@@ -2,17 +2,17 @@
 
 ## Status
 
-Accepted (2026-09-01). The decision was replaced on 2026-10-10. The in-process Host allocator integration is withdrawn.
-Simlock closed [simlock#70](https://github.com/callstackincubator/simlock/issues/70) in favor of direct device leases by agents.
-agent-device follows that design.
+Accepted (2026-10-10).
+
+Decision history: on 2026-10-10 this replaced an earlier in-process allocator design. Simlock closed [simlock#70](https://github.com/callstackincubator/simlock/issues/70) in favor of direct device leases by agents, and agent-device follows that design. To recover the earlier design, read the git history before that date: #2284, #2308 and #2312.
 
 ## Rules at a glance
 
 - Agents acquire booted devices from Simlock through `simlock lease`, the Simlock MCP tool, or the Simlock HTTP API.
   Agents own renewal and release. agent-device does not call Simlock.
 - Simlock owns allocation, capacity, provisioning, readiness, expiry, and device deletion.
 - agent-device uses the ordinary local runtime, sessions, and process-owned device claims for a leased device.
-  It has no managed runtime owner, allocator client, allocation journal, managed binding fence, or Host lease mapping.
+  It has no managed runtime owner, allocator client, allocation journal, or managed binding fence.
 - For iOS, pass the grant's `SIMLOCK_IOS_DEVICE_SET` as `--ios-simulator-device-set` or the `iosSimulatorDeviceSet` config key.
   Discovery, `simctl`, and the XCTest runner resolve the leased simulator inside Simlock's set.
 - For Android, the grant's `ANDROID_ADB_SERVER_PORT` selects Simlock's adb server.
@@ -26,16 +26,7 @@ Its simulators reside in a device set that Xcode does not read, and its emulator
 A grant reports device access requirements in an `environment` object with `SIMLOCK_IOS_DEVICE_SET` and `ANDROID_ADB_SERVER_PORT`.
 `simlock lease --export-env` prints this object for `eval`.
 
-The first design proposed a Host inside agent-device with these responsibilities:
-
-- Allocate through Simlock's typed client.
-- Journal allocation requests.
-- Fence each command with confirmed lease authority.
-- Use a dedicated runtime owner for managed devices.
-
-agent-device shipped these foundations but never activated them.
-Simlock then selected direct device leases by agents.
-This design needs nothing from agent-device beyond the ability to address a device in Simlock's roots.
+Direct leases need nothing from agent-device beyond the ability to address a device in Simlock's roots.
 agent-device already supported simulator-set scope and adb's server-port environment.
 
 ## 2. Decision
@@ -76,13 +67,6 @@ agent-device does not verify that a device is leased.
   Therefore, the caller points that executor at Simlock's server.
   Per-call `AndroidAdbExecutorOptions.serverPort` takes effect only if the executor honors it.
 
-## 4. Withdrawn design
-
-The replaced design required these components:
-
-- A durable allocation journal reconciled through Simlock after crashes.
-- Fenced lease admission with renewal across each command deadline and teardown.
-- A managed runtime owner that delegates to the local family.
-- Allocator-held device claims with an installation principal instead of a process principal.
+## 4. Rejected alternative
 
-If an in-process allocator returns, recover that design from git history: the ADR text before 2026-10-10, #2284, #2308, and #2312.
+- **An allocator inside agent-device** would allocate devices through Simlock's typed client, keep a journal of allocation requests, and fence each command with confirmed lease authority. We rejected it because Simlock owns allocation and agents lease devices directly, so an internal allocator would duplicate Simlock's state.
@@ -7,7 +7,7 @@ Each candidate has a `move`, `merge`, or `keep` decision with rationale.
 Moves use `refactor(move)` PRs.
 Git history retains completed move batches.
 
