+                LocalHandle(name, local.value, local.table, local.shape?.kinds ?: local.table.methods.associateWith { "async" })
+            }
+            host != null -> HostHandle(rt, name, "host:$id", host)
+            else -> throw IllegalStateException("service $name is not available")
+        }
+        val missing = factory.methods.filter { it !in handle.kinds }
+        if (missing.isNotEmpty()) throw IllegalArgumentException("use $name: ${type.simpleName} calls ${missing.joinToString()}, which the service does not have")
+        return factory.create(handle)
+    }
+
+    /**
+     * Provides `service`, an instance of a `@RutisService` class, as `name`
+     * until the row unloads or the returned function is called. A service
+     * `provides` does not declare reaches rutis by itself, its methods all
+     * `async`.
+     */
+    fun provide(name: String, service: Any): () -> Unit = rt.provide(row, name, service)
+
+    /** Registers a cleanup, run when the row unloads (latest first). */
+    fun effect(cleanup: suspend () -> Unit) {
+        row.cleanups.add(cleanup)
+    }
+
+    /**
+     * Listens to the event `name` on the bus until the row unloads or the
+     * returned function is called. The listener gets the event's arguments,
+     * and in a waterfall `next` last ([EventArgs.next]); its result counts in
+     * serial, bail and waterfall (null and false are no result). [prepend]
+     * puts it before the listeners registered so far; [global] exempts it from
+     * emitters' filters. `rutis/` events can be listened to.
+     */
+    fun on(name: String, prepend: Boolean = false, global: Boolean = false, listener: suspend (EventArgs) -> Any?): () -> Unit =
+        EventsRuntime.on(rt, row, name, prepend, global, listener)
+
+    /** An emitter whose dispatches reach only the listeners `keep` accepts (global listeners always). */
+    fun filter(keep: suspend (Listener) -> Boolean): Emitter = Filtered(keep)
+
+    override fun emit(name: String, vararg args: Any?) {
+        dispatchNow(name, Mode.Emit, args.toList(), null)
+    }
+
+    override suspend fun parallel(name: String, vararg args: Any?) {
+        EventsRuntime.dispatch(rt, row, name, Mode.Parallel, args.toList(), null, null)
+    }
+
+    override suspend fun serial(name: String, vararg args: Any?): Any? =
+        EventsRuntime.dispatch(rt, row, name, Mode.Serial, args.toList(), null, null)
+
+    override suspend fun waterfall(name: String, vararg args: Any?, terminal: (suspend (EventArgs) -> Any?)?): Any? =
+        EventsRuntime.dispatch(rt, row, name, Mode.Waterfall, args.toList(), terminal, null)
+
+    override fun bail(name: String, vararg args: Any?): Any? = dispatchNow(name, Mode.Bail, args.toList(), null)
+
+    /** A dispatch that does not suspend (emit, bail): on this thread, with its chain. */
+    private fun dispatchNow(name: String, mode: Mode, args: List<Any?>, keep: (suspend (Listener) -> Boolean)?): Any? =
+        runBlocking(CallChain.element()) { EventsRuntime.dispatch(rt, row, name, mode, args, null, keep) }
+
+    private inner class Filtered(private val keep: suspend (Listener) -> Boolean) : Emitter {
+        override fun emit(name: String, vararg args: Any?) {
+            dispatchNow(name, Mode.Emit, args.toList(), keep)
+        }
+
+        override suspend fun parallel(name: String, vararg args: Any?) {
+            EventsRuntime.dispatch(rt, row, name, Mode.Parallel, args.toList(), null, keep)
+        }
+
+        override suspend fun serial(name: String, vararg args: Any?): Any? =
+            EventsRuntime.dispatch(rt, row, name, Mode.Serial, args.toList(), null, keep)
+
+        override suspend fun waterfall(name: String, vararg args: Any?, terminal: (suspend (EventArgs) -> Any?)?): Any? =
+            EventsRuntime.dispatch(rt, row, name, Mode.Waterfall, args.toList(), terminal, keep)
+
+        override fun bail(name: String, vararg args: Any?): Any? = dispatchNow(name, Mode.Bail, args.toList(), keep)
+    }
+}
+
+/** A service provided in this process, used through its method table (values cross as copies). */
+internal class LocalHandle(
+    override val name: String,
+    private val target: Any,
+    private val table: ServiceTable<Any>,
+    override val kinds: Map<String, String>,
+) : ServiceHandle {
+    override suspend fun callSuspend(method: String, args: List<Any?>): Any? = table.invoke(target, method, args)
+
+    override fun callBlocking(method: String, args: List<Any?>): Any? =
+        runBlocking(CallChain.element()) { table.invoke(target, method, args) }
+}
+
+/** A rutis service, called through the session (`host:<id>`). */
+internal class HostHandle(
+    private val rt: RuntimeState,
+    override val name: String,
+    private val target: String,
+    override val kinds: Map<String, String>,
+) : ServiceHandle {
+    private fun session() = rt.session ?: throw IllegalStateException("the runtime has no session")
+
+    override suspend fun callSuspend(method: String, args: List<Any?>): Any? =
+        session().callSuspend(target, method, args, kinds[method] == "sync")
+
+    override fun callBlocking(method: String, args: List<Any?>): Any? =
+        session().call(target, method, args, kinds[method] == "sync")
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Events.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Events.kt
new file mode 100644
index 000000000..e245dba92
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Events.kt
@@ -0,0 +1,84 @@
+package arcships.rutis
+
+import arcships.rutis.internal.Native
+
+/**
+ * One loader instance (a group copy, such as a tenant or a session) of a
+ * scope chain, outermost first.
+ */
+data class Scope(val id: String, val group: String)
+
+/**
+ * What the bus says of a listener, as a filter predicate sees it; null for
+ * absent values: [row] for a listener of no row, [runtime] for one of the
+ * host, [node] for one of this node.
+ */
+data class Listener(
+    val name: String,
+    val prefix: Boolean = false,
+    val plugin: String,
+    val row: String? = null,
+    val runtime: String? = null,
+    val node: String? = null,
+    val scope: List<Scope> = emptyList(),
+    val global: Boolean = false,
+)
+
+/** The rest of a waterfall: a waterfall listener gets it last, and calls it at most once. */
+typealias Next = suspend () -> Any?
+
+/**
+ * A listener's arguments: the event's arguments as native values (`Any?`
+ * rules: integers as Long, objects as `Map<String, Any?>`, ...), and in a
+ * waterfall [next] as the last element.
+ */
+class EventArgs internal constructor(
+    private val values: List<Any?>,
+    /** The arguments as they crossed, for [decode]. */
+    private val raw: List<Any?>,
+    /** In a waterfall: the rest of it (also the last element). */
+    val next: Next?,
+) : List<Any?> by values {
+    /** Argument `i` decoded into `T` (a `@Serializable` type). */
+    inline fun <reified T> decode(i: Int): T = decode(i, RutisFormat.serializer<T>())
+
+    /** [decode] with the serializer given. */
+    fun <T> decode(i: Int, deserializer: kotlinx.serialization.DeserializationStrategy<T>): T =
+        RutisFormat.decode(deserializer, if (i < raw.size) raw[i] else null)
+
+    override fun toString(): String = values.toString()
+
+    internal companion object {
+        /** The arguments of session values `raw`, with `next` last in a waterfall. */
+        fun of(raw: List<Any?>, next: Next?): EventArgs {
+            val values = raw.map(Native::toNative).toMutableList<Any?>()
+            if (next != null) values.add(next)
+            return EventArgs(values, raw, next)
+        }
+    }
+}
+
+/**
+ * Emits events, filtered: [Ctx.filter] makes one. Its five methods are those
+ * of [Ctx].
+ */
+interface Emitter {
+    /** Starts every listener of `name` and returns at once; a listener's failure is reported where it is. */
+    fun emit(name: String, vararg args: Any?)
+
+    /** Starts every listener of `name` and waits for all; failures are an `AggregateError` in registration order. */
+    suspend fun parallel(name: String, vararg args: Any?)
+
+    /** Runs the listeners of `name` one at a time and returns the first result (anything but null and false). */
+    suspend fun serial(name: String, vararg args: Any?): Any?
+
+    /**
+     * Calls the outermost listener of `name`, which gets `next` last: `next`
+     * runs the rest, the innermost [terminal] (called with the arguments;
+     * none: no result). Returns the outermost listener's value as it is.
+     */
+    suspend fun waterfall(name: String, vararg args: Any?, terminal: (suspend (EventArgs) -> Any?)? = null): Any?
+
+    /** [serial] as a synchronous call, blocking this thread (a wait cycle fails with `SyncWaitCycle`). */
+    fun bail(name: String, vararg args: Any?): Any?
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Rutis.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Rutis.kt
new file mode 100644
index 000000000..13e1f537e
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/Rutis.kt
@@ -0,0 +1,131 @@
+package arcships.rutis
+
+import arcships.rutis.internal.Schema
+import kotlinx.serialization.KSerializer
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.JsonElement
+
+/**
+ * Writes rutis plugins in Kotlin (design: docs/design-android-runtime-2026-10-12.md).
+ *
+ * ```kotlin
+ * @Serializable data class Config(val city: String)
+ *
+ * @RutisClient interface Llm { suspend fun ask(question: String): String }
+ *
+ * @RutisService class Weather(private val llm: Llm, private val city: String) {
+ *     suspend fun today(question: String): String = llm.ask("weather in $city: $question")
+ * }
+ *
+ * val weather = Rutis.define<Config>(name = "weather", inject = listOf("llm")) { ctx, config ->
+ *     ctx.provide("weather", Weather(ctx.use<Llm>("llm"), config.city))
+ * }
+ * ```
+ *
+ * rutis decides when a plugin runs: `apply` runs once every injected service
+ * is there, and the plugin is unloaded when one goes away.
+ */
+object Rutis {
+    /** This SDK's version: the runtime's implementation version (the release train checks it). */
+    const val VERSION: String = "0.13.0"
+
+    /** The plugin API this SDK writes plugins against and its runtime supports. */
+    const val PLUGIN_API: Int = 3
+
+    /** The name the runtime reports itself by: the Maven coordinates it is published as. */
+    const val IMPLEMENTATION: String = "io.github.arcships:rutis"
+
+    /** The configuration of a plugin that takes none. */
+    @Serializable
+    object NoConfig
+
+    /**
+     * Defines a plugin whose configuration is `C`, a `@Serializable` type
+     * ([NoConfig] for none): its JSON Schema is derived from `C`'s
+     * descriptor unless [schema] gives one.
+     *
+     * [inject] lists the services it uses; [provides] optionally declares the
+     * services it provides and which of their methods are `sync` (undeclared
+     * services reach rutis by themselves, every method `async`). `apply`
+     * starts it; a failure fails the load, and the cleanups registered so far
+     * run.
+     */
+    inline fun <reified C> define(
+        name: String,
+        inject: List<String> = emptyList(),
+        provides: Map<String, ServiceShape> = emptyMap(),
+        schema: JsonElement? = null,
+        noinline apply: suspend (Ctx, C) -> Unit,
+    ): Plugin = define(name, RutisFormat.serializer<C>(), inject, provides, schema, apply)
+
+    /** [define] with the configuration's serializer given. */
+    fun <C> define(
+        name: String,
+        config: KSerializer<C>,
+        inject: List<String> = emptyList(),
+        provides: Map<String, ServiceShape> = emptyMap(),
+        schema: JsonElement? = null,
+        apply: suspend (Ctx, C) -> Unit,
+    ): Plugin {
+        require(name.isNotEmpty() && name.none { it == ':' || it == '/' || it == '\u0000' }) { "rutis: invalid plugin name \"$name\"" }
+        for ((service, shape) in provides) {
+            require(service.none { it == '#' || it == '\u0000' }) { "rutis: plugin $name: service name \"$service\" cannot be projected" }
+            shape.problem?.let { throw IllegalArgumentException("rutis: plugin $name: provides $service: $it") }
+        }
+        val derived = when {
+            schema != null -> schema
+            config.descriptor.serialName == NoConfig.serializer().descriptor.serialName -> null
+            else -> Schema.of(config.descriptor)
+        }
+        @Suppress("UNCHECKED_CAST")
+        return Plugin(name, inject.toList(), provides, derived, PLUGIN_API, config as KSerializer<Any?>, apply as suspend (Ctx, Any?) -> Unit)
+    }
+}
+
+/** A method's kind: a `sync` method is waited for, an `async` one awaited (default). */
+enum class Kind(val wire: String) {
+    Sync("sync"),
+    Async("async"),
+}
+
+/**
+ * The methods a provided service has on the wire, and the kind of each:
+ * [service] from a `@RutisService` class, or from the kinds themselves.
