@plurnk/plurnk-agui 1.0.4 → 1.0.6

package/dist/Module.js

@@ -3,13 +3,13 @@
 // the AG-UI+ HTTP/SSE listener and owns the client interface from there.
 //
 // This is the SINGLE-INTERFACE surface (AG-UI+), not the legacy bridge dialect:
-//   POST /  — the only endpoint. A run streams SSE. HITL is terminate-resume: a
-//   stopped-world emits a request_approval/request_user_input TOOL_CALL and the run
-//   FINISHES (the loop stays paused in-engine); the resume arrives as the next run's
+//   POST /  — the only endpoint. A worker streams SSE. HITL is terminate-resume: a
+//   stopped-world emits a request_approval/request_user_input TOOL_CALL and the worker
+//   FINISHES (the loop stays paused in-engine); the resume arrives as the next worker's
 //   tool-result message → resolveProposal → the continued loop streams there.
 //   Reads ride STATE_SNAPSHOT on RUN_STARTED; no /plurnk/rpc, no /resolve.
-// An AG-UI threadId IS a plurnk session (`<prefix>-<threadId>`); the envelope's
-// modelRunId binds the thread (no lazy inference — createSession returns it).
+// An AG-UI threadId IS a plurnk workspace (`<prefix>-<threadId>`); the envelope's
+// modelWorkerId binds the thread (no lazy inference — createWorkspace returns it).
 var _a;
 import { createServer } from "node:http";
 import Portal from "./Portal.js";
@@ -22,15 +22,15 @@ class Module {
     #portal;
     #http;
     #threads = new Map(); // threadId → envelope
-    #threadRuns = new Map(); // threadId → conversation runId
+    #threadRuns = new Map(); // threadId → conversation workerId
     // The control plane vs the world. A RUN lives in a world (a conversation, or an action
-    // that reads/writes a session's log); a control-plane action (list/create/attach/discover/
-    // auth) does NOT — so it must not bind or forge a session (operator ruling 2026-07-10:
-    // "every run/thread requires a world, not everything"). Only these kinds bind a session.
+    // that reads/writes a workspace's log); a control-plane action (list/create/attach/discover/
+    // auth) does NOT — so it must not bind or forge a workspace (operator ruling 2026-07-10:
+    // "every worker/thread requires a world, not everything"). Only these kinds bind a workspace.
     static #WORLD_SCOPED = Object.freeze(new Set([
-        "session.runs", "log.read", "loop.inject", "loop.cancel", "session.prompts", "session.rename",
-        "session.constrain", "session.unconstrain", "session.constraints", "entry.read",
-        "op.exec", "op.parse", "session.members", "op.look", "run.fork",
+        "workspace.workers", "log.read", "loop.inject", "loop.cancel", "workspace.prompts", "workspace.rename",
+        "workspace.constrain", "workspace.unconstrain", "workspace.constraints", "entry.read",
+        "op.exec", "op.parse", "workspace.members", "op.look", "run.fork",
     ]));
     constructor(seam, opts) {
         this.#seam = seam;
@@ -84,37 +84,45 @@ class Module {
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
-            if (!res.headersSent)
+            if (!res.headersSent) {
                 res.writeHead(500, { "content-type": "application/json" });
-            res.end(JSON.stringify({ error: message }));
+                res.end(JSON.stringify({ error: message }));
+                return;
+            }
+            // Post-headers throw (svc#480): the SSE is already open, so a JSON body is
+            // invisible to the event parser — the stream reads as a silent death. Emit a
+            // legible terminal RUN_ERROR frame instead (501 for the no-model case), then end.
+            const code = /no provider configured|no model|unknown alias/i.test(message) ? "501" : "500";
+            res.write(`data: ${JSON.stringify({ type: "RUN_ERROR", message, code })}\n\n`);
+            res.end();
         }
     }
     // THE PLURNK PARADIGM (operator ruling 2026-07-10): the name IS the identity,
     // verbatim. The SESSION is the WORLD (service SPEC, machine-processes) — selected by name via
-    // `forwardedProps.plurnk.session`; attach it if it exists, create it with EXACTLY that
-    // name if it doesn't. No prefixes, no forged names, no dual lookup. The session is
-    // REQUIRED: a run has no existence without a world, so its absence is a contract
+    // `forwardedProps.plurnk.workspace`; attach it if it exists, create it with EXACTLY that
+    // name if it doesn't. No prefixes, no forged names, no dual lookup. The workspace is
+    // REQUIRED: a worker has no existence without a world, so its absence is a contract
     // violation the client must fix — never a workspace forged from the threadId.