-The allocator design withdrawal removed `packages/managed-allocation` on 2026-10-10; see [ADR 0021](0021-host-simlock-managed-device-allocation.md).
+The allocator design withdrawal removed `packages/managed-allocation` on 2026-10-10; see [ADR 0021](0021-simlock-leased-devices.md).
 The `src/managed-device-allocation.ts` row and Batch 1 record a move that landed in #3287.
 The removal of the package then deleted the moved file.
 Nothing moves there now.
@@ -63,7 +63,7 @@ All its consumers occupy one zone that already owns the operations represented b
 | `src/device-boot.ts` | keep | Device-selection, platforms, and daemon-server consume this boot-phase vocabulary. |
 | `src/facades/device.ts` | keep | This is the published facade of the contracts package. Facades are the package boundary, not movable content. |
 | `src/interaction-guarantees.ts` | keep | AGENTS.md names this declaration site for interaction dispatch paths and guarantee cells under ADR 0011. Cross-language golden tables in `contracts/fixtures/` bind it to this package. |
-| `src/managed-device-allocation.ts` | move (batch 1, landed in #3287; package removed 2026-10-10) → `packages/managed-allocation` | Only managed-allocation and its dependent daemon composition consume this port and vocabulary; see [ADR 0021](0021-host-simlock-managed-device-allocation.md) §4, the withdrawn design. No other contracts file or zone imports it. Types therefore belong beside their implementing operations. |
+| `src/managed-device-allocation.ts` | move (batch 1, landed in #3287; package removed 2026-10-10) → `packages/managed-allocation` | Only managed-allocation and its dependent daemon composition consume this port and vocabulary; see [ADR 0021](0021-simlock-leased-devices.md) §4, the withdrawn design. No other contracts file or zone imports it. Types therefore belong beside their implementing operations. |
 | `src/wait-runtime-plan.ts` | keep | Command-registry and daemon-server share it. Both are spine zones; contracts is the only seam below them. |
 
 ### device-selection
 
@@ -60,8 +60,8 @@ had to fake the store to load a plugin from its own dependencies (#3747).
 
 The target is that starting or replacing a daemon is an explicit act, not a side effect of a client
 call. Today a client call can still start a daemon; #3754 makes that explicit for the client
-lifecycle, and #3757 adds `agent-device/host`, where an embedder owns its daemon and passes its
-plugins as the third source.
+lifecycle, and #3757 adds `startAgentDevice` to the `agent-device` entry, where an embedder owns
+its daemon and passes its plugins as the third source.
 
 ## Alternatives refused
 
 
@@ -22,7 +22,7 @@
 | [0018 Unified Request Event Journal (Proposed)](0018-unified-event-journal.md) | event/diagnostic vocabulary, journal scopes and sinks, progress-channel separation, observability-only state |
 | [0019 Request-Bound Platform Runtime](0019-request-bound-platform-runtime.md) | platform-package boundaries/composition, device discovery, runtime facts/facets, request binding, provider ownership, platform-shaped session resources, durable reattachment, daemon-handler migration |
 | [0020 Composable Recorded Fragments (Proposed)](0020-composable-recorded-fragments.md) | lifecycle-free recorded fragment capture/composition, entry guards, fragment-local addresses/digests, staleness, and native `.ad`/Maestro composition |
-| [0021 Simlock-Leased Devices Through Ordinary Local Runtimes](0021-host-simlock-managed-device-allocation.md) | operation of a Simlock-leased simulator or emulator, the reason for no agent-device allocator integration, and the withdrawn in-process Host design |
+| [0021 Simlock-Leased Devices Through Ordinary Local Runtimes](0021-simlock-leased-devices.md) | operation of a Simlock-leased simulator or emulator, and the reason for no agent-device allocator integration |
 | [0022 Daemon — Platform Runtime Coupling Audit and Ownership Ratchets](0022-daemon-platform-runtime-coupling.md) | daemon imports of root `platform-runtime-*` modules, the coupling ban that replaces R76 edge classification, the R75 session-authority ratchet, entry-to-platform hop routes and roles |
 | [0023 End-State Entry-to-Platform Hop Trace](0023-end-state-hop-trace.md) | the definition of hop counts, ordered `press`/Android and dual-arm `snapshot`/iOS chains, per-hop roles, and the deletion test for numbers in ADR 0019 and ADR 0022 |
 | [0024 Screen Recording — One Coordinator, Two Facts (Proposed)](0024-screen-recording-provable-signal.md) | `record start`/`stop` lifecycle, separate export-exists / recorder-stopped facts, backend stop-and-collect contract, coordinator recovery, the ADR 0019 §5 amendment, and the failed-finish cleanup fix |