+ */
+class ServiceShape internal constructor(
+    /** The class whose instances provide it, when known. */
+    val type: Class<*>?,
+    /** Each method's kind on the wire. */
+    val kinds: Map<String, String>,
+    internal val problem: String? = null,
+)
+
+/**
+ * The shape of a service of the `@RutisService` class `T`: its methods,
+ * `async` but those in [sync].
+ */
+inline fun <reified T : Any> service(sync: Set<String> = emptySet()): ServiceShape = service(T::class.java, sync)
+
+/** [service] for the class `type`. */
+fun service(type: Class<*>, sync: Set<String> = emptySet()): ServiceShape {
+    val table = Tables.serviceTable(type)
+        ?: return ServiceShape(type, emptyMap(), "${type.name} has no method table: annotate it @RutisService and apply the rutis-ksp processor")
+    val unknown = sync.filter { it !in table.methods }
+    if (unknown.isNotEmpty()) return ServiceShape(type, emptyMap(), "sync $unknown: ${type.name} has no such methods")
+    if (table.methods.isEmpty()) return ServiceShape(type, emptyMap(), "${type.name} has no public methods")
+    return ServiceShape(type, table.methods.associateWith { if (it in sync) "sync" else "async" })
+}
+
+/** The shape of a service with these methods and kinds. */
+fun service(kinds: Map<String, Kind>): ServiceShape = ServiceShape(null, kinds.mapValues { it.value.wire })
+
+/** A defined plugin, for `Rutis.serve` and the testing tool. */
+class Plugin internal constructor(
+    val name: String,
+    val inject: List<String>,
+    val provides: Map<String, ServiceShape>,
+    internal val schema: JsonElement?,
+    internal val api: Int,
+    internal val config: KSerializer<Any?>,
+    internal val apply: suspend (Ctx, Any?) -> Unit,
+)
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Bus.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Bus.kt
new file mode 100644
index 000000000..95210d5bc
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Bus.kt
@@ -0,0 +1,252 @@
+package arcships.rutis.internal
+
+import arcships.rutis.Listener
+import arcships.rutis.Next
+import arcships.rutis.RutisException
+import arcships.rutis.Scope
+import arcships.rutis.internal.peer.Undefined
+import arcships.rutis.internal.peer.errorMessage
+import arcships.rutis.internal.peer.errorName
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.ensureActive
+import kotlinx.coroutines.isActive
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonPrimitive
+import java.util.concurrent.atomic.AtomicBoolean
+
+// The dispatch of the unified event model (#464,
+// docs/design-events-protocol-2026-10-18.md §5): the five modes over a
+// snapshot of entries, wherever each entry runs. The runtime dispatches its
+// fast path with it (every entry a listener of its own process); the testing
+// tool dispatches as a host with it.
+
+/** How a dispatch runs its listeners. */
+enum class Mode(val wire: String) {
+    Emit("emit"),
+    Parallel("parallel"),
+    Serial("serial"),
+    Waterfall("waterfall"),
+    Bail("bail"),
+    WaterfallSync("waterfall-sync"),
+    ;
+
+    /** Whether listeners get `next` in this mode. */
+    val waterfall: Boolean get() = this == Waterfall || this == WaterfallSync
+
+    companion object {
+        fun of(wire: String): Mode? = entries.firstOrNull { it.wire == wire }
+    }
+}
+
+/** Runs one reserved invocation of an entry: with the event's arguments (session values) and, in a waterfall, `next`. */
+typealias Call = suspend (mode: Mode, args: List<Any?>, next: Next?) -> Any?
+
+/** One listener of a dispatch's snapshot. */
+interface Entry {
+    fun info(): Listener
+
+    /** Reserves an invocation, unless the entry was withdrawn: then it is skipped. */
+    fun begin(): Call?
+
+    /**
+     * Starts an `emit` invocation after the earlier ones of this entry (§5.5),
+     * unless the entry was withdrawn. Its failure is reported by the entry.
+     */
+    fun emit(args: List<Any?>): Boolean
+}
+
+/** Refuses what no plugin may emit: `internal/` names, and `rutis/` names (ReservedEvent). */
+fun checkEmit(name: String) {
+    if (name.startsWith("internal/")) throw IllegalArgumentException("event $name is internal to the runtime")
+    if (name.startsWith("rutis/")) throw RutisException(RutisException.RESERVED_EVENT, "rutis/* events are emitted by rutis only: $name")
+}
+
+/** Refuses what no leaf plugin may listen to: `internal/` names. */
+fun checkListen(name: String) {
+    if (name.startsWith("internal/")) throw IllegalArgumentException("event $name is internal to the runtime")
+}
+
+/** Whether a listener in the scope `listener` hears what is emitted in `emitter`: its chain is a prefix. */
+fun within(listener: List<Scope>, emitter: List<Scope>): Boolean {
+    if (listener.size > emitter.size) return false
+    return listener.indices.all { listener[it].id == emitter[it].id }
+}
+
+/** Whether `v` is a result: not null, undefined or false (§1), native or a session value. */
+fun hasResult(v: Any?): Boolean = when (v) {
+    null, Undefined, JsonNull -> false
+    is Boolean -> v
+    is JsonPrimitive -> !(v.content == "false" && !v.isString)
+    else -> true
+}
+
+/** How long an unload waits for its row's running listeners, and cleanups may take once the session ended. */
+object Shutdown {
+    const val VARIABLE: String = "RUTIS_SHUTDOWN_TIMEOUT"
+    const val DEFAULT_MILLIS: Long = 10_000
+
+    /** The deadline `RUTIS_SHUTDOWN_TIMEOUT` sets (seconds), in milliseconds. */
+    fun millis(): Long {
+        val seconds = System.getenv(VARIABLE)?.trim()?.toDoubleOrNull() ?: return DEFAULT_MILLIS
+        if (!(seconds > 0) || seconds.isInfinite()) return DEFAULT_MILLIS
+        return (seconds * 1000).toLong()
+    }
+
+    /** The deadline in seconds as the lines show it: `10`, `0.5`. */
+    fun shown(millis: Long): String {
+        val seconds = millis / 1000.0
+        return if (seconds == Math.floor(seconds)) seconds.toLong().toString() else seconds.toString()
+    }
+}
+
+/** The lines of §5.6: failures nobody waits for, one stderr line each. */
+object Report {
+    @Volatile
+    private var write: (String) -> Unit = { System.err.println(it) }
+
+    fun line(text: String) = write(text)
+
+    /** Replaces where the lines go, returning the previous. */
+    @Synchronized
+    fun replace(writer: (String) -> Unit): (String) -> Unit {
+        val previous = write
+        write = writer
+        return previous
+    }
+
+    /** An error as the lines show it: `<ErrorName>: <message>`. */
+    fun failure(error: Throwable): String = errorName(error) + ": " + errorMessage(error)
+}
+
+/** A dispatch: the snapshot, in registration order, already limited to the emitter's scope (§5.1 step 1). */
+class Dispatch(
+    val name: String,
+    val entries: List<Entry>,
+    /** The filter (§6), null for none: asked once per non-global entry, in order, before any invocation. */
+    val keep: (suspend (Listener) -> Boolean)? = null,
+) {
+    private suspend fun selected(): List<Entry> {
+        val keep = keep ?: return entries
+        val kept = ArrayList<Entry>(entries.size)
+        for (entry in entries) {
+            val info = entry.info()
+            if (!info.global && !keep(info)) continue
+            kept.add(entry)
+        }
+        return kept
+    }
+
+    /** Starts every invocation in order and waits for none; a filter's failure is thrown, for the dispatcher to report. */
+    suspend fun emit(args: List<Any?>) {
+        for (entry in selected()) entry.emit(args)
+    }
+
+    /**
+     * Starts every invocation in order and waits for all; failures are an
+     * `AggregateError` in registration order, even a single one.
+     */
+    suspend fun parallel(args: List<Any?>) {
+        val entries = selected()
+        val failures = coroutineScope {
+            val running = entries.mapNotNull { entry ->
+                currentCoroutineContext().ensureActive()
+                val call = entry.begin() ?: return@mapNotNull null
+                // Each invocation on a thread of its own, as each incoming call.
+                async(Dispatchers.IO) {
+                    try {
+                        call(Mode.Parallel, args, null)
+                        null
+                    } catch (e: CancellationException) {
+                        // Cancelled by itself (its row unloads): a failure;
+                        // by the emitter giving up: the dispatch's end.
+                        if (currentCoroutineContext().isActive) e else throw e
+                    } catch (e: Throwable) {
+                        e
+                    }
+                }
+            }
+            running.mapNotNull { it.await() }
+        }
+        if (failures.isNotEmpty()) {
+            throw RutisException(RutisException.AGGREGATE_ERROR, "${failures.size} listeners of $name failed", errors = failures)
+        }
+    }
+
+    /** Runs one invocation at a time and returns the first result; a failure stops it. `mode` is serial or bail. */
+    suspend fun serial(mode: Mode, args: List<Any?>): Any? {
+        for (entry in selected()) {
+            currentCoroutineContext().ensureActive()
+            val call = entry.begin() ?: continue
+            val value = call(mode, args, null)
+            if (hasResult(value)) return value
+        }
+        return null
+    }
+
+    /**
+     * Calls the outermost entry with `next`, each `next` calling the entry
+     * after it and the last one `terminal` with the event's arguments (none:
+     * no result); returns the outermost value as it is.
+     */
+    suspend fun waterfall(mode: Mode, args: List<Any?>, terminal: (suspend (List<Any?>) -> Any?)?): Any? {
+        val entries = selected()
+        val ended = AtomicBoolean(false)
+        try {
+            return run(entries, 0, mode, args, terminal, ended)
+        } finally {
+            ended.set(true)
+        }
+    }
+
+    private suspend fun run(entries: List<Entry>, from: Int, mode: Mode, args: List<Any?>, terminal: (suspend (List<Any?>) -> Any?)?, ended: AtomicBoolean): Any? {
+        for (i in from until entries.size) {
+            val call = entries[i].begin() ?: continue
+            val called = AtomicBoolean(false)
+            val next: Next = {
+                if (called.getAndSet(true)) throw RutisException(RutisException.WATERFALL_NEXT, "next of $name was already called")
+                if (ended.get()) throw RutisException(RutisException.WATERFALL_NEXT, "next of $name was called after its waterfall ended")
+                run(entries, i + 1, mode, args, terminal, ended)
+            }
+            return call(mode, args, next)
+        }
+        return terminal?.invoke(args.toList())
+    }
+}
+
+/**
+ * Runs functions one after another, in the order given, on a thread while
+ * there are any (§5.5: the `emit` invocations of one listener).
+ */
+class Queue(private val label: String) {
+    private val pending = ArrayDeque<() -> Unit>()
+    private var running = false
+
+    fun push(job: () -> Unit) {
+        synchronized(pending) {
+            pending.addLast(job)
+            if (running) return
+            running = true
+        }
+        Thread({
+            while (true) {
+                val next = synchronized(pending) {
+                    if (pending.isEmpty()) {
+                        running = false
+                        null
+                    } else {
+                        pending.removeFirst()
+                    }
+                } ?: return@Thread
+                try {
+                    next()
+                } catch (e: Throwable) {
+                    Report.line("rutis: $label failed: ${Report.failure(e)}")
+                }
+            }
+        }, "rutis-$label").apply { isDaemon = true }.start()
+    }
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Control.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Control.kt
new file mode 100644
index 000000000..a786f920f
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Control.kt
@@ -0,0 +1,102 @@
+package arcships.rutis.internal
+
+import arcships.rutis.Rutis
+import arcships.rutis.Scope
+import arcships.rutis.internal.peer.Undefined
+
+/** The control operations rutis drives a runtime with (runtime contract §3, §4). */
+internal object Control {
+    private fun arg(args: List<Any?>, i: Int): Any? = Native.toNative(if (i < args.size) args[i] else Undefined)
+
+    private fun string(args: List<Any?>, i: Int, what: String): String =
+        arg(args, i) as? String ?: throw IllegalArgumentException("$what: expected a string")
+
+    @Suppress("UNCHECKED_CAST")
+    private fun record(value: Any?): Map<String, Any?> = (value as? Map<String, Any?>) ?: emptyMap()
+
+    /** The engine this runtime runs on, for `mount`: `kotlin` and the VM. */
+    fun engine(): Map<String, String> {
+        val vm = System.getProperty("java.vm.name") ?: "JVM"
+        val version = System.getProperty("java.version") ?: "unknown"
+        return linkedMapOf("name" to "kotlin", "version" to "${KotlinVersion.CURRENT} ($vm $version)")
+    }
+
+    suspend fun control(rt: RuntimeState, method: String, args: List<Any?>): Any? = when (method) {
+        "mount" -> {
+            val mount = record(arg(args, 0))
+            rt.mounted(mount["announce"] == true, mount["runtime"] as? String)
+            linkedMapOf(
+                "services" to linkedMapOf<String, Any?>(),
+                "features" to FEATURES,
+                "implementation" to linkedMapOf("name" to Rutis.IMPLEMENTATION, "version" to Rutis.VERSION),
+                "engine" to engine(),
+                "plugins" to LinkedHashMap<String, Any?>().apply { for ((name, plugin) in rt.plugins) put(name, rt.describe(plugin)) },
+            )
+        }
+        // Served by `arrive` on the reading thread; here only when called directly.