-    // The threadId is the CONVERSATION over that world — resolved to a run by
-    // #conversationRun (svc#366 landed: the three doors are ensureModelRun, forkRun,
-    // createConversationRun).
+    // The threadId is the CONVERSATION over that world — resolved to a worker by
+    // #conversationRun (svc#366 landed: the three doors are ensureModelWorker, forkWorker,
+    // createConversationWorker).
     async #envelope(threadId, forwarded) {
-        const workspace = forwarded?.session;
+        const workspace = forwarded?.workspace;
         if (typeof workspace !== "string" || workspace.length === 0)
-            throw new Error("forwardedProps.plurnk.session (a session name) is required");
+            throw new Error("forwardedProps.plurnk.workspace (a workspace name) is required");
         const cached = this.#threads.get(threadId);
         if (cached !== undefined)
             return { env: cached, reattached: true };
-        const known = (await this.#seam.listSessions()).find((s) => s.name === workspace);
+        const known = (await this.#seam.listWorkspaces()).find((s) => s.name === workspace);
         let env;
         let reattached = false;
         if (known !== undefined) {
-            env = await this.#seam.attachSession({ sessionId: known.id });
+            env = await this.#seam.attachWorkspace({ workspaceId: known.id });
             reattached = true;
         }
         else {
             const opts = forwarded ?? {};
-            env = await this.#seam.createSession({
+            env = await this.#seam.createWorkspace({
                 name: workspace,
                 ...(typeof opts.projectRoot === "string" ? { projectRoot: opts.projectRoot } : {}),
                 ...(Array.isArray(opts.constraints) ? { constraints: opts.constraints } : {}),
@@ -124,18 +132,18 @@ class Module {
         this.#threads.set(threadId, env);
         return { env, reattached };
     }
-    // Resolve the thread's conversation run within its world. Cached per threadId;
-    // run names are immutable so the binding can't rot.
+    // Resolve the thread's conversation worker within its world. Cached per threadId;
+    // worker names are immutable so the binding can't rot.
     async #conversationRun(threadId, env) {
         const cached = this.#threadRuns.get(threadId);
         if (cached !== undefined)
             return cached;
-        const runId = threadId === env.sessionName
-            ? await this.#seam.ensureModelRun(env.sessionId)
-            : (await this.#seam.listRuns(env.sessionId)).find((r) => r.name === threadId)?.id
-                ?? (await this.#seam.createConversationRun({ sessionId: env.sessionId, name: threadId })).runId;
-        this.#threadRuns.set(threadId, runId);
-        return runId;
+        const workerId = threadId === env.workspaceName
+            ? await this.#seam.ensureModelWorker(env.workspaceId)
+            : (await this.#seam.listWorkers(env.workspaceId)).find((r) => r.name === threadId)?.id
+                ?? (await this.#seam.createConversationWorker({ workspaceId: env.workspaceId, name: threadId })).workerId;
+        this.#threadRuns.set(threadId, workerId);
+        return workerId;
     }
     async #run(req, res) {
         const input = JSON.parse(await _a.#body(req));
@@ -143,18 +151,18 @@ class Module {
             throw new Error("RunAgentInput.threadId required");
         const forwarded = input.forwardedProps?.plurnk;
         // Control plane FIRST: a management action that doesn't live in a world (and an
-        // unknown kind, which is no run at all) answers without binding — or forging — a
-        // session. Only world-scoped actions and conversations reach #envelope below.
+        // unknown kind, which is no worker at all) answers without binding — or forging — a
+        // workspace. Only world-scoped actions and conversations reach #envelope below.
         const early = parseAction(input.forwardedProps);
         if (early !== null && !_a.#WORLD_SCOPED.has(early.kind))
             return await this.#controlRun(early, input, res);
         const { env, reattached } = await this.#envelope(input.threadId, forwarded);
-        const sessionId = env.sessionId;
-        // THREAD ↔ RUN (svc#366): the threadId is the CONVERSATION — a run over the
-        // world. threadId == session name binds the model run (the default conversation);
-        // a distinct threadId names its own run: found by name, else minted via
-        // createConversationRun. The name is the identity at BOTH levels.
