@plurnk/plurnk-service 1.0.5 → 1.0.6

package/dist/server/Daemon.js

@@ -37,7 +37,7 @@ export default class Daemon {
     // module (plurnk-agui) subscribes and fans out to its OWN clients; core emits, never fans out
     // for it. The WS fan-out below is legacy scaffolding that retires at the AG-UI+ cutover.
     #eventSubscribers = new Set();
-    // Run-level drain registry. At most one drain per run. The stored object
+    // Run-level drain registry. At most one drain per worker. The stored object
     // is the drain's identity handle: start/exit compare it by reference so a
     // drain exiting never clobbers a successor that raced in, and a loop
     // enqueued during teardown is never stranded. A drain is a pure queue
@@ -51,18 +51,18 @@ export default class Daemon {
     // cancel self-aborts against the already-aborted signal (no race). Outlives
     // any single (ephemeral) drain; replaced with a fresh controller once
     // aborted so a later loop.run isn't born cancelled.
-    #runAborts = new Map();
-    // grammar 0.74.20 EXEC `<T,P>` — per-run hibernation poll-wake timer. When a loop parks at
+    #workerAborts = new Map();
+    // grammar 0.74.20 EXEC `<T,P>` — per-worker hibernation poll-wake timer. When a loop parks at
     // a park with a polled stream, a timer fires every P seconds to resume it (§exec-poll). One
-    // per run (the tightest cadence); cleared/replaced on each park and on cancel.
+    // per worker (the tightest cadence); cleared/replaced on each park and on cancel.
     #parkTimers = new Map();
     #pollTimers = new Map();
-    // Per-run drain-transition lock — see #withDrainLock (R4 / §run-lifecycle-single-drain).
+    // Per-run drain-transition lock — see #withDrainLock (R4 / §worker-lifecycle-single-drain).
     #drainLocks = new Map();
-    // §run-lifecycle-child-wake — runs OWED a wake: a child/stream conclusion fired while the run was
-    // mid-turn (not yet slept), so #wakeParkedRun could not resume it. A worker-run conclusion is a
+    // §worker-lifecycle-child-wake — runs OWED a wake: a child/stream conclusion fired while the worker was
+    // mid-turn (not yet slept), so #wakeParkedWorker could not resume it. A worker-run conclusion is a
     // BOUNDED, lossless wake (a worker always concludes), so a hibernation awaiting one MUST return —
-    // never deadlock. The drain honors the owed wake at the run's next park, closing the conclude-
+    // never deadlock. The drain honors the owed wake at the worker's next park, closing the conclude-
     // before-park race. (Only a live exec stream, unbounded absent a timeout, may hold a park open.)
     #owedWakes = new Set();
     constructor({ db, schemes, mimetypes, provider, nodeModulesPath, }) {
@@ -75,8 +75,8 @@ export default class Daemon {
         // in-repo tests. discover() takes a cwd and joins node_modules, so derive the parent.
         this.#nodeModulesPath = nodeModulesPath ?? resolve(process.cwd(), "node_modules");
         this.#discoveryCwd = dirname(this.#nodeModulesPath);
-        // Mimetypes owns discovery + detection; we inject the tokenize fn (from the provider's
-        // countTokens) and default to text/markdown.
+        // Mimetypes owns discovery + detection; default mimetype text/markdown. (Token counting
+        // is NOT wired here — the engine's ruler below is §tokenomics-agnostic-ruler.)
         this.#mimetypes = mimetypes ?? new Mimetypes({
             defaultMimetype: "text/markdown",
             discoverOptions: { cwd: this.#discoveryCwd },
@@ -84,34 +84,34 @@ export default class Daemon {
         this.#engine = new Engine({
             db, schemes: this.#schemes, mimetypes: this.#mimetypes,
             // §tokenomics-agnostic-ruler — the ONE model-facing token ruler (chars/2), NOT the
-            // boot provider: token accounting is session-wide across many concurrent models, so
+            // boot provider: token accounting is workspace-wide across many concurrent models, so
             // the write-time + catalog counts must be model-independent. Exact per-model counting
             // lives only at the packet-materialization fit-gate.
             tokenize: rulerCount,
-            streamEventNotify: (sessionId, event) => this.notifyStreamEvent(sessionId, event),
-            wakeRunNotify: (payload) => { void this.#handleWakeRun(payload); },
-            // run:// loop-start primitive — spawn/fork/irc deliver through
+            streamEventNotify: (workspaceId, event) => this.notifyStreamEvent(workspaceId, event),
+            wakeWorkerNotify: (payload) => { void this.#handleWakeWorker(payload); },
+            // worker:// loop-start primitive — spawn/fork/irc deliver through
             // Daemon.inject (active sister → fold; idle → enqueue + drain). The
-            // daemon owns provider + the law-file system prompt; the run scheme
+            // daemon owns provider + the law-file system prompt; the worker scheme
             // handler carries neither. Fire-and-forget: the returned drain runs
-            // independently (the sister is its own run). §machine-processes
-            injectRun: async ({ sessionId, runId, prompt, flags }) => {
+            // independently (the sister is its own worker). §machine-processes
+            injectWorker: async ({ workspaceId, workerId, prompt, flags }) => {
                 if (this.#provider === null)
-                    throw new Error("injectRun: no provider configured");
+                    throw new Error("injectWorker: no provider configured");
                 const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-                const { action, loopId } = await this.inject({ sessionId, runId, prompt, provider: this.#provider, systemPrompt, ...(flags === undefined ? {} : { flags }) });
+                const { action, loopId } = await this.inject({ workspaceId, workerId, prompt, provider: this.#provider, systemPrompt, ...(flags === undefined ? {} : { flags }) });
                 return { action, loopId };
             },
-            // run:// KILL (terminate) — abort any run's in-flight work by id. One
+            // worker:// KILL (terminate) — abort any worker's in-flight work by id. One
             // abort, one scope (Daemon.cancelDrain): the active loop closes 499,
             // background streams tear down. Whoever holds the address may end it.
-            cancelRun: (runId) => this.cancelDrain(runId, "killed via run:// KILL"),
-            telemetryEventNotify: (sessionId, payload) => this.notifyTelemetryEvent(sessionId, payload),
+            cancelWorker: (workerId) => this.cancelDrain(workerId, "killed via worker:// KILL"),
+            telemetryEventNotify: (workspaceId, payload) => this.notifyTelemetryEvent(workspaceId, payload),
         });
         // Wire proposal-pending events to the loop/proposal WS notification.
-        // Sessionid scopes the broadcast to clients on the same session.
+        // Sessionid scopes the broadcast to clients on the same workspace.
         this.#engine.onProposalPending((event) => {
-            this.#broadcast({ sessionId: event.sessionId }, "loop/proposal", {
+            this.#broadcast({ workspaceId: event.workspaceId }, "loop/proposal", {
                 logEntryId: event.logEntryId,
                 loopId: event.loopId,
                 turnId: event.turnId,
@@ -135,25 +135,25 @@ export default class Daemon {
         NoProposals.attachNoProposals(this.#engine, this.#db);
     }
     // The client-interface seam (#355). A transport module subscribes to the daemon's in-process
-    // event source: it receives every session-scoped engine event as `(sessionId, method, params)`
+    // event source: it receives every workspace-scoped engine event as `(workspaceId, method, params)`
     // and fans out to its OWN clients — core emits, it never fans out for the module. Returns an
-    // unsubscribe. `sessionId` is the event's session, or null for a global event (e.g. session/created).
+    // unsubscribe. `workspaceId` is the event's workspace, or null for a global event (e.g. workspace/created).
     // The engine and its events are core; the fan-out belongs to the module.
     subscribeToEvents(handler) {
         this.#eventSubscribers.add(handler);
         return () => { this.#eventSubscribers.delete(handler); };
     }
     // The client-interface seam (#355) — proposal HITL. A transport module reads the stopped-world
-    // proposals for a session (rendering each as a TOOL_CALL) and feeds back the human's decision. The
+    // proposals for a workspace (rendering each as a TOOL_CALL) and feeds back the human's decision. The
     // gate, validation, and applyResolution stay core (Engine.resolveProposal); the seam is the read +
     // the resolve, never the mechanism. `resolveProposal` throws for an unknown/already-resolved id.