+        "events.elsewhere", "events.call" -> EventsRuntime.arrive(rt, method, args)!!.invoke()
+        "dispose" -> {
+            rt.closing = true
+            rt.dispose()
+            rt.session?.drain(Shutdown.millis())
+            null
+        }
+        "rows.load" -> {
+            val key = string(args, 0, "rows.load key")
+            val entry = string(args, 1, "rows.load entry")
+            val config = if (args.size > 2) args[2] else Undefined
+            // args[4], the row's own `inject`, names services a Cordis row
+            // waits for in Cordis; a leaf runtime's rows wait in rutis, which
+            // gates every name its plugin injects.
+            val isolate = LinkedHashMap<String, String>()
+            for (pair in arg(args, 3) as? List<*> ?: emptyList<Any?>()) {
+                val (name, label) = (pair as? List<*>)?.takeIf { it.size == 2 } ?: throw IllegalArgumentException("isolate: expected [name, label] pairs")
+                isolate[name as? String ?: throw IllegalArgumentException("isolate: a name is not a string")] =
+                    label as? String ?: throw IllegalArgumentException("isolate: a label is not a string")
+            }
+            val exports = LinkedHashMap<String, Map<String, String>>()
+            for ((name, methods) in record(arg(args, 5))) {
+                exports[name] = record(methods).mapValues { it.value as? String ?: "async" }
+            }
+            // The seventh, from rutis 0.13: the row's scope chain and its id.
+            val placed = record(arg(args, 6))
+            val scope = (placed["scope"] as? List<*> ?: emptyList<Any?>()).map {
+                val s = record(it)
+                Scope(s["id"] as? String ?: "", s["group"] as? String ?: "")
+            }
+            rt.load(key, placed["id"] as? String ?: "", entry, config, exports, isolate, scope)
+            null
+        }
+        "rows.update" -> {
+            rt.update(string(args, 0, "rows.update key"), if (args.size > 1) args[1] else Undefined)
+            null
+        }
+        "rows.unload" -> {
+            rt.unload(string(args, 0, "rows.unload key"))
+            null
+        }
+        "rows.schema" -> rt.describe(rt.definition(string(args, 0, "rows.schema entry")))
+        "hosts.provide" -> {
+            val name = string(args, 0, "hosts.provide name")
+            val methods = record(arg(args, 1)).mapValues { it.value as? String ?: "async" }
+            val label = arg(args, 2) as? String
+            val id = scopedId(name, label, label != null)
+            synchronized(rt.lock) {
+                if (rt.hosts.containsKey(id)) throw IllegalStateException("host service ${printable(id)} is already provided")
+                rt.hosts[id] = methods
+            }
+            null
+        }
+        "hosts.withdraw" -> {
+            val id = string(args, 0, "hosts.withdraw id")
+            synchronized(rt.lock) { rt.hosts.remove(id) }
+            null
+        }
+        "release" -> {
+            rt.released(string(args, 0, "release handle"))
+            null
+        }
+        "get" -> rt.property(string(args, 0, "get handle"), string(args, 1, "get property"))
+        else -> throw IllegalArgumentException("unknown control method $method")
+    }
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/EventsRuntime.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/EventsRuntime.kt
new file mode 100644
index 000000000..1e9b78fb3
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/EventsRuntime.kt
@@ -0,0 +1,453 @@
+package arcships.rutis.internal
+
+import arcships.rutis.EventArgs
+import arcships.rutis.Listener
+import arcships.rutis.Next
+import arcships.rutis.RemoteFunction
+import arcships.rutis.RutisException
+import arcships.rutis.Scope
+import arcships.rutis.internal.peer.CallChain
+import arcships.rutis.internal.peer.Exported
+import arcships.rutis.internal.peer.Undefined
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.future.await
+import kotlinx.coroutines.job
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withContext
+import java.util.concurrent.CompletableFuture
+
+// Events (#464, docs/design-events-2026-10-18.md): every listener on a host
+// is on one logical bus. A listener this process registers is registered with
+// the host too; an emission whose listeners are all in this process is
+// dispatched here (the fast path), any other by the host. The result is the
+// same either way.
+
+/** A listener of this process. */
+internal class LocalListener(
+    val rt: RuntimeState,
+    val id: String,
+    val name: String,
+    val row: Row,
+    val fn: suspend (EventArgs) -> Any?,
+    val prepend: Boolean,
+    val global: Boolean,
+) : Entry {
+    /** Its position: the order of the listeners of one name. */
+    var position = 0L
+
+    /** Withdrawn (rt.lock): no invocation starts any more. */
+    var withdrawn = false
+    val queue = Queue("listener-$id")
+
+    override fun info(): Listener = Listener(
+        name = name,
+        plugin = row.plugin.name,
+        row = row.name,
+        runtime = rt.runtimeName,
+        // A copy: a filter changing it changes nothing else.
+        scope = row.scope.toList(),
+        global = global,
+    )
+
+    /** Whether invocations may start; rt.lock is held. */
+    fun live(): Boolean = !withdrawn && rt.rows[row.key] === row
+
+    /** Counts an invocation in the row's listeners, which unload waits for, unless withdrawn. */
+    fun reserve(): Boolean = synchronized(rt.lock) {
+        if (!live()) return false
+        row.listening.add()
+        true
+    }
+
+    override fun begin(): Call? {
+        if (!reserve()) return null
+        return { mode, args, next ->
+            try {
+                run(mode, args, next)
+            } finally {
+                row.listening.done()
+            }
+        }
+    }
+
+    override fun emit(args: List<Any?>): Boolean {
+        if (!reserve()) return false
+        val chain = CallChain.current()
+        queue.push {
+            try {
+                if (synchronized(rt.lock) { live() }) {
+                    try {
+                        runBlocking(CallChain.element(chain)) { run(Mode.Emit, args, null) }
+                    } catch (e: Throwable) {
+                        failed(e)
+                    }
+                }
+            } finally {
+                row.listening.done()
+            }
+        }
+        return true
+    }
+
+    /** Reports an `emit` invocation's failure where the listener is (§5.6). */
+    fun failed(error: Throwable) {
+        // Cancelled because its row unloads (§7.1): not a failure.
+        if (error is CancellationException && row.job.isCancelled) return
+        Report.line("rutis: listener of $name in row ${row.name} failed: ${Report.failure(error)}")
+    }
+
+    /**
+     * Calls the listener with session values, returning a session value:
+     * cancelled when the caller gives up or the row unloads. `next` returns a
+     * session value; the listener's `next` a native one.
+     */
+    suspend fun run(mode: Mode, args: List<Any?>, next: Next?): Any? {
+        val caller = currentCoroutineContext().job
+        val job = Job(caller)
+        val stop = row.job.invokeOnCompletion { job.cancel() }
+        if (row.job.isCancelled) job.cancel()
+        val native: Next? = if (mode.waterfall && next != null) ({ Native.toNative(next()) }) else null
+        try {
+            return withContext(job) { Native.fromNative(fn(EventArgs.of(args, native))) }
+        } catch (e: CancellationException) {
+            // Cancelled because its row unloads while the dispatch goes on:
+            // the listener has gone, with no result (a cancelled coroutine
+            // cannot return one; Go and Python listeners return after their
+            // cancellation, §7.1).
+            if (row.job.isCancelled && caller.isActive) return null
+            throw e
+        } finally {
+            stop.dispose()
+            job.complete()
+        }
+    }
+}
+
+internal object EventsRuntime {
+    /** Registers a listener of `row` (Ctx.on). */
+    fun on(rt: RuntimeState, row: Row, name: String, prepend: Boolean, global: Boolean, fn: suspend (EventArgs) -> Any?): () -> Unit {
+        checkListen(name)
+        val listener: LocalListener
+        synchronized(rt.lock) {
+            if (rt.rows[row.key] !== row) throw IllegalStateException("rutis: row ${row.key} is not active")
+            rt.listenerSeq++
+            listener = LocalListener(rt, rt.listenerSeq.toString(), name, row, fn, prepend, global)
+            val list = rt.listeners.getOrPut(name) { ArrayList() }
+            if (prepend) {
+                rt.first--
+                listener.position = rt.first
+                list.add(0, listener)
+            } else {
+                rt.last++
+                listener.position = rt.last
+                list.add(listener)
+            }
+            rt.byId[listener.id] = listener
+            // The host hears of it before any emission this process makes after
+            // it (sent in order); a row loading answers once the host has it,
+            // and fails when the host refuses it (§4.4). Refused outside a
+            // load, it is reported (§11).
+            val session = rt.session
+            if (session != null && !rt.closing) {
+                val loading = row.loading
+                val registration = listOf(
+                    linkedMapOf<String, Any?>(
+                        "id" to listener.id, "name" to name, "row" to row.key, "plugin" to row.plugin.name,
+                        "kind" to "sync", "prepend" to prepend, "global" to global,
+                    ),
+                )
+                val refused = CompletableFuture<Throwable?>()
+                val answered = session.announce("", "events.on", registration) { error ->
+                    if (loading) {
+                        refused.complete(error)
+                    } else {
+                        Report.line("rutis: registration of listener of $name in row ${row.name} failed: ${Report.failure(error)}")
+                    }
+                }
+                if (loading) row.pending?.add(answered.thenApply { refused.getNow(null) })
+            }
+        }
+        return {
+            synchronized(rt.lock) {
+                if (!listener.withdrawn) {
+                    withdraw(rt, listener)
+                    val session = rt.session
+                    if (session != null && !rt.closing) session.notify("", "events.off", listOf(listOf(listener.id)))
+                }
+            }
+        }
+    }
+
+    /** Takes a listener off the table; rt.lock is held. */
+    fun withdraw(rt: RuntimeState, listener: LocalListener) {
+        listener.withdrawn = true
+        rt.byId.remove(listener.id)
+        val list = rt.listeners[listener.name] ?: return
+        list.remove(listener)
+        if (list.isEmpty()) rt.listeners.remove(listener.name)
+    }
+
+    /**
+     * Withdraws a row's listeners before it unloads; rt.lock is held. A
+     * dispatch in progress keeps its snapshot but starts none of them. The
+     * host, which withdraws them itself on rows.unload, hears of it for the
+     * other unloads (a failed load, an update).
+     */
+    fun forgetListeners(rt: RuntimeState, row: Row) {
+        val ids = rt.byId.values.filter { it.row === row }
+        for (listener in ids) withdraw(rt, listener)
+        val session = rt.session
+        if (ids.isNotEmpty() && session != null && !rt.closing) session.notify("", "events.off", listOf(ids.map { it.id }))
+    }
+
+    /**
+     * Whether an emission of `name` goes through the host (§5.2): a listener
+     * of it may be elsewhere, or an earlier emit of it through the host is
+     * unanswered. rt.lock is held.
+     */
+    private fun viaHost(rt: RuntimeState, name: String, mode: Mode): Boolean {
+        val session = rt.session ?: return false
+        // Once the session ended, nothing is elsewhere.
+        if (rt.closing || session.error != null) return false
+        if (name in rt.elsewhere) return true
+        if (rt.elsewherePrefixes.any { name.startsWith(it) }) return true
+        return mode == Mode.Emit && (rt.hostEmits[name] ?: 0) > 0
+    }
+
+    /** Dispatches an emission of `row`; `terminal` only in a waterfall. */
+    suspend fun dispatch(
+        rt: RuntimeState,
+        row: Row,
+        name: String,
+        mode: Mode,
+        args: List<Any?>,
+        terminal: (suspend (EventArgs) -> Any?)?,
+        keep: (suspend (Listener) -> Boolean)?,
+    ): Any? {
+        checkEmit(name)
+        val values = args.map(Native::fromNative)
+        val snapshot: Dispatch
+        val viaHost: (suspend () -> Any?)?
+        synchronized(rt.lock) {
+            if (rt.rows[row.key] !== row) throw RutisException(RutisException.BINDING_ERROR, "row ${row.key} is not loaded in this runtime")
+            if (viaHost(rt, name, mode)) {
+                viaHost = sendViaHost(rt, row, name, mode, values, terminal, keep)
+                snapshot = Dispatch(name, emptyList())
+            } else {
+                viaHost = null
+                // The fast path (§5.2): the snapshot of this process's listeners.