-        const runId = await this.#conversationRun(input.threadId, env);
+        const workspaceId = env.workspaceId;
+        // THREAD ↔ RUN (svc#366): the threadId is the CONVERSATION — a worker over the
+        // world. threadId == workspace name binds the model worker (the default conversation);
+        // a distinct threadId names its own worker: found by name, else minted via
+        // createConversationWorker. The name is the identity at BOTH levels.
+        const workerId = await this.#conversationRun(input.threadId, env);
         res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", "connection": "keep-alive" });
         let finished = false;
         let pausedOnProposal = false;
@@ -170,7 +178,7 @@ class Module {
             finished = true;
             if (heartbeat !== null)
                 clearInterval(heartbeat);
-            this.#portal.closeRun(sessionId, boundRun);
+            this.#portal.closeRun(workspaceId, boundRun);
             res.end();
         };
         const emit = (events) => {
@@ -188,74 +196,90 @@ class Module {
                 finish();
             }
         };
-        const boundRun = this.#portal.openThread({ sessionId, runId, threadId: input.threadId, emit, modelRunId: runId, inputRunId: input.runId });
+        const boundRun = this.#portal.openThread({ workspaceId, workerId, threadId: input.threadId, emit, modelWorkerId: workerId, inputRunId: input.runId });
         emit([
             { type: "RUN_STARTED", threadId: input.threadId, runId: input.runId },
-            stateSnapshot({ providers: this.#seam.listProviders().aliases, session: { id: sessionId, name: env.sessionName, projectRoot: env.projectRoot } }),
+            stateSnapshot({ providers: this.#seam.listProviders().aliases, workspace: { id: workspaceId, name: env.workspaceName, projectRoot: env.projectRoot } }),
         ]);
         if (finished)
             return;
-        // §3 — a management ACTION run (forwardedProps.plurnk.action): execute via the
-        // seam; the outcome rides the session's CURRENT thread binding (Portal.finishRun),
-        // never this closure — a proposal-gated action (op.exec → 202) terminates THIS
-        // run and completes after the resume run rebinds the stream.
-        const action = parseAction(input.forwardedProps);
-        if (action !== null) {
-            const finishAction = (outcome) => {
-                const events = [actionResult(action.kind, outcome)];
-                // Plain action (stream still open): answer on OUR OWN stream — concurrent
-                // actions share a session, and the session binding is whoever bound last
-                // (results would cross streams). Only a proposal-pause (this stream already
-                // terminated) hands off to the session binding, which the resume run rebinds.
-                if (!finished) {
-                    emit([...events, { type: "RUN_FINISHED", threadId: input.threadId, runId: input.runId }]);
+        try {
+            // §3 — a management ACTION run (forwardedProps.plurnk.action): execute via the
+            // seam; the outcome rides the workspace's CURRENT thread binding (Portal.finishRun),
+            // never this closure — a proposal-gated action (op.exec → 202) terminates THIS
+            // run and completes after the resume run rebinds the stream.
+            const action = parseAction(input.forwardedProps);
+            if (action !== null) {
+                const finishAction = (outcome) => {
+                    const events = [actionResult(action.kind, outcome)];
+                    // Plain action (stream still open): answer on OUR OWN stream — concurrent
+                    // actions share a workspace, and the workspace binding is whoever bound last
+                    // (results would cross streams). Only a proposal-pause (this stream already
+                    // terminated) hands off to the workspace binding, which the resume run rebinds.
+                    if (!finished) {
+                        emit([...events, { type: "RUN_FINISHED", threadId: input.threadId, runId: input.runId }]);
+                        return;
+                    }
+                    this.#portal.finishRun(workspaceId, events);
+                };
+                void this.#action(action, env, workerId)
+                    // One queue barrier: a dispatch's channel notifies are enqueued but not yet
+                    // delivered when its promise resolves — drain them so Portal's stream
+                    // bookkeeping arms BEFORE the finish decision (then stream/concluded,
+                    // not a timer, releases any deferral).