-    async pendingProposals(sessionId) {
-        return this.#db.proposal_list_pending.all({ session_id: sessionId });
+    async pendingProposals(workspaceId) {
+        return this.#db.proposal_list_pending.all({ workspace_id: workspaceId });
     }
     resolveProposal(logEntryId, resolution) {
         this.#engine.resolveProposal(logEntryId, resolution);
     }
-    // The client-interface seam (#355) — drive/steer a loop. The module supplies only session/run/prompt;
+    // The client-interface seam (#355) — drive/steer a loop. The module supplies only workspace/run/prompt;
     // the provider and the law-file system prompt are core's and stay inside. Returns immediately — the
     // loop runs async and its outcome arrives on the event source (loop/terminated). `cancelDrain` (public)
     // is the cancel hook. Both funnel through the unified `inject`, which owns the drain lifecycle.
@@ -168,16 +168,16 @@ export default class Daemon {
             throw new Error("runLoop: no provider configured");
         const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
         // §machine-processes — the model NEVER runs in a client-origin run (its packets would carry
-        // client op.* rows). The module resolves the model run via ensureModelRun and passes it (or a
-        // fork); a client run here is a caller error, refused loudly rather than silently rehomed.
-        const target = await this.#db.envelope_get_run_by_id.get({ id: args.runId });
+        // client op.* rows). The module resolves the model worker via ensureModelWorker and passes it (or a
+        // fork); a client worker here is a caller error, refused loudly rather than silently rehomed.
+        const target = await this.#db.envelope_get_worker_by_id.get({ id: args.workerId });
         if (target === undefined)
-            throw new Error(`runLoop: run ${args.runId} not found`);
+            throw new Error(`runLoop: run ${args.workerId} not found`);
         if (target.origin === "client")
-            throw new Error(`runLoop: run ${args.runId} is a client run — loops run in model runs (§machine-processes); resolve one with ensureModelRun(sessionId)`);
+            throw new Error(`runLoop: run ${args.workerId} is a client worker — loops run in model workers (§machine-processes); resolve one with ensureModelWorker(workspaceId)`);
         // Pre-loop docs (both sets: operator/client mdDocs + the teaching docs the turn-1
         // FIND(plurnk://docs/**) foist discovers) — ONE truth shared with the legacy loop.run route.
-        await LoopDocs.materialize(this.#engine, this.#db, args.sessionId);
+        await LoopDocs.materialize(this.#engine, this.#db, args.workspaceId);
         // §operator-config-max-turns-ceiling — the operator ceiling clamps a per-call maxTurns; a
         // seam caller must not bypass operator policy (inject only DEFAULTS from env, never clamps).
         const ceiling = Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "-1");
@@ -194,10 +194,10 @@ export default class Daemon {
         const spec = resolveLoopAlias(alias, model, parseAliasesFromEnv());
         return spec === null ? this.#provider : ProviderInstantiate.instantiateProvider(spec);
     }
-    // §machine-processes — the session's model run (created on first use), distinct from the client
+    // §machine-processes — the workspace's model worker (created on first use), distinct from the client
     // run so the model's packets never carry client op.* rows. The module binds its threads to this.
-    ensureModelRun(sessionId) {
-        return Envelope.ensureModelRun(this.#db, sessionId);
+    ensureModelWorker(workspaceId) {
+        return Envelope.ensureModelWorker(this.#db, workspaceId);
     }
     // The op-dispatch hook (#355) — execute one parsed op on behalf of a client: journaled as a
     // client-origin turn (the log is core's, a client op is a first-class citizen), dispatched through
@@ -205,17 +205,17 @@ export default class Daemon {
     // family (read/edit/copy/find/fold/look/move/open/send/exec); the module parses at its edge with the
     // grammar package and hands over the statement, then fans the emitted entry out to its own clients.
     async dispatchAsClient(args) {
-        const { sessionId, runId, statement } = args;
-        const clientLoopId = await Envelope.ensureClientLoop(this.#db, runId);
+        const { workspaceId, workerId, statement } = args;
+        const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
         const turnId = await ClientTurn.insertClientTurn(this.#db, clientLoopId);
         const entryIds = [];
         const result = await this.#engine.dispatch({
-            statement, sessionId, runId, loopId: clientLoopId, turnId, sequence: 1,
+            statement, workspaceId, workerId, loopId: clientLoopId, turnId, sequence: 1,
             origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); },
         });
         for (const logEntryId of entryIds) {
             const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
-            this.#broadcast({ sessionId }, "log/entry", { entry });
+            this.#broadcast({ workspaceId }, "log/entry", { entry });
         }
         return result;
     }
@@ -225,23 +225,23 @@ export default class Daemon {
     // dispatchAsClient). Rides the client loop so log:/// coordinates resolve run-relative;
     // invisible to the model. Engine.look enforces READ-only.
     async look(args) {
-        const { sessionId, runId, statement } = args;
-        const clientLoopId = await Envelope.ensureClientLoop(this.#db, runId);
-        return await this.#engine.look({ statement, sessionId, runId, loopId: clientLoopId });
+        const { workspaceId, workerId, statement } = args;
+        const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
+        return await this.#engine.look({ statement, workspaceId, workerId, loopId: clientLoopId });
     }
-    // The log-read hook (#355) — a session's journal, the module's primary render input. The run is
-    // ownership-verified against the session (a session reads only its own runs — the model run included,
+    // The log-read hook (#355) — a workspace's journal, the module's primary render input. The worker is
+    // ownership-verified against the workspace (a workspace reads only its own runs — the model worker included,
     // #214); entries filter by loop/turn/since-id or the full L/T/S display coordinate. Core owns the
     // journal + the invariant; the module shapes the entries into AG-UI messages at its edge.
     async readLog(args) {
-        const { sessionId, runId } = args;
-        const target = await this.#db.envelope_get_run_by_id.get({ id: runId });
+        const { workspaceId, workerId } = args;
+        const target = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
         if (target === undefined)
-            throw new Error(`run ${runId} not found`);
-        if (target.session_id !== sessionId)
-            throw new Error(`run ${runId} is not in this session (${sessionId})`);
+            throw new Error(`run ${workerId} not found`);
+        if (target.workspace_id !== workspaceId)
+            throw new Error(`run ${workerId} is not in this workspace (${workspaceId})`);
         const rows = await this.#db.log_read_recent_ids.all({
-            run_id: runId,
+            worker_id: workerId,
             loop_id: args.loopId ?? null, turn_id: args.turnId ?? null, since_id: args.sinceId ?? null,
             loop_seq: args.loopSeq ?? null, turn_seq: args.turnSeq ?? null, sequence: args.sequence ?? null,
             limit: Math.min(args.limit ?? 100, 1000),
@@ -260,78 +260,78 @@ export default class Daemon {
                 const isActive = active !== null && active.alias === a.alias;
                 return {
                     alias: a.alias, provider: a.provider, model: a.model, active: isActive,
-                    // contextSize = the EFFECTIVE prompt budget (window minus reserves, #345) — the same
+                    // promptBudget = the EFFECTIVE prompt budget (window minus reserves, #345; named honestly #481) — the same
                     // denominator loop-usage reports; known for the active alias, null elsewhere.
-                    contextSize: isActive && this.#provider !== null ? this.#engine.promptBudgetFor(this.#provider) : null,
+                    promptBudget: isActive && this.#provider !== null ? this.#engine.promptBudgetFor(this.#provider) : null,
                 };
             }),
         };
     }
-    listSessions() { return Envelope.listSessions(this.#db); }
-    listRuns(sessionId) { return Envelope.listRunsForSession(this.#db, sessionId); }
-    listPrompts(sessionId, limit = 100) { return Envelope.listPromptsForSession(this.#db, sessionId, limit); }
-    listMembers(sessionId) { return GitMembership.resolveMembershipEffects(this.#db, sessionId, undefined); }
-    listConstraints(sessionId) {
-        return this.#db.crud_list_session_constraints.all({ session_id: sessionId });
+    listWorkspaces() { return Envelope.listWorkspaces(this.#db); }
+    listWorkers(workspaceId) { return Envelope.listWorkersForWorkspace(this.#db, workspaceId); }
+    listPrompts(workspaceId, limit = 100) { return Envelope.listPromptsForWorkspace(this.#db, workspaceId, limit); }
+    listMembers(workspaceId) { return GitMembership.resolveMembershipEffects(this.#db, workspaceId, undefined); }
+    listConstraints(workspaceId) {
+        return this.#db.crud_list_workspace_constraints.all({ workspace_id: workspaceId });
     }
-    // Session lifecycle (#355): the module's session-management surface. Inputs arrive already validated
+    // Workspace lifecycle (#355): the module's workspace-management surface. Inputs arrive already validated
     // at the module's edge ("I am the wall" — settings as the stored JSON string, constraints as a typed
     // array, roots absolute); core owns the envelope, its reserved-name + name-uniqueness invariants,
-    // membership resolution, warmSessionDerivations, and the session/created emit. No connection state
-    // (which client is on which session) lives here — that's the module's.