+                val entries = (rt.listeners[name] ?: emptyList()).filter { within(it.row.scope, row.scope) }
+                snapshot = Dispatch(name, entries, keep?.let(::protect))
+            }
+        }
+        if (viaHost != null) return viaHost()
+        val last: (suspend (List<Any?>) -> Any?)? = terminal?.let { t -> { raw: List<Any?> -> Native.fromNative(t(EventArgs.of(raw, null))) } }
+        return when (mode) {
+            Mode.Emit -> {
+                try {
+                    snapshot.emit(values)
+                } catch (e: CancellationException) {
+                    throw e
+                } catch (e: Throwable) {
+                    Report.line("rutis: filter of $name from row ${row.name} failed: ${Report.failure(e)}")
+                }
+                null
+            }
+            Mode.Parallel -> {
+                snapshot.parallel(values)
+                null
+            }
+            Mode.Waterfall -> Native.toNative(snapshot.waterfall(mode, values, last))
+            else -> Native.toNative(snapshot.serial(mode, values))
+        }
+    }
+
+    /** The filter as the dispatcher asks it: what it throws is its failure. */
+    private fun protect(keep: suspend (Listener) -> Boolean): suspend (Listener) -> Boolean = { keep(it) }
+
+    /**
+     * Sends `events.dispatch` now (rt.lock is held, so it goes out behind
+     * this process's earlier frames, such as the events.on of a listener
+     * registered before, §4.4), and returns the wait for its result.
+     */
+    private fun sendViaHost(
+        rt: RuntimeState,
+        row: Row,
+        name: String,
+        mode: Mode,
+        values: List<Any?>,
+        terminal: (suspend (EventArgs) -> Any?)?,
+        keep: (suspend (Listener) -> Boolean)?,
+    ): suspend () -> Any? {
+        val session = rt.session!!
+        val record = linkedMapOf<String, Any?>("row" to row.key, "name" to name, "mode" to mode.wire, "args" to values)
+        if (keep != null) record["filter"] = selector(keep)
+        if (terminal != null && mode == Mode.Waterfall) {
+            // The host calls it with the event's arguments.
+            record["terminal"] = Exported(terminal) { raw -> Native.fromNative(terminal(EventArgs.of(raw, null))) }
+        }
+        if (mode == Mode.Emit) {
+            // Its later emits of `name` follow it through the host until it
+            // is answered (§5.5). The emitter does not wait, nor cancel it.
+            rt.hostEmits[name] = (rt.hostEmits[name] ?: 0) + 1
+            val answered = { error: Throwable? ->
+                synchronized(rt.lock) {
+                    val left = (rt.hostEmits[name] ?: 1) - 1
+                    if (left <= 0) rt.hostEmits.remove(name) else rt.hostEmits[name] = left
+                }
+                if (error != null) Report.line("rutis: emit of $name from row ${row.name} failed: ${Report.failure(error)}")
+            }
+            val wait = try {
+                session.send("", "events.dispatch", listOf(record), false)
+            } catch (e: Throwable) {
+                answered(null)
+                throw e
+            }
+            Thread({
+                val error = try {
+                    runBlocking { wait() }
+                    null
+                } catch (e: Throwable) {
+                    e
+                }
+                answered(error)
+            }, "rutis-emit").apply { isDaemon = true }.start()
+            return { null }
+        }
+        val wait = session.send("", "events.dispatch", listOf(record), mode == Mode.Bail)
+        return {
+            val value = wait()
+            if (mode == Mode.Parallel) null else Native.toNative(value)
+        }
+    }
+
+    /** The function the host calls with the descriptors of a dispatch's candidates, answering one boolean each (§6). */
+    private fun selector(keep: suspend (Listener) -> Boolean): Exported = Exported(keep) { args ->
+        val infos = Native.toNative(if (args.isNotEmpty()) args[0] else Undefined) as? List<*> ?: emptyList<Any?>()
+        infos.map { keep(descriptor(it)) }
+    }
+
+    /** A descriptor received as data. */
+    fun descriptor(value: Any?): Listener {
+        @Suppress("UNCHECKED_CAST")
+        val d = value as? Map<String, Any?> ?: throw IllegalArgumentException("filter: a descriptor is not an object")
+        return Listener(
+            name = d["name"] as? String ?: "",
+            prefix = d["prefix"] == true,
+            plugin = d["plugin"] as? String ?: "",
+            row = d["row"] as? String,
+            runtime = d["runtime"] as? String,
+            node = d["node"] as? String,
+            scope = (d["scope"] as? List<*> ?: emptyList<Any?>()).map {
+                @Suppress("UNCHECKED_CAST")
+                val s = it as? Map<String, Any?> ?: emptyMap()
+                Scope(s["id"] as? String ?: "", s["group"] as? String ?: "")
+            },
+            global = d["global"] == true,
+        )
+    }
+
+    /** A descriptor as data, as the protocol names its fields (§4.2). */
+    fun data(listener: Listener): Map<String, Any?> = linkedMapOf(
+        "name" to listener.name,
+        "prefix" to listener.prefix,
+        "plugin" to listener.plugin,
+        "row" to listener.row,
+        "runtime" to listener.runtime,
+        "node" to listener.node,
+        "scope" to listener.scope.map { linkedMapOf("id" to it.id, "group" to it.group) },
+        "global" to listener.global,
+    )
+
+    // ── From the host ────────────────────────────────────────────
+
+    /** Takes the host's event calls on the reading thread, in frame order (§4.1, §5.5). */
+    fun arrive(rt: RuntimeState, method: String, args: List<Any?>): (suspend () -> Any?)? = when (method) {
+        "events.elsewhere" -> {
+            val error = try {
+                elsewhere(rt, args)
+                null
+            } catch (e: Throwable) {
+                e
+            }
+            { if (error != null) throw error else null }
+        }
+        "events.call" -> call(rt, args)
+        else -> null
+    }
+
+    private fun elsewhere(rt: RuntimeState, args: List<Any?>) {
+        @Suppress("UNCHECKED_CAST")
+        val change = Native.toNative(if (args.isNotEmpty()) args[0] else Undefined) as? Map<String, Any?>
+            ?: throw IllegalArgumentException("events.elsewhere: expected a record")
+        fun names(key: String): List<String> = (change[key] as? List<*> ?: emptyList<Any?>()).map {
+            it as? String ?: throw IllegalArgumentException("events.elsewhere $key: expected strings")
+        }
+        synchronized(rt.lock) {
+            rt.elsewhere.addAll(names("add"))
+            rt.elsewhere.removeAll(names("remove").toSet())
+            rt.elsewherePrefixes.addAll(names("addPrefixes"))
+            rt.elsewherePrefixes.removeAll(names("removePrefixes").toSet())
+        }
+    }
+
+    /** A record received as a call argument: its fields as session values. */
+    @Suppress("UNCHECKED_CAST")
+    private fun fields(value: Any?): Map<String, Any?>? = when (value) {
+        is kotlinx.serialization.json.JsonObject -> value
+        is Map<*, *> -> value as Map<String, Any?>
+        else -> null
+    }
+
+    /** Runs one invocation of a listener here (§5.3): an `emit` one is queued now, after the earlier ones of that listener (§5.5). */
+    private fun call(rt: RuntimeState, args: List<Any?>): suspend () -> Any? {
+        val record = fields(if (args.isNotEmpty()) args[0] else null) ?: return { throw IllegalArgumentException("events.call: not a record") }
+        val id = Native.toNative(record["listener"]) as? String
+        val name = Native.toNative(record["name"]) as? String ?: ""
+        val mode = (Native.toNative(record["mode"]) as? String)?.let(Mode::of)
+            ?: return { throw IllegalArgumentException("events.call: unknown mode ${record["mode"]}") }
+        val values: List<Any?> = when (val list = record["args"]) {
+            is List<*> -> list
+            is kotlinx.serialization.json.JsonArray -> list
+            null, Undefined -> emptyList()
+            else -> return { throw IllegalArgumentException("events.call args: not a list") }
+        }
+        val withdrawn = RutisException(RutisException.BINDING_ERROR, "listener $id of $name is withdrawn")
+        val listener = synchronized(rt.lock) { rt.byId[id] } ?: return { throw withdrawn }
+        if (mode == Mode.Emit) {
+            if (!listener.reserve()) return { throw withdrawn }
+            val done = CompletableFuture<Throwable?>()
+            val chain = CallChain.current()
+            listener.queue.push {
+                try {
+                    if (!synchronized(rt.lock) { listener.live() }) {
+                        done.complete(withdrawn)
+                    } else {
+                        try {
+                            runBlocking(CallChain.element(chain)) { listener.run(mode, values, null) }
+                        } catch (e: Throwable) {
+                            listener.failed(e)
+                        }
+                        done.complete(null)
+                    }
+                } finally {
+                    listener.row.listening.done()
+                }
+            }
+            // Answered once it ran; its failure is reported here.
+            return {
+                done.await()?.let { throw it }
+                null
+            }
+        }
+        var next: Next? = null
+        if (mode.waterfall) {
+            val remote = record["next"] as? RemoteFunction ?: return { throw IllegalArgumentException("events.call: a ${mode.wire} needs next") }
+            next = { remote.peer.callFunctionSuspend(remote, emptyList(), mode == Mode.WaterfallSync) }
+        }
+        val call = listener.begin() ?: return { throw withdrawn }
+        return { call(mode, values, next) }
+    }
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Runtime.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Runtime.kt
new file mode 100644
index 000000000..b79d01bef
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Runtime.kt
@@ -0,0 +1,457 @@
+package arcships.rutis.internal
+
+import arcships.rutis.Ctx
+import arcships.rutis.Plugin
+import arcships.rutis.Rutis
+import arcships.rutis.RutisException
+import arcships.rutis.RutisFormat
+import arcships.rutis.Scope
+import arcships.rutis.ServiceObject
+import arcships.rutis.ServiceShape
+import arcships.rutis.ServiceTable
+import arcships.rutis.Tables
+import arcships.rutis.internal.peer.CallChain
+import arcships.rutis.internal.peer.Peer
+import arcships.rutis.internal.peer.Undefined
+import kotlinx.coroutines.CompletableJob
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.future.await
+import kotlinx.coroutines.withContext
+import kotlinx.coroutines.withTimeoutOrNull
+import kotlinx.serialization.json.JsonObject
+import java.util.concurrent.CompletableFuture
+
+/**
+ * What this runtime supports of the runtime contract. `rows.announce`:
+ * services rows provide without declaring them are announced with their
+ * methods, to a host whose mount says `announce`. Events are the capability
+ * `events-v2` (#464), not a feature.