+                    .then(async (outcome) => { await new Promise((r) => setImmediate(r)); finishAction(outcome); })
+                    .catch((err) => finishAction({ ok: false, error: err instanceof Error ? err.message : String(err) }));
+                req.on("close", finish);
+                return;
+            }
+            // Terminate-resume, the resume half: a tool-result message resolves the paused
+            // proposal; the continued loop streams on THIS run. No new loop is driven.
+            const toolResult = [...(input.messages ?? [])].reverse().find((m) => m.role === "tool");
+            if (toolResult !== undefined && this.#portal.resolve(toolResult)) {
+                req.on("close", finish); // client hangup on a resume just detaches; the loop already runs
+                return;
+            }
+            const lastUser = [...(input.messages ?? [])].reverse().find((m) => m.role === "user");
+            if (lastUser?.content === undefined || lastUser.content.length === 0)
+                throw new Error("RunAgentInput.messages must carry a user message or a tool result");
+            if (reattached) {
+                const history = await this.#seam.readLog({ workspaceId, workerId, limit: 1000 }).catch(() => null);
+                if (history !== null)
+                    emit([...this.#threadRouterReplay(workspaceId, history)]);
+            }
+            await this.#portal.run({
+                workspaceId, workerId, prompt: lastUser.content,
+                ...(typeof forwarded?.maxTurns === "number" ? { maxTurns: forwarded.maxTurns } : this.#opts.maxTurns !== undefined ? { maxTurns: this.#opts.maxTurns } : {}),
+                ...(typeof forwarded?.flags === "object" && forwarded.flags !== null ? { flags: forwarded.flags } : {}),
+                // #414 — per-loop model selection: the client sends alias+model on every loop
+                // (model = client-resolved <provider>/<model>, #90); forward both, the daemon's
+                // runLoop applies precedence (model wins) and resolves the provider per loop.
+                ...(typeof forwarded?.alias === "string" && forwarded.alias.length > 0 ? { alias: forwarded.alias } : {}),
+                ...(typeof forwarded?.model === "string" && forwarded.model.length > 0 ? { model: forwarded.model } : {}),
+            });
+            // A dropped SSE on a LIVE run cancels the loop (hangup is the abort). A worker we
+            // finished ourselves — terminal event or proposal-terminate — leaves the engine
+            // alone (the paused loop is exactly what the resume run needs).
+            req.on("close", () => {
+                if (finished)
                     return;
-                }
-                this.#portal.finishRun(sessionId, events);
-            };
-            void this.#action(action, env, runId)
-                // One queue barrier: a dispatch's channel notifies are enqueued but not yet
-                // delivered when its promise resolves — drain them so Portal's stream
-                // bookkeeping arms BEFORE the finish decision (then stream/concluded,
-                // not a timer, releases any deferral).
-                .then(async (outcome) => { await new Promise((r) => setImmediate(r)); finishAction(outcome); })
-                .catch((err) => finishAction({ ok: false, error: err instanceof Error ? err.message : String(err) }));
-            req.on("close", finish);
-            return;
-        }
-        // Terminate-resume, the resume half: a tool-result message resolves the paused
-        // proposal; the continued loop streams on THIS run. No new loop is driven.
-        const toolResult = [...(input.messages ?? [])].reverse().find((m) => m.role === "tool");
-        if (toolResult !== undefined && this.#portal.resolve(toolResult)) {
-            req.on("close", finish); // client hangup on a resume just detaches; the loop already runs
-            return;
+                this.#seam.cancelDrain(workerId);
+                finish();
+            });
         }
-        const lastUser = [...(input.messages ?? [])].reverse().find((m) => m.role === "user");
-        if (lastUser?.content === undefined || lastUser.content.length === 0)
-            throw new Error("RunAgentInput.messages must carry a user message or a tool result");
-        if (reattached) {
-            const history = await this.#seam.readLog({ sessionId, runId, limit: 1000 }).catch(() => null);
-            if (history !== null)
-                emit([...this.#threadRouterReplay(sessionId, history)]);
+        catch (err) {
+            // Post-headers throw INSIDE the run (svc#480, completed): the frame alone is
+            // not enough — the heartbeat interval and the Portal binding are live, and a
+            // throw that escapes past finish() leaks them forever (the drill-hang). emit()
+            // writes the terminal frame AND finish()es on RUN_ERROR — one door out.