-    async createSession(args) {
+    // membership resolution, warmWorkspaceDerivations, and the workspace/created emit. No connection state
+    // (which client is on which workspace) lives here — that's the module's.
+    async createWorkspace(args) {
         // The SEAM fail-hards on malformed client input (#364 — validation flushed out of the
         // retired WS handlers so every module inherits it): settings bag (#231/#232/#249/#328),
         // constraints (#200), absolute projectRoot.
-        const projectRoot = ClientInput.assertProjectRoot("session.create", args.projectRoot);
+        const projectRoot = ClientInput.assertProjectRoot("workspace.create", args.projectRoot);
         const settings = ClientInput.parseSettings(args.settings);
         const constraints = ClientInput.parseConstraints(args.constraints);
         const envelope = await Envelope.createClientEnvelope(this.#db, { name: args.name, projectRoot, settings });
         for (const { effect, glob } of constraints) {
-            await this.#db.crud_insert_session_constraint.run({ session_id: envelope.sessionId, effect, glob });
+            await this.#db.crud_insert_workspace_constraint.run({ workspace_id: envelope.workspaceId, effect, glob });
         }
         if (constraints.length > 0)
-            await GitMembership.resolveGitMembership(this.#db, envelope.sessionId, undefined);
-        void this.#engine.warmSessionDerivations(envelope.sessionId).catch(() => { });
-        this.#broadcast("all", "session/created", { id: envelope.sessionId, name: envelope.sessionName, projectRoot: envelope.projectRoot });
+            await GitMembership.resolveGitMembership(this.#db, envelope.workspaceId, undefined);
+        void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
+        this.#broadcast("all", "workspace/created", { id: envelope.workspaceId, name: envelope.workspaceName, projectRoot: envelope.projectRoot });
         return envelope;
     }
-    async attachSession(args) {
-        // attachToSession owns the reserved-name + run-ownership invariants; the seam just delegates + warms.
-        const envelope = await Envelope.attachToSession(this.#db, args.sessionId, { runId: args.runId, runName: args.runName });
-        void this.#engine.warmSessionDerivations(envelope.sessionId).catch(() => { });
+    async attachWorkspace(args) {
+        // attachToWorkspace owns the reserved-name + run-ownership invariants; the seam just delegates + warms.
+        const envelope = await Envelope.attachToWorkspace(this.#db, args.workspaceId, { workerId: args.workerId, workerName: args.workerName });
+        void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
         return envelope;
     }
-    async renameSession(sessionId, name) {
+    async renameWorkspace(workspaceId, name) {
         if (typeof name !== "string" || name.length === 0)
-            throw new Error("session.rename: name must be a non-empty string"); // seam fail-hard (#364)
-        const taken = await this.#db.envelope_get_session_by_name.get({ name });
-        if (taken !== undefined && taken.id !== sessionId)
-            throw new Error(`a session named "${name}" already exists — pick another`);
-        return { id: sessionId, name: await Envelope.updateSessionName(this.#db, sessionId, name) };
+            throw new Error("workspace.rename: name must be a non-empty string"); // seam fail-hard (#364)
+        const taken = await this.#db.envelope_get_workspace_by_name.get({ name });
+        if (taken !== undefined && taken.id !== workspaceId)
+            throw new Error(`a workspace named "${name}" already exists — pick another`);
+        return { id: workspaceId, name: await Envelope.updateWorkspaceName(this.#db, workspaceId, name) };
     }
-    async constrain(sessionId, effect, glob) {
-        ClientInput.assertConstraint("session.constrain", effect, glob);
-        // Headless is FOREVER (owner ruling, 2026-07-11, matching the client SPEC): a session is
+    async constrain(workspaceId, effect, glob) {
+        ClientInput.assertConstraint("workspace.constrain", effect, glob);
+        // Headless is FOREVER (owner ruling, 2026-07-11, matching the client SPEC): a workspace is
         // born with its workspace pointer or never has one — so a 'repo' constraint on a headless
-        // session can never resolve. Refuse legibly instead of recording a forever-pending lie.
+        // workspace can never resolve. Refuse legibly instead of recording a forever-pending lie.
         if (effect === "repo") {
-            const s = await this.#db.envelope_get_session.get({ id: sessionId });
+            const s = await this.#db.envelope_get_workspace.get({ id: workspaceId });
             if (s?.project_root == null)
-                throw new Error("session.constrain: this session is headless — and headless is forever (a workspace pointer is set at session.create or never). A 'repo' overlay needs a session created with projectRoot.");
+                throw new Error("workspace.constrain: this workspace is headless — and headless is forever (a workspace pointer is set at workspace.create or never). A 'repo' overlay needs a workspace created with projectRoot.");
         }
-        await this.#db.crud_insert_session_constraint.run({ session_id: sessionId, effect, glob });
-        await GitMembership.resolveGitMembership(this.#db, sessionId, undefined);
+        await this.#db.crud_insert_workspace_constraint.run({ workspace_id: workspaceId, effect, glob });
+        await GitMembership.resolveGitMembership(this.#db, workspaceId, undefined);
         // Members may have just landed — warm their derivations NOW (fire-and-forget, off the hot
-        // path), exactly like createSession does (dogfood catch: '/repo' embeddings waited for a
+        // path), exactly like createWorkspace does (dogfood catch: '/repo' embeddings waited for a
         // later turn's pump).
-        void this.#engine.warmSessionDerivations(sessionId).catch(() => { });
+        void this.#engine.warmWorkspaceDerivations(workspaceId).catch(() => { });
         return { effect, glob };
     }
-    async unconstrain(sessionId, effect, glob) {
-        ClientInput.assertConstraint("session.unconstrain", effect, glob);
-        await this.#db.crud_delete_session_constraint.run({ session_id: sessionId, effect, glob });
-        await GitMembership.resolveGitMembership(this.#db, sessionId, undefined);
+    async unconstrain(workspaceId, effect, glob) {
+        ClientInput.assertConstraint("workspace.unconstrain", effect, glob);
+        await this.#db.crud_delete_workspace_constraint.run({ workspace_id: workspaceId, effect, glob });
+        await GitMembership.resolveGitMembership(this.#db, workspaceId, undefined);
         return { effect, glob };
     }
     // The entry-shape hook (#355) — one entry's channels + tags + metadata at a path. With channel+offset,
@@ -345,7 +345,7 @@ export default class Daemon {
             throw new Error("readEntry: offset requires channel (which channel to slice)");
         const scheme = m[1];
         const pathname = m[2].split("#")[0];
-        const row = await this.#db.entry_read_lookup.get({ session_id: args.sessionId, scheme, pathname });
+        const row = await this.#db.entry_read_lookup.get({ workspace_id: args.workspaceId, scheme, pathname });
         if (row === undefined)
             return { status: 404, entry: null };
         let channelRows;
@@ -360,52 +360,52 @@ export default class Daemon {
         for (const c of channelRows)
             channels[c.name] = { content: c.content, contentLength: c.contentLength, mimetype: c.mimetype, tokens: c.tokens, state: c.state };
         const tagRows = await this.#db.crud_read_tags.all({ entry_id: row.id });
-        return { status: 200, entry: { id: row.id, scope: row.scope, sessionId: row.session_id, scheme: row.scheme, pathname: row.pathname, channels, tags: tagRows.map((t) => t.tag) } };
+        return { status: 200, entry: { id: row.id, scope: row.scope, workspaceId: row.workspace_id, scheme: row.scheme, pathname: row.pathname, channels, tags: tagRows.map((t) => t.tag) } };
     }
-    // The fork hook (#355) — branch a run's log into a new run in the same session (#228), sharing the
-    // session's world (entries + overlay), copying nothing of it. The module resolves the default (the
-    // session's model run) from its own connection state and passes the concrete runId; the seam owns the
-    // #366 — a fresh conversation run: AG-UI threads map to RUNS (§machine-processes — the session
-    // is the workspace, the run is the conversation). ensureModelRun is the stable DEFAULT door,
-    // forkRun the branching door (copies history); this is the fresh door — a named, empty-log,
+    // The fork hook (#355) — branch a worker's log into a new worker in the same workspace (#228), sharing the
+    // workspace's world (entries + overlay), copying nothing of it. The module resolves the default (the
+    // workspace's model worker) from its own connection state and passes the concrete workerId; the seam owns the
+    // #366 — a fresh conversation worker: AG-UI threads map to RUNS (§machine-processes — the workspace
+    // is the workspace, the worker is the conversation). ensureModelWorker is the stable DEFAULT door,
+    // forkWorker the branching door (copies history); this is the fresh door — a named, empty-log,
     // model-origin root that runLoop accepts. New chat = new conversation, same workspace.