+ */
+val FEATURES: List<String> = listOf("rows.v2", "hosts", "leaf", "scopes", "rows.announce")
+
+/** Where a plugin is told that the host does not take an undeclared service. */
+@Volatile
+var oldHostOutput: (String) -> Unit = { System.err.println(it) }
+
+/** What a plugin providing the undeclared service `name` is told by a host older than 0.12. */
+fun oldHost(name: String): String =
+    "rutis: service $name is not declared in provides, and this host (older than 0.12) does not take undeclared services; declare it or upgrade rutis-host"
+
+/** How the service `name` is identified in the scope `label`: the name, or the name, NUL and the label. */
+fun scopedId(name: String, label: String?, scoped: Boolean): String {
+    if ('\u0000' in name || (label != null && '\u0000' in label)) throw IllegalArgumentException("service \"$name\" or its scope label contains NUL")
+    if (!scoped) return name
+    if (label.isNullOrEmpty()) throw IllegalArgumentException("service \"$name\" has an empty scope label")
+    return name + "\u0000" + label
+}
+
+fun handleOf(id: String, generation: Int): String {
+    if (generation == 1) return id
+    val separator = if ('\u0000' in id) "\u0000" else "#"
+    return id + separator + generation
+}
+
+fun printable(id: String): String = id.replace('\u0000', '@')
+
+/** Counts running invocations; waits until none run. */
+class Counter {
+    private var count = 0
+    private val lock = Object()
+
+    fun add() = synchronized(lock) { count++ }
+
+    fun done() = synchronized(lock) {
+        count--
+        if (count <= 0) lock.notifyAll()
+    }
+
+    /** Waits until none run, at most `millis`; whether none run. */
+    fun await(millis: Long): Boolean = synchronized(lock) {
+        val deadline = System.currentTimeMillis() + millis
+        while (count > 0) {
+            val left = deadline - System.currentTimeMillis()
+            if (left <= 0) return false
+            lock.wait(left)
+        }
+        true
+    }
+}
+
+internal class Provided(val row: String, val value: Any, val shape: ServiceShape?, val table: ServiceTable<Any>)
+
+internal class Slot(val row: String, val name: String, var methods: Set<String>?, val announced: Boolean = false) {
+    var obj: Any? = null
+    var present = false
+    var handle: String? = null
+    var generation = 0
+}
+
+internal class HandleEntry(val id: String, val obj: Any, val table: ServiceTable<Any>, val methods: Set<String>?) {
+    var current = true
+    var released = false
+}
+
+internal class Row(
+    val key: String,
+    /** The row's id in the configuration (rows.load's `id`; the key when not given). */
+    val name: String,
+    val entry: String,
+    val plugin: Plugin,
+    val config: Any?,
+    val exports: Map<String, Map<String, String>>,
+    val isolate: Map<String, String>,
+    /** Its scope chain, outermost first. */
+    val scope: List<Scope>,
+    /** The chain of the call that loaded it, which its own code keeps. */
+    val chain: List<String>,
+) {
+    val job: CompletableJob = SupervisorJob()
+    val cleanups = ArrayList<suspend () -> Unit>()
+    val provided = ArrayList<String>()
+    val announced = ArrayList<String>()
+    val listening = Counter()
+    var order = 0L
+
+    /** Announcements and registrations the host has yet to answer while the row loads; each completes with a refusal or null. */
+    var pending: MutableList<CompletableFuture<Throwable?>>? = ArrayList()
+    var loading = true
+
+    fun id(name: String): String {
+        val label = isolate[name]
+        return try {
+            scopedId(name, label, label != null)
+        } catch (_: IllegalArgumentException) {
+            name
+        }
+    }
+}
+
+/** The rows one controller loads into this process. */
+class RuntimeState(plugins: List<Plugin>) {
+    internal val plugins: Map<String, Plugin> = plugins.associateBy { it.name }
+
+    @Volatile
+    var session: Peer? = null
+
+    internal val lock = Object()
+    internal val rows = HashMap<String, Row>()
+    internal val services = HashMap<String, Provided>()
+    internal val hosts = HashMap<String, Map<String, String>>()
+    internal val slots = HashMap<String, Slot>()
+    internal val handles = HashMap<String, HandleEntry>()
+    private var version = 0L
+    private var loaded = 0L
+
+    @Volatile
+    internal var closing = false
+
+    // The listeners of each name, in position order, and by id.
+    internal val listeners = HashMap<String, MutableList<LocalListener>>()
+    internal val byId = HashMap<String, LocalListener>()
+    internal var listenerSeq = 0L
+    internal var first = 0L
+    internal var last = 0L
+
+    // The names and prefixes with listeners outside this process
+    // (events.elsewhere), and the emits through the host not answered yet.
+    internal val elsewhere = HashSet<String>()
+    internal val elsewherePrefixes = HashSet<String>()
+    internal val hostEmits = HashMap<String, Int>()
+
+    /** What the host calls this runtime (mount `runtime`), for descriptors. */
+    @Volatile
+    internal var runtimeName: String? = null
+
+    /** The host takes announced services (mount `announce`). */
+    private var announce = false
+
+    /** Mounted by a host; one without `announce` is older than 0.12. */
+    private var mounted = false
+    private val told = HashSet<String>()
+
+    private fun names(): String = plugins.keys.sorted().joinToString(", ")
+
+    internal fun definition(entry: String): Plugin {
+        val plugin = plugins[entry] ?: throw RutisException("NotFound", "plugin $entry is not in this runtime; it has: ${names()}")
+        if (plugin.api > Rutis.PLUGIN_API) throw IllegalStateException("plugin $entry needs plugin API ${plugin.api}; this runtime supports ${Rutis.PLUGIN_API}")
+        return plugin
+    }
+
+    // ── Services ─────────────────────────────────────────────────
+
+    /** Reports the object now in an exported slot under a new handle; `lock` is held. */
+    internal fun refresh(id: String) {
+        val slot = slots[id] ?: return
+        val provided = services[id]?.takeIf { it.row == slot.row }
+        val present = provided != null
+        val current = provided?.value
+        if (present == slot.present && current === slot.obj) return
+        slot.handle?.let(::retire)
+        slot.obj = current
+        slot.present = present
+        slot.handle = null
+        if (provided != null) {
+            slot.generation++
+            val handle = handleOf(id, slot.generation)
+            slot.handle = handle
+            if (slot.announced) slot.methods = provided.table.methods.toSet()
+            handles[handle] = HandleEntry(id, provided.value, provided.table, slot.methods)
+        }
+        version++
+        val session = session ?: return
+        if (closing) return
+        val handle = slot.handle
+        if (!slot.announced) {
+            session.notify("", "service", listOf(id, handle, version))
+            return
+        }
+        // An announced service says whose it is and what it offers, and a row
+        // loading answers once rutis has heard it (a refusal fails the row there).
+        val methods = LinkedHashMap<String, Any?>()
+        for (method in slot.methods ?: emptySet()) methods[method] = "async"
+        val answered = session.announce("", "service", listOf(id, handle, version, linkedMapOf("row" to slot.row, "methods" to methods)))
+        val row = rows[slot.row]
+        if (row != null && row.loading) row.pending?.add(answered.thenApply { null })
+    }
+
+    private fun retire(handle: String) {
+        val entry = handles[handle] ?: return
+        entry.current = false
+        if (entry.released) handles.remove(handle)
+    }
+
+    internal fun provide(row: Row, name: String, value: Any): () -> Unit {
+        val table = Tables.serviceTable(value.javaClass)
+            ?: throw IllegalArgumentException("rutis: provide $name: ${value.javaClass.name} is not a @RutisService class (no generated method table: apply the rutis-ksp processor)")
+        val shape = row.plugin.provides[name]
+        val type = shape?.type
+        if (type != null && !type.isInstance(value)) {
+            throw IllegalArgumentException("rutis: provide $name: ${value.javaClass.name} is not the ${type.name} provides declares")
+        }
+        val id = row.id(name)
+        synchronized(lock) {
+            services[id]?.let { throw IllegalStateException("rutis: service ${printable(id)} is already provided by row ${it.row}") }
+            services[id] = Provided(row.key, value, shape, table)
+            row.provided.add(id)
+            // Not declared: announced, with its methods; a host older than
+            // 0.12 does not take it, and the plugin is told, once per name.
+            if (slots[id] == null && '#' !in name) {
+                if (announce) {
+                    slots[id] = Slot(row.key, name, null, announced = true)
+                    row.announced.add(id)
+                } else if (mounted && told.add(name)) {
+                    oldHostOutput(oldHost(name))
+                }
+            }
+            refresh(id)
+        }
+        return {
+            synchronized(lock) {
+                val existing = services[id]
+                if (existing != null && existing.row == row.key && existing.value === value) {
+                    services.remove(id)
+                    row.provided.remove(id)
+                    refresh(id)
+                }
+            }
+        }
+    }
+
+    // ── Rows ─────────────────────────────────────────────────────
+
+    /** Loads row `key`, whose id in the configuration is `name`. */
+    internal suspend fun load(
+        key: String,
+        name: String,
+        entry: String,
+        config: Any?,
+        exports: Map<String, Map<String, String>>,
+        isolate: Map<String, String>,
+        scope: List<Scope>,
+    ) {
+        val plugin = definition(entry)
+        val row = Row(key, name.ifEmpty { key }, entry, plugin, config, exports, isolate, scope, CallChain.current())
+        synchronized(lock) {
+            if (rows.containsKey(key)) throw IllegalStateException("row $key is already loaded")
+            for ((service, label) in isolate) scopedId(service, label, true)
+            for (service in exports.keys) {
+                if ('#' in service) throw IllegalArgumentException("service name $service cannot be projected")
+                slots[row.id(service)]?.let { throw IllegalStateException("service ${printable(row.id(service))} is already exported by row ${it.row}") }
+            }
+            loaded++
+            row.order = loaded
+            rows[key] = row
+            for ((service, methods) in exports) slots[row.id(service)] = Slot(key, service, methods.keys.toSet())
+        }
+        val failure = try {
+            val decoded = decodeConfig(plugin, config)
+            withContext(row.job + CallChain.element(row.chain)) {
+                plugin.apply(Ctx(this@RuntimeState, row), decoded)
+            }
+            null
+        } catch (e: Throwable) {
+            e
+        }
+        if (failure != null) {
+            try {
+                unload(key)
+            } catch (e: Throwable) {
+                failure.addSuppressed(e)
+            }
+            throw failure
+        }
+        val pending = synchronized(lock) {
+            for (service in exports.keys) refresh(row.id(service))
+            val pending = row.pending ?: emptyList()
+            row.pending = null
+            row.loading = false
+            pending
+        }
+        // rutis has published the announced services (or refused one, which
+        // fails the row there) and registered the row's listeners before it
+        // hears that the row loaded. A refused listener fails the load (§4.4).
+        var refused: Throwable? = null
+        for (wait in pending) {
+            val error = wait.await()
+            if (error != null && refused == null) refused = error
+        }
+        if (refused != null) {
+            try {
+                unload(key)
+            } catch (e: Throwable) {
+                refused.addSuppressed(e)
+            }
+            throw refused
+        }
+    }
+
+    private fun decodeConfig(plugin: Plugin, config: Any?): Any? {
+        val value = if ((config == null || config === Undefined || config == kotlinx.serialization.json.JsonNull) &&
+            plugin.config.descriptor.kind.let { it == kotlinx.serialization.descriptors.StructureKind.CLASS || it == kotlinx.serialization.descriptors.StructureKind.OBJECT }
+        ) {
+            JsonObject(emptyMap())
+        } else {
+            config
+        }
+        return try {
+            RutisFormat.decode(plugin.config, value)
+        } catch (e: kotlinx.serialization.SerializationException) {
+            throw IllegalArgumentException("config: ${e.message}", e)
+        } catch (e: arcships.rutis.internal.peer.ValueException) {
+            throw IllegalArgumentException("config: ${e.message}", e)
+        }
+    }
+
+    internal suspend fun unload(key: String) {
+        val row = synchronized(lock) {
+            val row = rows.remove(key) ?: return
+            EventsRuntime.forgetListeners(this, row)
+            // Withdrawals first: rutis hears them before the plugin goes away.
+            for (id in row.provided.toList()) {
+                val existing = services[id]
+                if (existing != null && existing.row == key) {
+                    services.remove(id)
+                    refresh(id)
+                }
+            }
+            row.provided.clear()
+            val ids = row.announced.toMutableList()
+            for (service in row.exports.keys) ids.add(row.id(service))
+            for (id in ids) {
+                val slot = slots[id]
+                if (slot != null && slot.row == key) {
+                    slots.remove(id)
+                    slot.handle?.let(::retire)
+                }
+            }
+            row.announced.clear()
+            row
+        }
+        // The row's coroutines are cancelled; its running listeners waited
+        // for, at most the shutdown deadline (§7.1); then its cleanups run,
+        // latest first.
+        row.job.cancel()
+        val budget = Shutdown.millis()
+        if (!row.listening.await(budget)) {
+            Report.line("rutis: listeners of row ${row.name} still running after ${Shutdown.shown(budget)}s; unloading anyway")
+        }
+        withTimeoutOrNull(budget) { row.job.cancelAndJoin() }
+        var failure: Throwable? = null
+        for (cleanup in row.cleanups.asReversed()) {
+            try {
+                withContext(CallChain.element(row.chain)) { cleanup() }
+            } catch (e: Throwable) {
+                if (failure == null) failure = e else failure.addSuppressed(e)
+            }
+        }
+        failure?.let { throw it }
+    }
+
+    internal suspend fun update(key: String, config: Any?) {
+        val row = synchronized(lock) { rows[key] } ?: throw IllegalStateException("row $key is not loaded")
+        // Leaf plugins have no volatile fields: a new config restarts the row.