+            const message = err instanceof Error ? err.message : String(err);
+            const code = /no provider configured|no model|unknown alias/i.test(message) ? "501" : "500";
+            emit([{ type: "RUN_ERROR", message, code }]);
         }
-        await this.#portal.run({
-            sessionId, runId, prompt: lastUser.content,
-            ...(typeof forwarded?.maxTurns === "number" ? { maxTurns: forwarded.maxTurns } : this.#opts.maxTurns !== undefined ? { maxTurns: this.#opts.maxTurns } : {}),
-            ...(typeof forwarded?.flags === "object" && forwarded.flags !== null ? { flags: forwarded.flags } : {}),
-        });
-        // A dropped SSE on a LIVE run cancels the loop (hangup is the abort). A run we
-        // finished ourselves — terminal event or proposal-terminate — leaves the engine
-        // alone (the paused loop is exactly what the resume run needs).
-        req.on("close", () => {
-            if (finished)
-                return;
-            this.#seam.cancelDrain(runId);
-            finish();
-        });
     }
     // A control-plane run: no world bound. Open the SSE, run the worldless verb, answer on
-    // our own stream. No Portal thread, no model run — nothing to forge (operator ruling:
-    // session-plane actions must not spin an ephemeral session).
+    // our own stream. No Portal thread, no model worker — nothing to forge (operator ruling:
+    // workspace-plane actions must not spin an ephemeral workspace).
     async #controlRun(action, input, res) {
         res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", "connection": "keep-alive" });
         const emit = (e) => { res.write(`data: ${JSON.stringify(e)}\n\n`); };
@@ -270,7 +294,7 @@ class Module {
     // events the client un-projects. Built from the real surface — never a hand-kept list.
     #capabilities() {
         const methods = {};
-        for (const k of ["ping", "discover", "providers.list", "session.list", "session.create", "session.attach", "auth.authorize", "auth.authorize.poll", ..._a.#WORLD_SCOPED])
+        for (const k of ["ping", "discover", "providers.list", "workspace.list", "workspace.create", "workspace.attach", "auth.authorize", "auth.authorize.poll", ..._a.#WORLD_SCOPED])
             methods[k] = true;
         const notifications = {};
         for (const n of ["log/entry", "loop/terminated", "loop/proposal", "telemetry/event", "stream/event", "stream/concluded"])
@@ -278,44 +302,44 @@ class Module {
         return { methods, notifications };
     }
     // The action executor — the verb surface. The control plane runs worldless; everything
-    // below the guard operates within a bound session. An unknown kind is an honest error,
+    // below the guard operates within a bound workspace. An unknown kind is an honest error,
     // never a silent pass-through. loop.inject rides here too (§4): the seam's unified
     // runLoop folds a prompt into the active drain; the steered effect streams on the SSE.
     async #action(a, env, convRun) {
         const p = a.params;
         try {
-            // The control plane — worldless verbs (no bound session; #WORLD_SCOPED gates this).
+            // The control plane — worldless verbs (no bound workspace; #WORLD_SCOPED gates this).
             switch (a.kind) {
                 case "ping": return { ok: true, result: {} };
                 case "discover": return { ok: true, result: this.#capabilities() };
                 case "providers.list": return { ok: true, result: this.#seam.listProviders() };
-                case "session.list": return { ok: true, result: { sessions: await this.#seam.listSessions() } };
-                case "session.create": {
+                case "workspace.list": return { ok: true, result: { workspaces: await this.#seam.listWorkspaces() } };
+                case "workspace.create": {
                     // The name IS the identity: an explicit name creates/attaches EXACTLY
-                    // that session; no name = the daemon names it and the real name binds.
+                    // that workspace; no name = the daemon names it and the real name binds.
                     if (typeof p.name === "string" && p.name.length > 0) {
-                        // The name IS the world here — feed it as the session so #envelope
-                        // creates/attaches exactly it (p carries no `session` of its own).
-                        const { env: created } = await this.#envelope(p.name, { ...p, session: p.name });
-                        return { ok: true, result: { id: created.sessionId, name: created.sessionName, runId: created.runId } };
+                        // The name IS the world here — feed it as the workspace so #envelope
+                        // creates/attaches exactly it (p carries no `workspace` of its own).