-    async createConversationRun(args) {
-        const { sessionId, name } = args;
+    async createConversationWorker(args) {
+        const { workspaceId, name } = args;
         if (name !== undefined && (typeof name !== "string" || name.length === 0))
             throw new Error("run.create: name must be a non-empty string");
-        const session = await this.#db.envelope_get_session.get({ id: sessionId });
-        if (session === undefined)
-            throw new Error(`run.create: session ${sessionId} not found`);
+        const workspace = await this.#db.envelope_get_workspace.get({ id: workspaceId });
+        if (workspace === undefined)
+            throw new Error(`run.create: workspace ${workspaceId} not found`);
         if (name !== undefined) {
             if (Envelope.RESERVED_RUN_NAMES.has(name.toLowerCase()))
                 throw new Error(`run.create: name "${name}" is reserved for a non-client actor`);
-            const taken = await this.#db.envelope_get_run_by_name.get({ session_id: sessionId, name });
+            const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
             if (taken !== undefined)
-                throw new Error(`run.create: a run named "${name}" already exists — run names are immutable, pick another`);
+                throw new Error(`run.create: a worker named "${name}" already exists — worker names are immutable, pick another`);
         }
-        const run = await Envelope.createModelRun(this.#db, sessionId, name);
-        return { runId: run.id, runName: run.name };
+        const run = await Envelope.createModelWorker(this.#db, workspaceId, name);
+        return { workerId: run.id, workerName: run.name };
     }
     // ownership check and the run-name namespace + uniqueness invariants (names are immutable — no rename).
-    async forkRun(args) {
+    async forkWorker(args) {
         if (args.name !== undefined && (typeof args.name !== "string" || args.name.length === 0))
             throw new Error("run.fork: name must be a non-empty string"); // seam fail-hard (#364)
-        const { sessionId, runId, name } = args;
-        const owner = await this.#db.envelope_get_run_by_id.get({ id: runId });
+        const { workspaceId, workerId, name } = args;
+        const owner = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
         if (owner === undefined)
-            throw new Error(`forkRun: run ${runId} not found`);
-        if (owner.session_id !== sessionId)
-            throw new Error(`forkRun: run ${runId} is not in session ${sessionId}`);
+            throw new Error(`forkWorker: run ${workerId} not found`);
+        if (owner.workspace_id !== workspaceId)
+            throw new Error(`forkWorker: run ${workerId} is not in workspace ${workspaceId}`);
         if (name !== undefined) {
             if (Envelope.RESERVED_RUN_NAMES.has(name.toLowerCase()))
-                throw new Error(`forkRun: name "${name}" is reserved for a non-client actor`);
-            const taken = await this.#db.envelope_get_run_by_name.get({ session_id: sessionId, name });
+                throw new Error(`forkWorker: name "${name}" is reserved for a non-client actor`);
+            const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
             if (taken !== undefined)
-                throw new Error(`forkRun: a run named "${name}" already exists — run names are immutable, pick another`);
+                throw new Error(`forkWorker: a worker named "${name}" already exists — worker names are immutable, pick another`);
         }
-        const branchRunId = await Fork.fork(this.#db, runId, name);
-        const branch = await this.#db.envelope_get_run_by_id.get({ id: branchRunId });
-        return { runId: branchRunId, runName: branch?.name ?? null, parentRunId: runId };
+        const branchWorkerId = await Fork.fork(this.#db, workerId, name);
+        const branch = await this.#db.envelope_get_worker_by_id.get({ id: branchWorkerId });
+        return { workerId: branchWorkerId, workerName: branch?.name ?? null, parentWorkerId: workerId };
     }
     // The module-load hook (#355 / #289) — register a runtime into the live registry, driver-agnostic:
     // the kernel knows nothing about MCP or any specific driver. The struct is the booth window agreed
@@ -468,7 +468,7 @@ export default class Daemon {
         // to completion, (3) drain streaming schemes' background work
         // (exec spawn cleanup, channel writes). Only THEN close the DB
         // upstream — drain queries hit the DB right up until they exit.
-        // Abort every run's cancellation scope — stops in-flight loops AND the
+        // Abort every worker's cancellation scope — stops in-flight loops AND the
         // streams (background execs) linked to them, so idle() doesn't block on
         // a long-running command. Covers runs whose drain already exited but
         // whose exec is still in flight.
@@ -476,13 +476,19 @@ export default class Daemon {
         // that will never arrive once clients are gone — allSettled(drains) below would deadlock
         // the stop forever (a daemon with a pending HITL proposal could not shut down).
         this.#engine.cancelAllProposals("daemon_stopping");
-        for (const scope of this.#runAborts.values()) {
+        for (const scope of this.#workerAborts.values()) {
             if (!scope.signal.aborted)
                 scope.abort("daemon_stopping");
         }
         for (const t of this.#pollTimers.values())
             clearTimeout(t); // drop pending hibernation poll-wakes
         this.#pollTimers.clear();
+        // …and the park-DEADLINE timers (#432): a bounded park's timer fires #wakeParkedWorker after
+        // stop/db-close if left pending — an unhandled rejection (SqlRite closed) that abnormally
+        // exits the worker under load. Symmetric with the poll-wakes above; both must be reaped.
+        for (const t of this.#parkTimers.values())
+            clearTimeout(t);
+        this.#parkTimers.clear();
         const drainPromises = [...this.#activeDrains.values()].map((d) => d.promise);
         await Promise.allSettled(drainPromises);
         await this.#drainStreamingSchemes();
@@ -496,25 +502,25 @@ export default class Daemon {
             await exec.idle();
     }
     /**
-     * Emit a stream/event notification scoped to the session containing the
+     * Emit a stream/event notification scoped to the workspace containing the
      * entry. ChannelWrite helpers (src/core/ChannelWrite.ts) invoke this when
      * they update channel content or state. SPEC §notifications.
      */
-    notifyStreamEvent(sessionId, event) {
-        this.#broadcast({ sessionId }, "stream/event", event);
+    notifyStreamEvent(workspaceId, event) {
+        this.#broadcast({ workspaceId }, "stream/event", event);
     }
     /**
-     * Emit a telemetry/event notification scoped to the session containing
+     * Emit a telemetry/event notification scoped to the workspace containing
      * the loop. TelemetryChannel.push invokes this for every TelemetryEvent
      * (parse_error, strike, cycle, sudden_death, no_ops, max_commands_exceeded,
      * action_failure) the moment it lands in the loop's telemetry buffer.
      * SPEC §telemetry.
      */
-    notifyTelemetryEvent(sessionId, payload) {
-        this.#broadcast({ sessionId }, "telemetry/event", payload);
+    notifyTelemetryEvent(workspaceId, payload) {
+        this.#broadcast({ workspaceId }, "telemetry/event", payload);
     }
     /**
-     * Inject a prompt into a run. Two paths:
+     * Inject a prompt into a worker. Two paths:
      *   - Active drain: writes a plurnk://prompt/<run>/<loop>/<next-turn> entry
      *     via Engine.inject. Current loop sees the new prompt at its next
      *     turn. Returns immediately with {action: "injected_next_turn"}.
@@ -530,12 +536,12 @@ export default class Daemon {
     // to: an inject carrying flags that DIFFER from the target loop's effective flags is refused
     // legibly (cancel the loop or omit the flags), never a silent posture discard. Identical or
     // absent flags fold clean.
-    async #assertFoldPosture(runId, flags, loopId) {
+    async #assertFoldPosture(workerId, flags, loopId) {
         if (flags === undefined || Object.keys(flags).length === 0)
             return;
         const row = loopId !== undefined
             ? await this.#db.engine_get_loop_flags.get({ loop_id: loopId })
-            : await this.#db.drain_active_loop_flags.get({ run_id: runId });
+            : await this.#db.drain_active_loop_flags.get({ worker_id: workerId });
         const effective = { ...DEFAULT_LOOP_FLAGS, ...JSON.parse(row?.flags ?? "{}") };
         const conflicts = Object.entries(flags).filter(([k, v]) => v !== undefined && effective[k] !== v).map(([k, v]) => `${k}: ${JSON.stringify(effective[k])} → ${JSON.stringify(v)}`);
         if (conflicts.length > 0) {
@@ -543,41 +549,41 @@ export default class Daemon {
         }
     }
     async inject(args) {
-        const { sessionId, runId, prompt } = args;
+        const { workspaceId, workerId, prompt } = args;
         // Active loop (status=102)? Fold the wake/prompt into its next turn.