+        unload(key)
+        load(key, row.name, row.entry, config, row.exports, row.isolate, row.scope)
+    }
+
+    /** Unloads every row, latest first. Returns false when it gave up cleanups at the deadline. */
+    suspend fun dispose(budgetMillis: Long? = null): Boolean {
+        val ordered = synchronized(lock) { rows.values.sortedBy { it.order } }
+        for (row in ordered.asReversed()) {
+            if (budgetMillis == null) {
+                runCatching { unload(row.key) }
+                continue
+            }
+            val done = withTimeoutOrNull(budgetMillis) { runCatching { unload(row.key) } }
+            if (done == null) {
+                System.err.println("rutis: gave up the cleanups of row ${row.key} and those after it")
+                return false
+            }
+        }
+        return true
+    }
+
+    // ── Dispatch ─────────────────────────────────────────────────
+
+    /** Serves `invoke`: a control operation (target "") or a method of an exported service object. */
+    suspend fun dispatch(target: String, method: String, args: List<Any?>): Any? {
+        if (closing) throw IllegalStateException("runtime is closing")
+        if (target.isEmpty()) return Control.control(this, method, args)
+        val entry = synchronized(lock) { handles[target] } ?: throw IllegalArgumentException("unknown or released service object ${printable(target)}")
+        val methods = entry.methods
+        if ((methods != null && method !in methods) || method !in entry.table.methods) {
+            throw IllegalArgumentException("unknown service method ${printable(entry.id)}.$method")
+        }
+        return entry.table.invoke(entry.obj, method, args)
+    }
+
+    internal fun mounted(announce: Boolean, runtime: String?) = synchronized(lock) {
+        this.announce = announce
+        this.runtimeName = runtime
+        this.mounted = true
+    }
+
+    internal fun released(handle: String) = synchronized(lock) {
+        val entry = handles[handle] ?: return@synchronized
+        entry.released = true
+        if (!entry.current) handles.remove(handle)
+    }
+
+    internal fun property(handle: String, property: String): Any? {
+        val entry = synchronized(lock) { handles[handle] } ?: throw IllegalArgumentException("unknown or released service object ${printable(handle)}")
+        throw IllegalArgumentException("no property $property of ${printable(entry.id)}: a service's methods cross, not its fields")
+    }
+
+    /** The plugin's declarations, as `rows.schema` answers them. */
+    internal fun describe(plugin: Plugin): Map<String, Any?> = linkedMapOf(
+        "config" to (plugin.schema ?: kotlinx.serialization.json.JsonNull),
+        "inject" to plugin.inject,
+        "provides" to LinkedHashMap<String, Any?>().apply { for ((name, shape) in plugin.provides) put(name, LinkedHashMap<String, Any?>(shape.kinds)) },
+        "version" to null,
+        // Every plugin of this SDK may provide services `provides` does not
+        // list: they reach rutis by themselves.
+        "announces" to true,
+    )
+
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Schema.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Schema.kt
new file mode 100644
index 000000000..5d7d45c0d
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Schema.kt
@@ -0,0 +1,96 @@
+package arcships.rutis.internal
+
+import kotlinx.serialization.descriptors.PolymorphicKind
+import kotlinx.serialization.descriptors.PrimitiveKind
+import kotlinx.serialization.descriptors.SerialDescriptor
+import kotlinx.serialization.descriptors.SerialKind
+import kotlinx.serialization.descriptors.StructureKind
+import kotlinx.serialization.descriptors.getContextualDescriptor
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+
+/**
+ * The JSON Schema of a configuration type, derived from its serial
+ * descriptor (generated at compile time, no reflection): primitive types,
+ * lists, maps, nested classes, nullable fields, fields with defaults (not
+ * required) and enums.
+ */
+object Schema {
+    fun of(descriptor: SerialDescriptor): JsonElement = of(descriptor, HashSet())
+
+    private fun of(descriptor: SerialDescriptor, visiting: MutableSet<String>): JsonElement {
+        val base = when (descriptor.serialName.removeSuffix("?")) {
+            "java.time.Instant", "kotlin.time.Instant", "java.time.LocalDateTime" -> stringFormat("date-time")
+            "java.time.LocalDate" -> stringFormat("date")
+            "java.time.LocalTime" -> stringFormat("time")
+            "java.util.UUID", "kotlin.uuid.Uuid" -> stringFormat("uuid")
+            "java.math.BigInteger" -> type("integer")
+            "java.math.BigDecimal" -> type("number")
+            "arcships.rutis.Any" -> JsonObject(emptyMap())
+            else -> structural(descriptor, visiting)
+        }
+        if (!descriptor.isNullable || base !is JsonObject || base.isEmpty()) return base
+        val kind = base["type"]
+        return if (kind is JsonPrimitive) {
+            JsonObject(base + ("type" to JsonArray(listOf(kind, JsonPrimitive("null")))))
+        } else {
+            buildJsonObject { put("anyOf", JsonArray(listOf(base, type("null")))) }
+        }
+    }
+
+    private fun type(name: String): JsonObject = buildJsonObject { put("type", name) }
+
+    private fun stringFormat(format: String): JsonObject = buildJsonObject {
+        put("type", "string")
+        put("format", format)
+    }
+
+    private fun structural(descriptor: SerialDescriptor, visiting: MutableSet<String>): JsonElement = when (descriptor.kind) {
+        PrimitiveKind.BOOLEAN -> type("boolean")
+        PrimitiveKind.BYTE, PrimitiveKind.SHORT, PrimitiveKind.INT, PrimitiveKind.LONG -> type("integer")
+        PrimitiveKind.FLOAT, PrimitiveKind.DOUBLE -> type("number")
+        PrimitiveKind.CHAR, PrimitiveKind.STRING -> type("string")
+        SerialKind.ENUM -> buildJsonObject {
+            put("type", "string")
+            put("enum", JsonArray((0 until descriptor.elementsCount).map { JsonPrimitive(descriptor.getElementName(it)) }))
+        }
+        StructureKind.LIST -> buildJsonObject {
+            put("type", "array")
+            put("items", of(descriptor.getElementDescriptor(0), visiting))
+            if (descriptor.serialName.removeSuffix("?").let { it.endsWith("HashSet") }) put("uniqueItems", true)
+        }
+        StructureKind.MAP -> buildJsonObject {
+            put("type", "object")
+            put("additionalProperties", of(descriptor.getElementDescriptor(1), visiting))
+        }
+        StructureKind.CLASS, StructureKind.OBJECT -> {
+            val name = descriptor.serialName.removeSuffix("?")
+            if (!visiting.add(name)) {
+                // A recursive type: its nested occurrences take any object.
+                type("object")
+            } else {
+                val required = ArrayList<JsonPrimitive>()
+                val properties = LinkedHashMap<String, JsonElement>()
+                for (i in 0 until descriptor.elementsCount) {
+                    val field = descriptor.getElementName(i)
+                    properties[field] = of(descriptor.getElementDescriptor(i), visiting)
+                    if (!descriptor.isElementOptional(i) && !descriptor.getElementDescriptor(i).isNullable) required.add(JsonPrimitive(field))
+                }
+                visiting.remove(name)
+                buildJsonObject {
+                    put("type", "object")
+                    put("properties", JsonObject(properties))
+                    if (required.isNotEmpty()) put("required", JsonArray(required))
+                }
+            }
+        }
+        SerialKind.CONTEXTUAL -> arcships.rutis.RutisFormat.serializersModule.getContextualDescriptor(descriptor)
+            ?.let { of(it, visiting) } ?: JsonObject(emptyMap())
+        is PolymorphicKind -> JsonObject(emptyMap())
+        else -> JsonObject(emptyMap())
+    }
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Sessions.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Sessions.kt
new file mode 100644
index 000000000..8c178bbd8
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/internal/Sessions.kt
@@ -0,0 +1,68 @@
+package arcships.rutis.internal
+
+import arcships.rutis.Plugin
+import arcships.rutis.Rutis
+import arcships.rutis.internal.peer.Channel
+import arcships.rutis.internal.peer.EVENTS_CAPABILITY
+import arcships.rutis.internal.peer.Endpoint
+import arcships.rutis.internal.peer.Options
+import arcships.rutis.internal.peer.Peer
+import arcships.rutis.internal.peer.RefusedException
+import arcships.rutis.internal.peer.SESSION_CAPABILITIES
+import kotlinx.coroutines.runBlocking
+
+/** Why a host that does not declare events-v2 is refused. */
+const val OLD_EVENTS_HOST: String =
+    "this host does not declare events-v2 (the event protocol of rutis 0.13): upgrade rutis-host to 0.13 or later"
+
+/** The state line of a refusal: `refused: incompatible (<reason>); stopping`. */
+fun refusedLine(reason: String): String = "refused: incompatible ($reason); stopping"
+
+/** One controller's session and the rows it loaded. */
+class RuntimeSession private constructor(val peer: Peer, val runtime: RuntimeState) {
+    /** Why this side refused the far end at its handshake, if it did. */
+    val refusal: String? get() = (peer.error as? RefusedException)?.reason
+
+    /**
+     * Ends the lease: nothing more is read, then every row goes, within the
+     * shutdown deadline. Returns false when cleanups were given up.
+     */
+    fun end(): Boolean {
+        peer.close(null)
+        runtime.closing = true
+        return runBlocking { runtime.dispose(Shutdown.millis()) }
+    }
+
+    companion object {
+        /** Starts serving `plugins` on `channel`: compat (no endpoint) or endpoint format. */
+        fun start(channel: Channel, endpoint: Endpoint?, plugins: List<Plugin>): RuntimeSession {
+            checkPlugins(plugins)
+            val runtime = RuntimeState(plugins)
+            val peer = Peer(
+                channel,
+                Options(
+                    dispatch = runtime::dispatch,
+                    arrive = { method, args -> EventsRuntime.arrive(runtime, method, args) },
+                    endpoint = endpoint,
+                    implementation = mapOf("name" to Rutis.IMPLEMENTATION, "version" to Rutis.VERSION),
+                    capabilities = SESSION_CAPABILITIES,
+                    // A host older than 0.13 is refused right after its handshake (#464 §2.2).
+                    require = listOf(EVENTS_CAPABILITY),
+                    refuse = { OLD_EVENTS_HOST },
+                ),
+            )
+            runtime.session = peer
+            peer.start()
+            return RuntimeSession(peer, runtime)
+        }
+
+        /** Two plugins of one name, or none, cannot be served. */
+        fun checkPlugins(plugins: List<Plugin>) {
+            if (plugins.isEmpty()) throw IllegalArgumentException("no plugins to serve")
+            val seen = HashSet<String>()
+            for (plugin in plugins) {
+                if (!seen.add(plugin.name)) throw IllegalArgumentException("two plugins are named ${plugin.name}")
+            }
+        }
+    }
+}
diff --git a/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/testing/RutisTest.kt b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/testing/RutisTest.kt
new file mode 100644
index 000000000..a5209c90e
--- /dev/null
+++ b/kotlin/rutis/rutis/src/shared/kotlin/arcships/rutis/testing/RutisTest.kt
@@ -0,0 +1,645 @@
+package arcships.rutis.testing
+
+import arcships.rutis.ClientFactory
+import arcships.rutis.EventArgs
+import arcships.rutis.Listener
+import arcships.rutis.Next
+import arcships.rutis.Plugin
+import arcships.rutis.RemoteFunction
+import arcships.rutis.RutisException
+import arcships.rutis.Scope
+import arcships.rutis.ServiceHandle
+import arcships.rutis.ServiceTable
+import arcships.rutis.Tables
+import arcships.rutis.internal.Call
+import arcships.rutis.internal.Dispatch
+import arcships.rutis.internal.Entry
+import arcships.rutis.internal.EventsRuntime
+import arcships.rutis.internal.Mode
+import arcships.rutis.internal.Native
+import arcships.rutis.internal.Queue
+import arcships.rutis.internal.Report
+import arcships.rutis.internal.RuntimeSession
+import arcships.rutis.internal.Shutdown
+import arcships.rutis.internal.checkEmit
+import arcships.rutis.internal.checkListen
+import arcships.rutis.internal.within
+import arcships.rutis.internal.peer.CallChain
+import arcships.rutis.internal.peer.Exported
+import arcships.rutis.internal.peer.MemoryChannel
+import arcships.rutis.internal.peer.Options
+import arcships.rutis.internal.peer.Peer
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import kotlinx.serialization.json.JsonNull
+import java.util.Collections
+import java.util.concurrent.TimeUnit
+
+/**
+ * Tests a plugin without a host (design K16): it gives the plugin the
+ * services it injects, calls the services it provides, emits and listens to
+ * events as a host does, and unloads it.
+ *
+ * ```kotlin
+ * RutisTest.load(weather, Config("Oslo"), services = mapOf("llm" to FakeLlm())).use { loaded ->
+ *     assertEquals("sunny", loaded.service("weather").call("today"))
+ * }
+ * ```
+ *
+ * The plugin runs in its real runtime, across a real session (in memory):
+ * values cross as they would between processes, so what works only in one
+ * process fails here too. It checks what a host would: the plugin uses only
+ * the services it injects. A service `provides` does not declare is used as
+ * rutis uses it: its methods are its class's, all `async`.
+ *
+ * Events: the test side is the host of the bus. The plugin's listeners
+ * register with it; [Loaded.emit], [Loaded.parallel], ... dispatch to them
+ * from that row's scope, as a host plugin would. [Loaded.on] listens as the
+ * host: the plugin's emissions of that name then go through the test side.
+ * More rows of the plugin load into the same runtime with [Loaded.load], each
+ * in a scope of its own.