+                        const { env: created } = await this.#envelope(p.name, { ...p, workspace: p.name });
+                        return { ok: true, result: { id: created.workspaceId, name: created.workspaceName, workerId: created.workerId } };
                     }
-                    const created = await this.#seam.createSession({
+                    const created = await this.#seam.createWorkspace({
                         ...(typeof p.projectRoot === "string" ? { projectRoot: p.projectRoot } : {}),
                         ...(Array.isArray(p.constraints) ? { constraints: p.constraints } : {}),
                         ...(typeof p.settings === "object" && p.settings !== null ? { settings: JSON.stringify(p.settings) } : {}),
                     });
-                    this.#threads.set(created.sessionName, created);
-                    return { ok: true, result: { id: created.sessionId, name: created.sessionName, runId: created.runId } };
+                    this.#threads.set(created.workspaceName, created);
+                    return { ok: true, result: { id: created.workspaceId, name: created.workspaceName, workerId: created.workerId } };
                 }
-                case "session.attach": {
-                    // A REAL attach: rebind the thread map to the chosen session and hand
+                case "workspace.attach": {
+                    // A REAL attach: rebind the thread map to the chosen workspace and hand
                     // back its envelope — the picker does what it says (the unwired kind +
                     // a nil-masking fallback produced the 2026-07-10 front-door disaster).
                     if (typeof p.id !== "number")
-                        return { ok: false, error: "session.attach requires id" };
-                    const att = await this.#seam.attachSession({ sessionId: p.id, ...(typeof p.runId === "number" ? { runId: p.runId } : {}) });
-                    this.#threads.set(att.sessionName, att);
-                    return { ok: true, result: { id: att.sessionId, name: att.sessionName, runId: att.runId, modelRunId: att.modelRunId } };
+                        return { ok: false, error: "workspace.attach requires id" };
+                    const att = await this.#seam.attachWorkspace({ workspaceId: p.id, ...(typeof p.workerId === "number" ? { workerId: p.workerId } : {}) });
+                    this.#threads.set(att.workspaceName, att);
+                    return { ok: true, result: { id: att.workspaceId, name: att.workspaceName, workerId: att.workerId, modelWorkerId: att.modelWorkerId } };
                 }
                 case "auth.authorize": {
                     // Stateless relay to the execs-mcp driver (settled: no auth seam — the
@@ -330,50 +354,50 @@ class Module {
                     return { ok: true, result: await mcpPoll(p.target, { device: p.device }) };
                 }
             }
-            // Below this line lives IN a world. An unknown kind is no run at all; a
-            // world-scoped kind with no bound session is a routing bug — both surface plainly.
+            // Below this line lives IN a world. An unknown kind is no worker at all; a
+            // world-scoped kind with no bound workspace is a routing bug — both surface plainly.
             if (!_a.#WORLD_SCOPED.has(a.kind))
                 return { ok: false, error: `unknown action '${a.kind}'` };
             if (env === null)
-                throw new Error(`action '${a.kind}' operates within a session, but none is bound`);
+                throw new Error(`action '${a.kind}' operates within a workspace, but none is bound`);
             switch (a.kind) {
-                case "session.runs": return { ok: true, result: { runs: await this.#seam.listRuns(typeof p.id === "number" ? p.id : env.sessionId) } };
+                case "workspace.workers": return { ok: true, result: { workers: await this.#seam.listWorkers(typeof p.id === "number" ? p.id : env.workspaceId) } };
                 case "log.read": {
-                    // Default run: the conversation (model run); p.runId pins another.
-                    const readRun = typeof p.runId === "number" ? p.runId : convRun ?? await this.#seam.ensureModelRun(env.sessionId);
-                    const entries = await this.#seam.readLog({ sessionId: env.sessionId, runId: readRun, ...(typeof p.limit === "number" ? { limit: p.limit } : {}), ...(typeof p.sinceId === "number" ? { sinceId: p.sinceId } : {}), ...(typeof p.loopId === "number" ? { loopId: p.loopId } : {}), ...(typeof p.turnId === "number" ? { turnId: p.turnId } : {}), ...(typeof p.loopSeq === "number" ? { loopSeq: p.loopSeq } : {}), ...(typeof p.turnSeq === "number" ? { turnSeq: p.turnSeq } : {}), ...(typeof p.sequence === "number" ? { sequence: p.sequence } : {}) });
+                    // Default run: the conversation (model worker); p.workerId pins another.