         // engine.inject returns null when no loop is currently executing, so
         // we enqueue a fresh loop below and ensure a drain claims it.
-        if (this.#activeDrains.has(runId)) {
-            await this.#assertFoldPosture(runId, args.flags); // #368 — a fold never silently discards intent
-            const result = await this.#engine.inject(runId, prompt);
+        if (this.#activeDrains.has(workerId)) {
+            await this.#assertFoldPosture(workerId, args.flags); // #368 — a fold never silently discards intent
+            const result = await this.#engine.inject(workerId, prompt);
             if (result !== null) {
                 return { action: "injected_next_turn", loopId: result.loopId, turnSeq: result.turnSeq };
             }
         }
-        // #55 — a run PARKED at 202 RESUMES that slept loop in place: the voice door (irc / loop.inject)
+        // #55 — a worker PARKED at 202 RESUMES that slept loop in place: the voice door (irc / loop.inject)
         // is a wake edge like a stream/child conclusion, not a fresh loop that orphans the parked one
-        // (which would leave the run non-quiescent forever). engine.inject writes the message as the
+        // (which would leave the worker non-quiescent forever). engine.inject writes the message as the
         // slept loop's next-turn prompt (the directed message — distinct from the env door, which
-        // resumes promptless); then re-queue + drain it. §run-lifecycle-wake-liveness.
-        if (!this.#activeDrains.has(runId)) {
-            const slept = await this.#db.drain_find_slept_loop.get({ run_id: runId });
+        // resumes promptless); then re-queue + drain it. §worker-lifecycle-wake-liveness.
+        if (!this.#activeDrains.has(workerId)) {
+            const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
             if (slept !== undefined) {
-                await this.#assertFoldPosture(runId, args.flags, slept.id); // #368 — the resume path drops nothing silently either
-                const injected = await this.#engine.inject(runId, prompt);
+                await this.#assertFoldPosture(workerId, args.flags, slept.id); // #368 — the resume path drops nothing silently either
+                const injected = await this.#engine.inject(workerId, prompt);
                 await this.#db.drain_resume_slept_loop.run({ loop_id: slept.id });
                 const started = await this.#ensureDrain({
-                    sessionId, runId, provider: args.provider, systemPrompt: args.systemPrompt,
+                    workspaceId, workerId, provider: args.provider, systemPrompt: args.systemPrompt,
                     maxTurns: args.maxTurns ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
                 });
                 return { action: "injected_next_turn", loopId: slept.id, ...(injected?.turnSeq !== undefined ? { turnSeq: injected.turnSeq } : {}), ...(started ?? {}) };
             }
         }
         // Enqueue a fresh loop. Persist flags on the row.
-        const seqRow = await this.#db.loop_run_next_sequence.get({ run_id: runId });
+        const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
         if (seqRow === undefined)
             throw new Error("inject: next-sequence query returned no row");
         const loopRow = await this.#db.drain_enqueue_loop.get({
-            run_id: runId, sequence: seqRow.next, prompt,
+            worker_id: workerId, sequence: seqRow.next, prompt,
         });
         if (loopRow === undefined)
             throw new Error("inject: loop enqueue returned no row");
@@ -595,14 +601,14 @@ export default class Daemon {
             });
         }
         // Guarantee a drain claims the loop we just enqueued. #ensureDrain runs its
-        // check-and-start UNDER the per-run drain lock (§run-lifecycle-single-drain),
+        // check-and-start UNDER the per-worker drain lock (§worker-lifecycle-single-drain),
         // serialized against a draining sibling's teardown relinquish so the two can't
         // both register a drain (R4). A live drain re-claims the loop in its own
         // iteration or its lock-held exit re-claim, so it's never stranded.
         // firstLoopPromise is present only when THIS call started the drain — loop.run
         // keys its fast-path response on that.
         const started = await this.#ensureDrain({
-            sessionId, runId, provider: args.provider,
+            workspaceId, workerId, provider: args.provider,
             systemPrompt: args.systemPrompt,
             maxTurns: args.maxTurns ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
         });
@@ -612,7 +618,7 @@ export default class Daemon {
      * Start a drain for the given run. The drain claims queued loops via
      * drain_claim_next_loop (atomic 100→102 flip), executes each via
      * Engine.runLoop, and re-checks. Stream-aware: when the queue is empty
-     * but the run has active subscriptions, the drain parks on a
+     * but the worker has active subscriptions, the drain parks on a
      * #drainPokes signal — wake-on-completion → inject() wakes it. Drain
      * exits when queue is empty AND no active subscriptions remain.
      *
@@ -622,10 +628,10 @@ export default class Daemon {
      * (resolves only when the whole drain finishes, queue+subs settled).
      */
     #startDrain(opts) {
-        const { sessionId, runId, provider, systemPrompt, maxTurns } = opts;
-        // The drain runs under the run's cancellation scope (shared with the
+        const { workspaceId, workerId, provider, systemPrompt, maxTurns } = opts;
+        // The drain runs under the worker's cancellation scope (shared with the
         // execs its loops spawn), so loop.cancel/shutdown abort it as a unit.
-        const controller = this.#runSignal(runId);
+        const controller = this.#workerSignal(workerId);
         const handle = {
             controller, promise: Promise.resolve(),
         };
@@ -636,7 +642,7 @@ export default class Daemon {
             rejectFirst = rej;
         });
         let firstSettled = false;
-        const claim = () => this.#db.drain_claim_next_loop.get({ run_id: runId });
+        const claim = () => this.#db.drain_claim_next_loop.get({ worker_id: workerId });
         const drainPromise = (async () => {
             let loopsDrained = 0;
             let lastResult = null;
@@ -646,16 +652,16 @@ export default class Daemon {
                     controller.signal.throwIfAborted();
                     let loopRow = await claim();
                     if (loopRow === undefined) {
-                        // Queue empty → teardown UNDER the per-run drain lock (R4 / I1),
+                        // Queue empty → teardown UNDER the per-worker drain lock (R4 / I1),
                         // serialized against #ensureDrain so a concurrent inject can't
                         // start a 2nd drain in the gap. Re-claim while holding the lock;
                         // relinquish the registry slot only if it's empty too. A loop
                         // that raced in is returned and run — we stay registered, so
                         // there's no transient delete for #ensureDrain to catch.
-                        loopRow = await this.#withDrainLock(runId, async () => {
+                        loopRow = await this.#withDrainLock(workerId, async () => {
                             const claimed = await claim();
-                            if (claimed === undefined && this.#activeDrains.get(runId) === handle) {
-                                this.#activeDrains.delete(runId);
+                            if (claimed === undefined && this.#activeDrains.get(workerId) === handle) {
+                                this.#activeDrains.delete(workerId);
                             }
                             return claimed;
                         });
@@ -666,11 +672,11 @@ export default class Daemon {
                     const onDispatch = (logEntryId) => {
                         void (async () => {
                             const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
-                            this.#broadcast({ sessionId }, "log/entry", { entry });
+                            this.#broadcast({ workspaceId }, "log/entry", { entry });
                         })();
                     };
                     const result = await this.#engine.runLoop({
-                        provider, sessionId, runId, loopId: loopRow.id, maxTurns,
+                        provider, workspaceId, workerId, loopId: loopRow.id, maxTurns,
                         messages: [
                             { role: "system", content: systemPrompt },
                             { role: "user", content: loopRow.prompt },
@@ -682,9 +688,9 @@ export default class Daemon {
                     if (result.finalStatus === 202) {
                         // The loop SLEPT (parked via [102]<T>/<-1>) — suspended, not terminated. Leave it at 202
                         // (resumable); no loop/terminated, no orphan-reconcile. A stream conclusion
-                        // (#handleWakeRun) re-queues it; and if it holds a polled stream, a poll timer
-                        // wakes it every P to inspect (§exec-poll). §run-lifecycle-wake-liveness.
-                        void this.#schedulePollWake(sessionId, runId, provider, systemPrompt);
+                        // (#handleWakeWorker) re-queues it; and if it holds a polled stream, a poll timer
+                        // wakes it every P to inspect (§exec-poll). §worker-lifecycle-wake-liveness.