+ */
+object RutisTest {
+    /**
+     * Loads `plugin` with `config` (a value of its config type, or null) and
+     * the services in `services` (instances of `@RutisService` classes). The
+     * first row is named `test`; [runtime] is the runtime's name in
+     * descriptors. Close the result to unload it.
+     */
+    fun load(
+        plugin: Plugin,
+        config: Any? = null,
+        services: Map<String, Any> = emptyMap(),
+        row: String? = null,
+        scope: List<Scope> = emptyList(),
+        runtime: String = "kotlin",
+    ): Loaded {
+        for (name in plugin.inject) {
+            if (name !in services) throw IllegalArgumentException("RutisTest: the plugin injects $name: give the test a service $name")
+        }
+        val harness = Harness(plugin, services, runtime)
+        harness.start()
+        return harness.load(config, row, scope)
+    }
+
+    /** A scope chain of `path` (`t1/s1`): one instance per segment, its group the segment unless `groups` says. */
+    fun scope(path: String, vararg groups: String): List<Scope> {
+        if (path.isEmpty() || path == "root") return emptyList()
+        val segments = path.split("/")
+        return segments.indices.map { i ->
+            Scope(segments.subList(0, i + 1).joinToString("/"), groups.getOrNull(i) ?: segments[i])
+        }
+    }
+}
+
+private const val WAIT_MILLIS = 30_000L
+
+/** The runtime under test and the host side of its session. */
+internal class Harness(val plugin: Plugin, private val services: Map<String, Any>, val runtime: String) {
+    lateinit var session: Peer
+    private lateinit var served: RuntimeSession
+    val lock = Object()
+    private val handles = HashMap<String, String>()
+    private val announced = HashMap<String, Map<String, String>>()
+    val rows = ArrayList<Loaded>()
+    val scopes = HashMap<String, List<Scope>>()
+    val entries = ArrayList<BusEntry>()
+    private var first = 0L
+    private var last = 0L
+    private var dispatches = 0L
+    val reported: MutableList<String> = Collections.synchronizedList(ArrayList())
+    @Volatile
+    var closed = false
+    private val pushing = Object()
+    private var declared: Map<String, Map<String, String>> = emptyMap()
+
+    fun start() {
+        Reporting.add(this)
+        val (runtimeSide, hostSide) = MemoryChannel.pair()
+        served = RuntimeSession.start(runtimeSide, null, listOf(plugin))
+        session = Peer(
+            hostSide,
+            Options(
+                host = true,
+                dispatch = ::dispatch,
+                arrive = ::arrive,
+            ),
+        )
+        session.start()
+        session.readyFuture.get(WAIT_MILLIS, TimeUnit.MILLISECONDS)
+        call("", "events.elsewhere", listOf(linkedMapOf("add" to emptyList<String>())))
+        call("", "mount", listOf(linkedMapOf("announce" to true, "runtime" to runtime)))
+        @Suppress("UNCHECKED_CAST")
+        val schema = Native.toNative(call("", "rows.schema", listOf(plugin.name))) as Map<String, Any?>
+        @Suppress("UNCHECKED_CAST")
+        declared = (schema["provides"] as? Map<String, Map<String, String>>) ?: emptyMap()
+        for (name in plugin.inject) {
+            val table = tableOf(name)
+            call("", "hosts.provide", listOf(name, table.methods.associateWith { "sync" }))
+        }
+    }
+
+    private fun tableOf(name: String): ServiceTable<Any> {
+        val service = services[name] ?: throw IllegalStateException("RutisTest: no service $name")
+        return Tables.serviceTable(service.javaClass)
+            ?: throw IllegalArgumentException("RutisTest: the service $name (${service.javaClass.name}) is not a @RutisService class")
+    }
+
+    fun call(target: String, method: String, args: List<Any?>, sync: Boolean = false): Any? =
+        runBlocking { withTimeout(WAIT_MILLIS + Shutdown.millis()) { session.callSuspend(target, method, args, sync) } }
+
+    fun load(config: Any?, row: String?, scope: List<Scope>): Loaded {
+        val key: String
+        val exports = LinkedHashMap<String, Any?>()
+        synchronized(lock) {
+            key = row ?: if (rows.isEmpty()) "test" else "test-${rows.size + 1}"
+            if (key in scopes) throw IllegalStateException("RutisTest: a row $key is already loaded")
+            if (rows.isEmpty()) for ((name, kinds) in declared) exports[name] = LinkedHashMap<String, Any?>(kinds)
+            scopes[key] = scope
+        }
+        val loaded = Loaded(this, key, scope)
+        synchronized(lock) { rows.add(loaded) }
+        val configValue = if (config == null) JsonNull else Native.fromNative(config)
+        val placed = linkedMapOf("scope" to scope.map { linkedMapOf("id" to it.id, "group" to it.group) })
+        try {
+            call("", "rows.load", listOf(key, plugin.name, configValue, emptyList<Any?>(), emptyList<Any?>(), exports, placed))
+        } catch (e: Throwable) {
+            forgetRow(key)
+            throw e
+        }
+        return loaded
+    }
+
+    /** Withdraws a row's listeners from the bus, as a host does when it unloads the row. */
+    fun forgetRow(row: String) = synchronized(lock) {
+        withdrawRow(row)
+        scopes.remove(row)
+        rows.removeAll { it.row == row }
+    }
+
+    /** Withdraws the runtime's listeners of `row`; lock is held. */
+    fun withdrawRow(row: String) {
+        entries.removeAll { entry ->
+            (entry.fn == null && entry.row == row).also { if (it) entry.withdrawn = true }
+        }
+    }
+
+    /** Puts an entry on the bus; lock is held. */
+    fun add(entry: BusEntry, prepend: Boolean) {
+        if (prepend) {
+            first--
+            entry.position = first
+            entries.add(0, entry)
+        } else {
+            last++
+            entry.position = last
+            entries.add(entry)
+        }
+    }
+
+    /** Takes the runtime's registrations in frame order (§4.1). */
+    private fun arrive(method: String, args: List<Any?>): (suspend () -> Any?)? {
+        val error: Throwable? = try {
+            when (method) {
+                "events.on" -> register(args)
+                "events.off" -> {
+                    val ids = (Native.toNative(args.firstOrNull()) as? List<*>)?.map { it as String } ?: emptyList()
+                    synchronized(lock) {
+                        entries.removeAll { entry -> (entry.fn == null && entry.id in ids).also { if (it) entry.withdrawn = true } }
+                    }
+                }
+                else -> return null
+            }
+            null
+        } catch (e: Throwable) {
+            e
+        }
+        return { if (error != null) throw error else null }
+    }
+
+    private fun register(args: List<Any?>) {
+        @Suppress("UNCHECKED_CAST")
+        val registration = Native.toNative(args.firstOrNull()) as? Map<String, Any?> ?: throw IllegalArgumentException("events.on: not a record")
+        val name = registration["name"] as String
+        if (name.startsWith("internal/")) throw RutisException(RutisException.BINDING_ERROR, "event $name is internal to its runtime")
+        val row = registration["row"] as? String ?: ""
+        synchronized(lock) {
+            if (row !in scopes) throw RutisException(RutisException.BINDING_ERROR, "row $row is not loaded in this runtime")
+            add(
+                BusEntry(this, registration["id"] as String, name, row, registration["plugin"] as? String ?: "", registration["global"] == true, null),
+                registration["prepend"] == true,
+            )
+        }
+    }
+
+    private suspend fun dispatch(target: String, method: String, args: List<Any?>): Any? {
+        if (target.isEmpty() && method == "service") {
+            val id = Native.toNative(args.getOrNull(0)) as? String ?: ""
+            val handle = Native.toNative(args.getOrNull(1)) as? String
+            @Suppress("UNCHECKED_CAST")
+            val announcement = Native.toNative(args.getOrNull(3)) as? Map<String, Any?>
+            synchronized(lock) {
+                if (handle == null) {
+                    handles.remove(id)
+                } else {
+                    handles[id] = handle
+                    @Suppress("UNCHECKED_CAST")
+                    (announcement?.get("methods") as? Map<String, String>)?.let { announced[id] = it }
+                }
+                lock.notifyAll()
+            }
+            return null
+        }
+        if (target.isEmpty() && method == "events.dispatch") return dispatchFromRuntime(args)
+        val name = target.removePrefix("host:")
+        if (name == target) throw IllegalArgumentException("the test serves no $target $method")
+        val service = services[name] ?: throw IllegalArgumentException("the test gives no service $name")
+        val table = tableOf(name)
+        if (method !in table.methods) throw IllegalArgumentException("the test's $name has no method $method")
+        return table.invoke(service, method, args)
+    }
+
+    /** The service `name` the plugin provides: its handle and methods, once provided. */
+    fun provided(name: String): Pair<String, Map<String, String>> {
+        val deadline = System.currentTimeMillis() + WAIT_MILLIS
+        synchronized(lock) {
+            while (true) {
+                val handle = handles[name]
+                if (handle != null) return handle to (declared[name] ?: announced[name] ?: emptyMap())
+                val left = deadline - System.currentTimeMillis()
+                if (left <= 0) throw IllegalStateException("RutisTest: the plugin does not provide $name (now)")
+                lock.wait(left)
+            }
+        }
+    }
+
+    fun providedNames(): List<String> = synchronized(lock) { handles.keys.toList() }
+
+    /** A dispatch of `name` emitted in `scope` (§5.1). */
+    fun snapshot(name: String, scope: List<Scope>, own: Boolean, keep: (suspend (Listener) -> Boolean)?): Dispatch = synchronized(lock) {
+        dispatches++
+        val id = "d$dispatches"
+        val selected = entries.filter { it.name == name && within(if (it.fn != null) emptyList() else scopes[it.row] ?: emptyList(), scope) }
+            .map { Invocation(it, id, own && it.fn == null) }
+        Dispatch(name, selected, keep)
+    }
+
+    /** Serves the runtime's `events.dispatch` (§5.3). */
+    private suspend fun dispatchFromRuntime(args: List<Any?>): Any? {
+        @Suppress("UNCHECKED_CAST")
+        val record = (args.firstOrNull() as? Map<String, Any?>) ?: (args.firstOrNull() as? kotlinx.serialization.json.JsonObject)
+            ?: throw IllegalArgumentException("events.dispatch needs a record")
+        val row = Native.toNative(record["row"]) as? String ?: ""
+        val name = Native.toNative(record["name"]) as? String ?: ""
+        val mode = (Native.toNative(record["mode"]) as? String)?.let(Mode::of)
+        if (mode == null || mode == Mode.WaterfallSync) throw IllegalArgumentException("events.dispatch: unknown mode ${record["mode"]}")
+        val values: List<Any?> = when (val list = record["args"]) {
+            is List<*> -> list
+            is kotlinx.serialization.json.JsonArray -> list
+            else -> emptyList()
+        }
+        checkEmit(name)
+        val scope = synchronized(lock) { scopes[row] } ?: throw RutisException(RutisException.BINDING_ERROR, "row $row is not loaded in this runtime")
+        var d = snapshot(name, scope, true, null)
+        val filter = record["filter"] as? RemoteFunction
+        if (filter != null) {
+            // One call of the emitter's selector, with every candidate the
+            // filter applies to (§6).