+                    const readRun = typeof p.workerId === "number" ? p.workerId : convRun ?? await this.#seam.ensureModelWorker(env.workspaceId);
+                    const entries = await this.#seam.readLog({ workspaceId: env.workspaceId, workerId: readRun, ...(typeof p.limit === "number" ? { limit: p.limit } : {}), ...(typeof p.sinceId === "number" ? { sinceId: p.sinceId } : {}), ...(typeof p.loopId === "number" ? { loopId: p.loopId } : {}), ...(typeof p.turnId === "number" ? { turnId: p.turnId } : {}), ...(typeof p.loopSeq === "number" ? { loopSeq: p.loopSeq } : {}), ...(typeof p.turnSeq === "number" ? { turnSeq: p.turnSeq } : {}), ...(typeof p.sequence === "number" ? { sequence: p.sequence } : {}) });
                     return { ok: true, result: { entries } };
                 }
                 case "loop.inject": {
                     if (typeof p.prompt !== "string" || p.prompt.length === 0)
                         return { ok: false, error: "loop.inject requires prompt" };
-                    const ack = await this.#seam.runLoop({ sessionId: env.sessionId, runId: convRun ?? await this.#seam.ensureModelRun(env.sessionId), prompt: p.prompt });
+                    const ack = await this.#seam.runLoop({ workspaceId: env.workspaceId, workerId: convRun ?? await this.#seam.ensureModelWorker(env.workspaceId), prompt: p.prompt });
                     return { ok: true, result: ack };
                 }
                 // The stop button (TUI /stop + Ctrl-C, nvim :PlurnkStop): abort the model
-                // run's active drain. Mirrors the SSE-hangup abort, addressable as a verb.
-                case "loop.cancel": return { ok: true, result: { cancelled: this.#seam.cancelDrain(convRun ?? await this.#seam.ensureModelRun(env.sessionId)) } };
-                case "session.prompts": return { ok: true, result: { prompts: await this.#seam.listPrompts(env.sessionId, typeof p.limit === "number" ? p.limit : undefined) } };
-                case "session.rename": {
+                // worker's active drain. Mirrors the SSE-hangup abort, addressable as a verb.
+                case "loop.cancel": return { ok: true, result: { cancelled: this.#seam.cancelDrain(convRun ?? await this.#seam.ensureModelWorker(env.workspaceId)) } };
+                case "workspace.prompts": return { ok: true, result: { prompts: await this.#seam.listPrompts(env.workspaceId, typeof p.limit === "number" ? p.limit : undefined) } };
+                case "workspace.rename": {
                     if (typeof p.name !== "string" || p.name.length === 0)
-                        return { ok: false, error: "session.rename requires name" };
-                    return { ok: true, result: await this.#seam.renameSession(env.sessionId, p.name) };
+                        return { ok: false, error: "workspace.rename requires name" };
+                    return { ok: true, result: await this.#seam.renameWorkspace(env.workspaceId, p.name) };
                 }
-                case "session.constrain": {
+                case "workspace.constrain": {
                     if (typeof p.effect !== "string" || typeof p.glob !== "string")
-                        return { ok: false, error: "session.constrain requires effect + glob" };
-                    return { ok: true, result: await this.#seam.constrain(env.sessionId, p.effect, p.glob) };
+                        return { ok: false, error: "workspace.constrain requires effect + glob" };
+                    return { ok: true, result: await this.#seam.constrain(env.workspaceId, p.effect, p.glob) };
                 }
-                case "session.unconstrain": {
+                case "workspace.unconstrain": {
                     if (typeof p.effect !== "string" || typeof p.glob !== "string")
-                        return { ok: false, error: "session.unconstrain requires effect + glob" };
-                    return { ok: true, result: await this.#seam.unconstrain(env.sessionId, p.effect, p.glob) };
+                        return { ok: false, error: "workspace.unconstrain requires effect + glob" };
+                    return { ok: true, result: await this.#seam.unconstrain(env.workspaceId, p.effect, p.glob) };
                 }
-                case "session.constraints": return { ok: true, result: { constraints: await this.#seam.listConstraints(env.sessionId) } };
+                case "workspace.constraints": return { ok: true, result: { constraints: await this.#seam.listConstraints(env.workspaceId) } };
                 case "entry.read": {
                     if (typeof p.target !== "string")
                         return { ok: false, error: "entry.read requires target" };
-                    return { ok: true, result: await this.#seam.readEntry({ sessionId: env.sessionId, target: p.target, ...(typeof p.channel === "string" ? { channel: p.channel } : {}), ...(typeof p.offset === "number" ? { offset: p.offset } : {}) }) };
+                    return { ok: true, result: await this.#seam.readEntry({ workspaceId: env.workspaceId, target: p.target, ...(typeof p.channel === "string" ? { channel: p.channel } : {}), ...(typeof p.offset === "number" ? { offset: p.offset } : {}) }) };
                 }
                 case "op.exec": {
                     // EXEC constructed structurally (no DSL text): the model-facing shape,
@@ -382,8 +406,8 @@ class Module {
                         return { ok: false, error: "op.exec requires command" };
                     const statement = { op: "EXEC", suffix: "", signal: null, target: null, lineMarker: null, body: p.command, position: { line: 1, col: 1 } };
                     // Client ops journal as client-origin turns in the CLIENT run (run-split:
-                    // only LOOPS live in the model run).