+                        void this.#schedulePollWake(workspaceId, workerId, provider, systemPrompt).catch((err) => console.error("poll-wake scheduling failed:", err instanceof Error ? err.message : String(err)));
                         // §send-premature-terminate/[102]<T> — the park DEADLINE (grammar 0.75.0): the
                         // dispatcher recorded the marker's seconds; a bounded park is woken at T
                         // regardless of arrivals, so a park always has a next turn. -1 (indefinite:
@@ -693,25 +699,25 @@ export default class Daemon {
                         if (currentLoopId !== null) {
                             const deadline = this.#engine.parkDeadlines.get(currentLoopId);
                             this.#engine.parkDeadlines.delete(currentLoopId);
-                            const prior = this.#parkTimers.get(runId);
+                            const prior = this.#parkTimers.get(workerId);
                             if (prior !== undefined) {
                                 clearTimeout(prior);
-                                this.#parkTimers.delete(runId);
+                                this.#parkTimers.delete(workerId);
                             }
                             if (deadline !== undefined && deadline > 0) {
                                 const t = setTimeout(() => {
-                                    this.#parkTimers.delete(runId);
-                                    void this.#wakeParkedRun(sessionId, runId, provider, systemPrompt);
+                                    this.#parkTimers.delete(workerId);
+                                    void this.#wakeParkedWorker(workspaceId, workerId, provider, systemPrompt).catch((err) => console.error("park-deadline wake failed:", err instanceof Error ? err.message : String(err)));
                                 }, deadline * 1000);
                                 t.unref();
-                                this.#parkTimers.set(runId, t);
+                                this.#parkTimers.set(workerId, t);
                             }
                         }
-                        // Honor an OWED wake (§run-lifecycle-child-wake): a child/stream concluded while
-                        // this run was mid-turn, before it slept — resume in place rather than park blind,
+                        // Honor an OWED wake (§worker-lifecycle-child-wake): a child/stream concluded while
+                        // this worker was mid-turn, before it slept — resume in place rather than park blind,
                         // so a worker-run hibernation always returns. The loop is 202 here; reset to
                         // claimable and the drain re-runs it on the next claim below.
-                        if (this.#owedWakes.delete(runId)) {
+                        if (this.#owedWakes.delete(workerId)) {
                             await this.#db.drain_resume_slept_loop.run({ loop_id: loopRow.id });
                             continue;
                         }
@@ -720,9 +726,9 @@ export default class Daemon {
                         // conclude-before-block race). An idle wait never reaches here — it concluded at dispatch.
                         continue;
                     }
-                    this.#owedWakes.delete(runId); // the loop concluded (non-202) — no park to honor a held wake at
+                    this.#owedWakes.delete(workerId); // the loop concluded (non-202) — no park to honor a held wake at
                     const usage = await this.#engine.loopUsage(loopRow.id);
-                    this.#broadcast({ sessionId }, "loop/terminated", {
+                    this.#broadcast({ workspaceId }, "loop/terminated", {
                         loopId: loopRow.id,
                         finalStatus: result.finalStatus,
                         hitMaxTurns: result.hitMaxTurns,
@@ -745,7 +751,7 @@ export default class Daemon {
                     // A next-turn prompt this loop ended before consuming (a
                     // wake conclusion or a loop.run-while-active) is promoted to
                     // a fresh queued loop so it's never silently dropped.
-                    await this.#reconcileOrphanedWake(runId, loopRow.id);
+                    await this.#reconcileOrphanedWake(workerId, loopRow.id);
                 }
             }
             catch (err) {
@@ -754,7 +760,7 @@ export default class Daemon {
                     // is the loop's TERMINAL state (499), delivered via loop/terminated (loop.run no
                     // longer blocks to return it). A genuine error rejects firstLoopPromise.
                     const usage = currentLoopId === null
-                        ? { promptTokens: 0, completionTokens: 0, costPico: 0, contextTokens: 0, contextSize: null, meta: {} }
+                        ? { promptTokens: 0, completionTokens: 0, costPico: 0, contextTokens: 0, promptBudget: null, meta: {} }
                         : await this.#engine.loopUsage(currentLoopId);
                     if (currentLoopId !== null) {
                         // #380 (owner ruling) — the cancel is allowed but provenanced: the ROW goes
@@ -764,7 +770,7 @@ export default class Daemon {
                         // loop.cancel reason (cancelDrain threads it through scope.abort).
                         const message = String(controller.signal.reason ?? "user_cancelled").slice(0, 500);
                         await this.#db.engine_loop_cancel_external.run({ loop_id: currentLoopId, message });
-                        this.#broadcast({ sessionId }, "loop/terminated", {
+                        this.#broadcast({ workspaceId }, "loop/terminated", {
                             loopId: currentLoopId, finalStatus: 499, hitMaxTurns: false, turnIds: [], usage, message,
                         });
                     }
@@ -787,7 +793,7 @@ export default class Daemon {
                         const message = (err instanceof Error ? err.message : String(err)).slice(0, 500);
                         await this.#db.engine_loop_set_status.run({ loop_id: currentLoopId, status: 500, message });
                         const usage = await this.#engine.loopUsage(currentLoopId);
-                        this.#broadcast({ sessionId }, "loop/terminated", {
+                        this.#broadcast({ workspaceId }, "loop/terminated", {
                             loopId: currentLoopId, finalStatus: 500, hitMaxTurns: false, turnIds: [], usage, message,
                         });
                     }
@@ -803,47 +809,47 @@ export default class Daemon {
                     firstSettled = true;
                     rejectFirst(new Error("drain exited without producing a result"));
                 }
-                if (this.#activeDrains.get(runId) === handle)
-                    this.#activeDrains.delete(runId);
+                if (this.#activeDrains.get(workerId) === handle)
+                    this.#activeDrains.delete(workerId);
             }
             return { loopsDrained, lastResult };
         })();
         handle.promise = drainPromise;
-        this.#activeDrains.set(runId, handle);
-        // Topology join (§run-lifecycle): when this drain exits having CONCLUDED the run, wake its parent
+        this.#activeDrains.set(workerId, handle);
+        // Topology join (§run-lifecycle): when this drain exits having CONCLUDED the worker, wake its parent
         // if parked. Runs after the drain fully tears down (settled promise) so the quiescence check sees
-        // final state; speculative (#onDrainExit no-ops unless the run concluded AND the parent is parked).
-        drainPromise.then(() => this.#onDrainExit(sessionId, runId, provider, systemPrompt)).catch(() => { });
+        // final state; speculative (#onDrainExit no-ops unless the worker concluded AND the parent is parked).
+        drainPromise.then(() => this.#onDrainExit(workspaceId, workerId, provider, systemPrompt)).catch(() => { });
         // Swallow unhandled rejections (drain aborts with no awaiter); the
         // error already surfaced via firstLoopPromise or was logged inside.
         drainPromise.catch(() => { });
         firstLoopPromise.catch(() => { });
         return { firstLoopPromise, drainPromise };
     }
-    // Per-run drain-transition lock (R4 / §run-lifecycle-single-drain). #ensureDrain's
+    // Per-run drain-transition lock (R4 / §worker-lifecycle-single-drain). #ensureDrain's
     // start and a drain's teardown relinquish both run under it, serialized, so the two
-    // can't interleave and register two drains for one run. The critical section is the
+    // can't interleave and register two drains for one worker. The critical section is the
     // registry decision only (never a loop's work) — a sub-ms hop at drain boundaries.
     // A promise-chain mutex: each caller awaits the prior holder; the tail self-prunes
     // when idle so the Map stays bounded to runs mid-transition.
-    #withDrainLock(runId, fn) {
-        const prev = this.#drainLocks.get(runId) ?? Promise.resolve();
+    #withDrainLock(workerId, fn) {
+        const prev = this.#drainLocks.get(workerId) ?? Promise.resolve();
         const run = prev.then(fn, fn);
         const tail = run.catch(() => { });
-        this.#drainLocks.set(runId, tail);
-        void tail.then(() => { if (this.#drainLocks.get(runId) === tail)
-            this.#drainLocks.delete(runId); });
+        this.#drainLocks.set(workerId, tail);
+        void tail.then(() => { if (this.#drainLocks.get(workerId) === tail)
+            this.#drainLocks.delete(workerId); });
         return run;
     }
-    // The drain guarantee, serialized per run via #withDrainLock so it can't race a
+    // The drain guarantee, serialized per worker via #withDrainLock so it can't race a
     // sibling drain's teardown relinquish into a double-drain (R4). A live drain
     // (registered, NOT aborting) will claim the just-enqueued loop in its own iteration
     // or its lock-held exit re-claim → return null. A registered-but-ABORTING drain is
     // in teardown and won't claim, so we don't defer to it — start fresh, or the loop
     // strands on a cancel/resume race (I6 no-lost-loop). Otherwise start one.