+            val infos = d.entries.map { it.info() }.filter { !it.global }
+            val answers = try {
+                val answer = session.callFunctionSuspend(filter, listOf(infos.map { EventsRuntime.data(it) }), mode == Mode.Bail)
+                val list = Native.toNative(answer) as? List<*>
+                if (list == null || list.size != infos.size || list.any { it !is Boolean }) {
+                    throw RutisException(RutisException.BINDING_ERROR, "filter of $name returned ${list?.size ?: 0} answers for ${infos.size} listeners")
+                }
+                list.map { it as Boolean }
+            } catch (e: Throwable) {
+                if (mode == Mode.Emit) {
+                    Report.line("rutis: filter of $name from row $row failed: ${Report.failure(e)}")
+                    return null
+                }
+                throw e
+            }
+            var asked = 0
+            d = Dispatch(name, d.entries) { answers[asked++] }
+        }
+        val terminal = record["terminal"] as? RemoteFunction
+        val last: (suspend (List<Any?>) -> Any?)? = terminal?.let { t -> { raw -> session.settleSuspend(session.callFunctionSuspend(t, raw, false)) } }
+        return run(d, mode, values, last)
+    }
+
+    suspend fun run(d: Dispatch, mode: Mode, args: List<Any?>, terminal: (suspend (List<Any?>) -> Any?)?): Any? = when (mode) {
+        Mode.Emit -> {
+            d.emit(args)
+            null
+        }
+        Mode.Parallel -> {
+            d.parallel(args)
+            null
+        }
+        Mode.Waterfall, Mode.WaterfallSync -> d.waterfall(mode, args, terminal)
+        else -> d.serial(mode, args)
+    }
+
+    /** Tells the runtime of a change of the names with listeners outside it, and waits until it applied it. */
+    fun elsewhere(change: Map<String, Any?>) {
+        if (closed) return
+        call("", "events.elsewhere", listOf(change))
+    }
+
+    fun hasTestListener(name: String): Boolean = entries.any { it.fn != null && it.name == name }
+
+    fun listen(name: String, prepend: Boolean, global: Boolean, fn: suspend (EventArgs) -> Any?): () -> Unit {
+        checkListen(name)
+        val entry = BusEntry(this, "", name, "", "rutistest", global, fn)
+        synchronized(pushing) {
+            val first = synchronized(lock) {
+                val first = !hasTestListener(name)
+                add(entry, prepend)
+                first
+            }
+            if (first) elsewhere(linkedMapOf("add" to listOf(name)))
+        }
+        var done = false
+        return {
+            synchronized(pushing) {
+                if (!done) {
+                    done = true
+                    val last = synchronized(lock) {
+                        entry.withdrawn = true
+                        entries.remove(entry)
+                        !hasTestListener(name)
+                    }
+                    if (last) elsewhere(linkedMapOf("remove" to listOf(name)))
+                }
+            }
+        }
+    }
+
+    fun close() {
+        val all = synchronized(lock) { rows.toList() }
+        for (row in all.asReversed()) row.unload()
+        closed = true
+        Reporting.remove(this)
+        session.shutdown("the test ended")
+        served.peer.closedFuture.get(WAIT_MILLIS, TimeUnit.MILLISECONDS)
+        if (!served.end()) throw IllegalStateException("RutisTest: the runtime's cleanups did not finish")
+    }
+}
+
+/** Collects the lines the runtime reports (§5.6) for every harness. */
+private object Reporting {
+    private val harnesses = Collections.synchronizedSet(HashSet<Harness>())
+
+    @Volatile
+    private var hooked = false
+
+    fun add(harness: Harness) {
+        synchronized(this) {
+            if (!hooked) {
+                hooked = true
+                var previous: (String) -> Unit = {}
+                previous = Report.replace { line ->
+                    synchronized(harnesses) { for (h in harnesses) h.reported.add(line) }
+                    previous(line)
+                }
+            }
+        }
+        harnesses.add(harness)
+    }
+
+    fun remove(harness: Harness) {
+        harnesses.remove(harness)
+    }
+}
+
+/** A listener on the test side's bus: one of the runtime's (by its id) or one of the test's (fn). */
+internal class BusEntry(
+    val h: Harness,
+    val id: String,
+    val name: String,
+    val row: String,
+    val plugin: String,
+    val global: Boolean,
+    val fn: (suspend (EventArgs) -> Any?)?,
+) {
+    var position = 0L
+
+    @Volatile
+    var withdrawn = false
+    val queue = Queue("test-listener")
+
+    fun info(): Listener = if (fn != null) {
+        Listener(name = name, plugin = "rutistest", global = global)
+    } else {
+        // A copy: a filter changing it changes nothing else.
+        val scope = synchronized(h.lock) { h.scopes[row]?.toList() ?: emptyList() }
+        Listener(name = name, plugin = plugin, row = row, runtime = h.runtime, scope = scope, global = global)
+    }
+}
+
+/** An entry within one dispatch. */
+private class Invocation(val entry: BusEntry, val dispatch: String, val own: Boolean) : Entry {
+    private val h = entry.h
+
+    override fun info(): Listener = entry.info()
+
+    override fun begin(): Call? {
+        if (entry.withdrawn) return null
+        return { mode, args, next -> call(mode, args, next) }
+    }
+
+    private suspend fun call(mode: Mode, args: List<Any?>, next: Next?): Any? {
+        val fn = entry.fn ?: return h.session.settleSuspend(
+            h.session.callSuspend("", "events.call", listOf(record(mode, args, next)), mode == Mode.Bail || mode == Mode.WaterfallSync),
+        )
+        return local(fn, mode, args, next)
+    }
+
+    /** Runs one of the test's listeners: session values in and out. */
+    private suspend fun local(fn: suspend (EventArgs) -> Any?, mode: Mode, args: List<Any?>, next: Next?): Any? {
+        val native: Next? = if (mode.waterfall && next != null) ({ Native.toNative(next()) }) else null
+        return Native.fromNative(fn(EventArgs.of(args, native)))
+    }
+
+    /** An `events.call` (§5.3). */
+    private fun record(mode: Mode, args: List<Any?>, next: Next?): Map<String, Any?> {
+        val record = linkedMapOf<String, Any?>(
+            "listener" to entry.id, "dispatch" to dispatch, "own" to own, "name" to entry.name, "mode" to mode.wire, "args" to args,
+        )
+        if (next != null) record["next"] = Exported(next) { next() }
+        return record
+    }
+
+    override fun emit(args: List<Any?>): Boolean {
+        if (entry.withdrawn) return false
+        val fn = entry.fn
+        if (fn != null) {
+            val chain = CallChain.current()
+            entry.queue.push {
+                if (!entry.withdrawn) {
+                    try {
+                        runBlocking(CallChain.element(chain)) { local(fn, Mode.Emit, args, null) }
+                    } catch (e: Throwable) {
+                        Report.line("rutis: listener of ${entry.name} in row rutistest failed: ${Report.failure(e)}")
+                    }
+                }
+            }
+            return true
+        }
+        // Sent now, in order: the runtime starts them in arrival order.
+        val report = { e: Throwable -> Report.line("rutis: listener of ${entry.name} in runtime ${h.runtime} failed: ${Report.failure(e)}") }
+        val wait = try {
+            h.session.send("", "events.call", listOf(record(Mode.Emit, args, null)), false)
+        } catch (e: Throwable) {
+            report(e)
+            return true
+        }
+        Thread({
+            try {
+                runBlocking { wait() }
+            } catch (e: Throwable) {
+                report(e)
+            }
+        }, "rutistest-emit").apply { isDaemon = true }.start()
+        return true
+    }
+}
+
+/** A row of a plugin loaded for a test. Close it (or the first row) to unload. */
+class Loaded internal constructor(private val h: Harness, val row: String, val scope: List<Scope>) : AutoCloseable, arcships.rutis.Emitter {
+    @Volatile
+    private var unloaded = false
+
+    /** Loads another row of the same plugin into the same runtime, in `scope`. */
+    fun load(config: Any? = null, row: String? = null, scope: List<Scope> = emptyList()): Loaded = h.load(config, row, scope)
+
+    /** The services the plugin provides now. */
+    val provided: List<String> get() = h.providedNames()
+
+    /**
+     * The service `name` the plugin provides, as rutis sees it: its declared
+     * methods, or, undeclared, its class's, all `async`.
+     */
+    fun service(name: String): TestService {
+        val (handle, kinds) = h.provided(name)
+        return TestService(h.session, name, handle, kinds)
+    }
+
+    /**
+     * Listens to `name` as the host does, until the returned function is
+     * called or the test ends: the plugin's emissions of `name` reach
+     * `listener` (through the test side, as through rutis), and so do the
+     * test's own. The listener is at the root scope.
+     */
+    fun on(name: String, prepend: Boolean = false, global: Boolean = false, listener: suspend (EventArgs) -> Any?): () -> Unit =
+        h.listen(name, prepend, global, listener)
+
+    /** Dispatches only to the listeners `keep` accepts. */
+    fun filter(keep: suspend (Listener) -> Boolean): arcships.rutis.Emitter = Filtered(keep)
+
+    override fun emit(name: String, vararg args: Any?) {
+        runBlocking { dispatch(name, Mode.Emit, args.toList(), null, null) }
+    }
+
+    override suspend fun parallel(name: String, vararg args: Any?) {
+        dispatch(name, Mode.Parallel, args.toList(), null, null)
+    }
+
+    override suspend fun serial(name: String, vararg args: Any?): Any? = dispatch(name, Mode.Serial, args.toList(), null, null)
+
+    override suspend fun waterfall(name: String, vararg args: Any?, terminal: (suspend (EventArgs) -> Any?)?): Any? =
+        dispatch(name, Mode.Waterfall, args.toList(), terminal, null)
+
+    override fun bail(name: String, vararg args: Any?): Any? = runBlocking { dispatch(name, Mode.Bail, args.toList(), null, null) }
+
+    private inner class Filtered(private val keep: suspend (Listener) -> Boolean) : arcships.rutis.Emitter {
+        override fun emit(name: String, vararg args: Any?) {
+            runBlocking { dispatch(name, Mode.Emit, args.toList(), null, keep) }
+        }
+
+        override suspend fun parallel(name: String, vararg args: Any?) {
+            dispatch(name, Mode.Parallel, args.toList(), null, keep)
+        }
+
+        override suspend fun serial(name: String, vararg args: Any?): Any? = dispatch(name, Mode.Serial, args.toList(), null, keep)
+
+        override suspend fun waterfall(name: String, vararg args: Any?, terminal: (suspend (EventArgs) -> Any?)?): Any? =
+            dispatch(name, Mode.Waterfall, args.toList(), terminal, keep)
+
+        override fun bail(name: String, vararg args: Any?): Any? = runBlocking { dispatch(name, Mode.Bail, args.toList(), null, keep) }
+    }
+
+    private suspend fun dispatch(name: String, mode: Mode, args: List<Any?>, terminal: (suspend (EventArgs) -> Any?)?, keep: (suspend (Listener) -> Boolean)?): Any? {
+        checkEmit(name)
+        val values = args.map(Native::fromNative)
+        val d = h.snapshot(name, scope, false, keep)
+        val last: (suspend (List<Any?>) -> Any?)? = terminal?.let { t -> { raw -> Native.fromNative(t(EventArgs.of(raw, null))) } }
+        return Native.toNative(h.run(d, mode, values, last))
+    }
+
+    /** What the runtime reported so far (§5.6), one line per failure nobody waited for. */
+    fun reported(): List<String> = synchronized(h.reported) { h.reported.toList() }
+
+    /**
+     * Unloads the row: the runtime cancels its running listeners and waits
+     * for them (up to RUTIS_SHUTDOWN_TIMEOUT), then runs its cleanups.
+     */
+    fun unload() {
+        if (unloaded) return
+        unloaded = true
+        // The host withdraws the row's listeners as it unloads it (§7.1).
+        h.forgetRow(row)
+        if (h.closed) return
+        h.call("", "rows.unload", listOf(row))
+    }
+
+    /**
+     * Changes the row's config, as a host's rows.update: the runtime unloads
+     * the row and loads it again, so its listeners register again.
+     */
+    fun update(config: Any?) {
+        synchronized(h.lock) {
+            if (row !in h.scopes || h.closed) throw IllegalStateException("RutisTest: row $row is not loaded")
+            h.withdrawRow(row)
+        }
+        h.call("", "rows.update", listOf(row, if (config == null) JsonNull else Native.fromNative(config)))
+    }
+
+    /** Unloads every row, latest first, and ends the runtime (the first row's close), or this row. */
+    override fun close() {
+        if (h.rows.firstOrNull() === this || h.rows.isEmpty()) h.close() else unload()
+    }
+}
+
+/** A provided service, called across the session. */
+class TestService internal constructor(
+    private val session: Peer,
+    val name: String,
+    private val handle: String,
+    /** The service's methods, each `sync` or `async`. */
+    val methods: Map<String, String>,
+) {
+    /** Calls `method` with native values; the result as a native value. */
+    suspend fun call(method: String, vararg args: Any?): Any? = Native.toNative(raw(method, args.map(Native::fromNative)))
+
+    /** Calls `method` with session values; the result as a session value (for the conformance checks). */
+    suspend fun raw(method: String, args: List<Any?>): Any? {
+        val kind = methods[method] ?: throw IllegalArgumentException("$name has no method $method")
+        return session.settleSuspend(session.callSuspend(handle, method, args, kind == "sync"))
+    }
+
+    /** The service through the `@RutisClient` interface `I`. */
+    inline fun <reified I : Any> bind(): I = bind(I::class.java)
+
+    fun <I : Any> bind(type: Class<I>): I {
+        val factory: ClientFactory<I> = Tables.clientFactory(type) ?: throw IllegalArgumentException("${type.name} has no proxy: annotate it @RutisClient")
+        val service = this
+        return factory.create(object : ServiceHandle {
+            override val name: String = service.name
+            override val kinds: Map<String, String> = methods
+            override suspend fun callSuspend(method: String, args: List<Any?>): Any? = raw(method, args)
+            override fun callBlocking(method: String, args: List<Any?>): Any? = runBlocking { raw(method, args) }
+        })
+    }
+}