-                    return { ok: true, result: await this.#seam.dispatchAsClient({ sessionId: env.sessionId, runId: env.runId, statement }) };
+                    // only LOOPS live in the model worker).
+                    return { ok: true, result: await this.#seam.dispatchAsClient({ workspaceId: env.workspaceId, workerId: env.workerId, statement }) };
                 }
                 case "op.parse": {
                     // Raw DSL parsed at the module's edge (the grammar is a family-internal
@@ -393,7 +417,7 @@ class Module {
                         return { ok: false, error: "op.parse requires text" };
                     const parsed = PlurnkParser.parseClient(p.text);
                     const results = [];
-                    const runId = env.runId; // client ops ride the client run
+                    const workerId = env.workerId; // client ops ride the client worker
                     for (const item of parsed.items) {
                         if (item.kind === "error") {
                             results.push({ status: 400, error: String(item.error.message ?? item.error) });
@@ -401,11 +425,11 @@ class Module {
                         }
                         if (item.kind !== "statement")
                             continue; // interstitial text isn't dispatchable
-                        results.push(await this.#seam.dispatchAsClient({ sessionId: env.sessionId, runId, statement: item.statement }));
+                        results.push(await this.#seam.dispatchAsClient({ workspaceId: env.workspaceId, workerId, statement: item.statement }));
                     }
                     return { ok: true, result: { results } };
                 }
-                case "session.members": return { ok: true, result: await this.#seam.listMembers(env.sessionId) };
+                case "workspace.members": return { ok: true, result: await this.#seam.listMembers(env.workspaceId) };
                 case "op.look": {
                     // Parse at the edge; LOOK is the wire spelling of the read-projection —
                     // rewrite to READ (Engine.look enforces READ-only).
@@ -416,9 +440,9 @@ class Module {
                     if (item === undefined || item.kind !== "statement")
                         return { ok: false, error: "op.look: no statement parsed" };
                     const statement = { ...item.statement, op: "READ" };
-                    return { ok: true, result: await this.#seam.look({ sessionId: env.sessionId, runId: env.runId, statement }) };
+                    return { ok: true, result: await this.#seam.look({ workspaceId: env.workspaceId, workerId: env.workerId, statement }) };
                 }
-                case "run.fork": return { ok: true, result: await this.#seam.forkRun({ sessionId: env.sessionId, runId: convRun ?? await this.#seam.ensureModelRun(env.sessionId), ...(typeof p.name === "string" ? { name: p.name } : {}) }) };
+                case "run.fork": return { ok: true, result: await this.#seam.forkWorker({ workspaceId: env.workspaceId, workerId: convRun ?? await this.#seam.ensureModelWorker(env.workspaceId), ...(typeof p.name === "string" ? { name: p.name } : {}) }) };
                 default: return { ok: false, error: `unknown action '${a.kind}'` };
             }
         }
@@ -426,7 +450,7 @@ class Module {
             return { ok: false, error: err instanceof Error ? err.message : String(err) };
         }
     }
-    #threadRouterReplay(sessionId, entries) {
+    #threadRouterReplay(workspaceId, entries) {
         // Replay via the thread's own router (MESSAGES_SNAPSHOT of the model SENDs).
         const messages = [];
         for (const e of entries) {