     #ensureDrain(opts) {
-        return this.#withDrainLock(opts.runId, async () => {
-            const existing = this.#activeDrains.get(opts.runId);
+        return this.#withDrainLock(opts.workerId, async () => {
+            const existing = this.#activeDrains.get(opts.workerId);
             if (existing !== undefined && !existing.controller.signal.aborted)
                 return null;
             return this.#startDrain(opts);
@@ -854,17 +860,17 @@ export default class Daemon {
     // that landed on a turn the loop didn't reach — into a fresh queued loop.
     // The drain claims it on its next iteration, so a conclusion or client
     // prompt is never silently dropped. Inherits the ended loop's flags.
-    async #reconcileOrphanedWake(runId, endedLoopId) {
+    async #reconcileOrphanedWake(workerId, endedLoopId) {
         const endedSeq = (await this.#db.engine_loop_sequence.get({ loop_id: endedLoopId }))?.sequence ?? endedLoopId;
-        const prefix = promptLoopPrefix(runId, endedSeq);
+        const prefix = promptLoopPrefix(workerId, endedSeq);
         const orphan = await this.#db.drain_orphaned_prompt_for_loop.get({ loop_id: endedLoopId, pattern: `${prefix}%`, prefix_len: prefix.length });
         if (orphan === undefined)
             return;
-        const seqRow = await this.#db.loop_run_next_sequence.get({ run_id: runId });
+        const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
         if (seqRow === undefined)
             throw new Error("reconcileOrphanedWake: next-sequence query returned no row");
         const fresh = await this.#db.drain_enqueue_loop.get({
-            run_id: runId, sequence: seqRow.next, prompt: orphan.body,
+            worker_id: workerId, sequence: seqRow.next, prompt: orphan.body,
         });
         if (fresh === undefined)
             throw new Error("reconcileOrphanedWake: enqueue returned no row");
@@ -872,89 +878,89 @@ export default class Daemon {
             await this.#db.engine_set_loop_flags.run({ loop_id: fresh.id, flags: orphan.flags });
         }
     }
-    // The run's cancellation scope — lazily created, and replaced once aborted
+    // The worker's cancellation scope — lazily created, and replaced once aborted
     // so a later loop.run gets a live signal. The drain and the execs its loops
     // spawn all run under it.
-    #runSignal(runId) {
-        const existing = this.#runAborts.get(runId);
+    #workerSignal(workerId) {
+        const existing = this.#workerAborts.get(workerId);
         if (existing !== undefined && !existing.signal.aborted)
             return existing;
         const fresh = new AbortController();
-        this.#runAborts.set(runId, fresh);
+        this.#workerAborts.set(workerId, fresh);
         return fresh;
     }
     /**
-     * Cancel the run's in-flight work (loop.cancel). One abort, one scope: the
+     * Cancel the worker's in-flight work (loop.cancel). One abort, one scope: the
      * run signal stops the running loop's turn generation AND tears down every
      * stream linked to it — a background exec that outlived its loop, or even a
      * spawn that registers after this abort (it self-aborts against the aborted
      * signal). Returns cancelled iff there was work. Queued loops stay enqueued.
      */
-    cancelDrain(runId, reason = "user_cancelled") {
-        const hadDrain = this.#activeDrains.has(runId);
-        const hadWork = hadDrain || this.#runHasActiveStreams(runId);
-        // A cancel is deliberate — kill any pending hibernation poll-wake so it can't resurrect the run.
-        const pollTimer = this.#pollTimers.get(runId);
+    cancelDrain(workerId, reason = "user_cancelled") {
+        const hadDrain = this.#activeDrains.has(workerId);
+        const hadWork = hadDrain || this.#workerHasActiveStreams(workerId);
+        // A cancel is deliberate — kill any pending hibernation poll-wake so it can't resurrect the worker.
+        const pollTimer = this.#pollTimers.get(workerId);
         if (pollTimer !== undefined) {
             clearTimeout(pollTimer);
-            this.#pollTimers.delete(runId);
+            this.#pollTimers.delete(workerId);
         }
-        // Stop the active drain's turn-generation (its loop closes 499). The run
+        // Stop the active drain's turn-generation (its loop closes 499). The worker
         // signal is the optimization path — the fast, listener-driven reap.
-        const scope = this.#runAborts.get(runId);
+        const scope = this.#workerAborts.get(workerId);
         if (scope !== undefined && !scope.signal.aborted)
             scope.abort(reason);
         // #380, the PARKED case — a 202-blocked loop has no drain to observe the abort (the
         // drain tears down on 202), so before this a cancelled park stayed 202 forever with no
-        // terminal and no broadcast. Terminalize the run's live loops (102/202; queued 100 stays
+        // terminal and no broadcast. Terminalize the worker's live loops (102/202; queued 100 stays
         // enqueued) with provenance and broadcast each. With a live drain its abort catch does
         // this instead — skipping here keeps the broadcast single.
         if (!hadDrain) {
             void (async () => {
                 const message = reason.slice(0, 500);
-                const dead = await this.#db.engine_run_cancel_live_loops.all({ run_id: runId, message });
+                const dead = await this.#db.engine_worker_cancel_live_loops.all({ worker_id: workerId, message });
                 if (dead.length === 0)
                     return;
-                const srow = await this.#db.drain_get_run_session.get({ run_id: runId });
+                const srow = await this.#db.drain_get_worker_workspace.get({ worker_id: workerId });
                 if (srow === undefined)
                     return;
                 for (const { id } of dead) {
                     const usage = await this.#engine.loopUsage(id);
-                    this.#broadcast({ sessionId: srow.session_id }, "loop/terminated", {
+                    this.#broadcast({ workspaceId: srow.workspace_id }, "loop/terminated", {
                         loopId: id, finalStatus: 499, hitMaxTurns: false, turnIds: [], usage, message,
                     });
                 }
             })().catch((err) => {
-                console.error(`cancelDrain(${runId}) live-loop terminalize failed:`, err);
+                console.error(`cancelDrain(${workerId}) live-loop terminalize failed:`, err);
             });
         }
-        // Total reap by the REGISTRY (§run-lifecycle-total-reap): the durable source
-        // of truth. Every open subscription the run holds, aborted via its owning
+        // Total reap by the REGISTRY (§worker-lifecycle-total-reap): the durable source
+        // of truth. Every open subscription the worker holds, aborted via its owning
         // scheme — independent of the signal-listener timing, so an exec mid-spawn
         // (registry row written before it is killable) is reaped too. A late spawn
         // (registering after this) self-aborts against its captured, now-aborted
         // epoch (§exec-timeout). Idempotent; fire-and-forget (the
         // abort is sync, the registry read async; the 499 conclusion surfaces async).
-        void this.#reapRunStreams(runId).catch((err) => {
-            console.error(`reapRunStreams(${runId}) failed:`, err);
+        void this.#reapWorkerStreams(workerId).catch((err) => {
+            console.error(`reapWorkerStreams(${workerId}) failed:`, err);
         });
         return hadWork;
     }
-    // Does the run have an in-flight stream (a background exec)? Used only for
+    // Does the worker have an in-flight stream (a background exec)? Used only for
     // loop.cancel's cancelled=true/false answer; the teardown itself rides the
     // run signal. Duck-typed like #drainStreamingSchemes.
-    #runHasActiveStreams(runId) {
+    #workerHasActiveStreams(workerId) {
         const exec = this.#schemes.get("exec");
-        return exec?.hasActiveSpawns?.(runId) ?? false;
+        return exec?.hasActiveSpawns?.(workerId) ?? false;
     }
-    // The registry-routed reap (§run-lifecycle-total-reap): every open subscription
-    // the run holds, aborted via its owning scheme. The durable answer to "reap
+    // The registry-routed reap (§worker-lifecycle-total-reap): every open subscription
+    // the worker holds, aborted via its owning scheme. The durable answer to "reap
     // everything" — the in-process AbortSignal listener is the optimization, this is
     // the source of truth: an exec mid-spawn (registry row written before it is
     // killable) or a background exec from any past loop is caught regardless of
     // listener timing. Idempotent — a stream the signal already reaped is a no-op.
-    async #reapRunStreams(runId) {
-        const open = await ChannelWrite.findOpenSubscriptionsForRun(this.#db, runId);
+    async #reapWorkerStreams(workerId) {
+        const open = await ChannelWrite.findOpenSubscriptionsForWorker(this.#db, workerId);
         for (const { id, scheme } of open) {
             const handler = this.#schemes.get(scheme);
             handler?.abortSubscription?.(id);
@@ -962,7 +968,7 @@ export default class Daemon {
     }
     /**
      * Wake-on-completion handler. Streaming schemes call this when a
-     * subscription closes. If the run has an active loop, the channel
+     * subscription closes. If the worker has an active loop, the channel
      * transition will surface at that loop's next turn boundary — no new
      * loop needed. Otherwise we open a fresh loop with the synthetic
      * summary as the user prompt so the model gets a chance to react.
@@ -973,65 +979,53 @@ export default class Daemon {
      *
      * Rummy parallel: plugins/stream/stream.js stream/completed wake:true.
      */
-    async #handleWakeRun(payload) {
+    async #handleWakeWorker(payload) {
         // §search-gate — settle the dedup registration: promote on a 200 conclusion, drop on
         // failure (a dead search must never serve as a duplicate). No-op for non-search streams.
         this.#engine.searchGate.settle(payload.target.replace(/^[a-z+.-]+:\/\//, "/").replace(/^\/+/, "/"), payload.closeStatus);
-        // §search-prefetch — page conclusions from the pass's own fan-out are sync-write
-        // internals, never wake edges; swallow them (still broadcast for client telemetry).
-        if (this.#engine.searchPrefetch.ownsConclusion(payload)) {
-            this.#broadcast({ sessionId: payload.sessionId }, "stream/concluded", { ...payload, wakeAction: "prefetch-page" });
-            return;
-        }
-        // §search-prefetch — a search runtime concluded: materialize the candidates and rewrite
-        // #results as the survivor render BEFORE the wake proceeds, so the fold-back the model
-        // reads is post-prefetch truth (the Engine hold loop holds while the pass runs).
-        if (this.#engine.searchPrefetch.isSearchConclusion(payload)) {
-            await this.#engine.searchPrefetch.onSearchConcluded(payload, (s, r) => this.#engine.prefetchCtx(s, r));
-        }
         // Aborted streams don't wake — the abort was deliberate.
         if (payload.closeStatus === 499) {
-            this.#broadcast({ sessionId: payload.sessionId }, "stream/concluded", {
+            this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                 ...payload, wakeAction: "skipped-aborted",
             });
             return;
         }
-        // No resurrection (§run-lifecycle-no-resurrection): a non-499 completion whose
+        // No resurrection (§worker-lifecycle-no-resurrection): a non-499 completion whose
         // run was CANCELLED (idle + its scope aborted) must not start a fresh drain —
         // the cancel was deliberate. The deliverable is already in the channel/log and
-        // surfaces as a `collect` environment delta (§env-delta) if the run is read or
+        // surfaces as a `collect` environment delta (§env-delta) if the worker is read or
         // resumed; we just don't inject a turn. (An active run folds the wake into its
         // next turn via inject below; a resumed run is active, never aborted, so it is
         // unaffected.)
-        const scope = this.#runAborts.get(payload.runId);
-        if (scope?.signal.aborted === true && !this.#activeDrains.has(payload.runId)) {
-            this.#broadcast({ sessionId: payload.sessionId }, "stream/concluded", {
+        const scope = this.#workerAborts.get(payload.workerId);
+        if (scope?.signal.aborted === true && !this.#activeDrains.has(payload.workerId)) {
+            this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                 ...payload, wakeAction: "skipped-cancelled",
             });
             return;
         }
         if (this.#provider === null) {
-            this.#broadcast({ sessionId: payload.sessionId }, "stream/concluded", {
+            this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                 ...payload, wakeAction: "skipped-no-provider",
             });
             return;
         }
         try {
             const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-            // A slept (202) loop means the run PARKED ([102]<T>/<-1>) → RESUME it IN PLACE: re-queue
+            // A slept (202) loop means the worker PARKED ([102]<T>/<-1>) → RESUME it IN PLACE: re-queue
             // it (202→100) so the drain re-claims and CONTINUES it (seq>1 → no re-foist). Checked
-            // FIRST: the slept status is the run's true disposition regardless of a draining
+            // FIRST: the slept status is the worker's true disposition regardless of a draining
             // sibling mid-teardown (the #ensureDrain lock serializes the re-claim). No fresh loop,
             // no summary-as-prompt — the resumed loop reads the concluded stream's own state from
-            // the manifest. §run-lifecycle-wake-liveness.
-            const slept = await this.#db.drain_find_slept_loop.get({ run_id: payload.runId });
+            // the manifest. §worker-lifecycle-wake-liveness.
+            const slept = await this.#db.drain_find_slept_loop.get({ worker_id: payload.workerId });
             if (slept !== undefined) {
                 await this.#db.drain_resume_slept_loop.run({ loop_id: slept.id });
                 const started = await this.#ensureDrain({
-                    sessionId: payload.sessionId, runId: payload.runId, provider: this.#provider,
+                    workspaceId: payload.workspaceId, workerId: payload.workerId, provider: this.#provider,
                     systemPrompt, maxTurns: Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
                 });
-                this.#broadcast({ sessionId: payload.sessionId }, "stream/concluded", {
+                this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                     ...payload, wakeAction: "resumed-loop", wakeLoopId: slept.id,
                 });
                 started?.drainPromise?.catch((err) => {
@@ -1043,15 +1037,15 @@ export default class Daemon {
             // environment-observation injector (§exec-stream) on its next turn — there is no prompt
             // to inject and NO task to overwrite. The obsolete "automated environment update"
             // synthesis (which clobbered the model's actual goal) is retired; just tell the client.
-            if (this.#activeDrains.has(payload.runId)) {
-                this.#broadcast({ sessionId: payload.sessionId }, "stream/concluded", {
+            if (this.#activeDrains.has(payload.workerId)) {
+                this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                     ...payload, wakeAction: "no-op-active-loop",
                 });
                 return;
             }
             // No slept loop, no active drain — nothing to resume (e.g. a SEND[200]-done run whose
             // streams were swept). Surface the conclusion without opening a loop.
-            this.#broadcast({ sessionId: payload.sessionId }, "stream/concluded", {
+            this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                 ...payload, wakeAction: "no-loop",
             });
         }
@@ -1061,18 +1055,18 @@ export default class Daemon {
     }
     /**
      * grammar 0.74.20 EXEC `<T,P>` — schedule a hibernation poll-wake. Called when a loop parks at
-     * a park; if the run holds an open polled stream, arm a timer for its tightest cadence P that
+     * a park; if the worker holds an open polled stream, arm a timer for its tightest cadence P that
      * resumes the slept loop so the model inspects progress. While the loop is ACTIVE there is no
      * poll work — ambient folded stream deltas already surface progress (§exec-stream); the wake
      * matters only across hibernation. A wake-edge-less 202 (no polled stream) gets no timer. §exec-poll
      */
-    async #schedulePollWake(sessionId, runId, provider, systemPrompt) {
-        const existing = this.#pollTimers.get(runId);
+    async #schedulePollWake(workspaceId, workerId, provider, systemPrompt) {
+        const existing = this.#pollTimers.get(workerId);
         if (existing !== undefined) {
             clearTimeout(existing);
-            this.#pollTimers.delete(runId);
+            this.#pollTimers.delete(workerId);
         }
-        const row = await this.#db.drain_run_min_poll.get({ run_id: runId });
+        const row = await this.#db.drain_worker_min_poll.get({ worker_id: workerId });
         const pollSec = row?.poll_seconds ?? null;
         if (pollSec === null || pollSec <= 0)
             return; // no polled stream → the 202 just sleeps (woken only by conclusion)
@@ -1080,71 +1074,71 @@ export default class Daemon {
         // faster than a turn settles — §exec-poll.
         const execWaitMs = Number(process.env.PLURNK_SERVICE_EXEC_WAIT_MS ?? "0");
         const timer = setTimeout(() => {
-            this.#pollTimers.delete(runId);
-            void this.#wakeParkedRun(sessionId, runId, provider, systemPrompt);
+            this.#pollTimers.delete(workerId);
+            void this.#wakeParkedWorker(workspaceId, workerId, provider, systemPrompt);
         }, Math.max(pollSec * 1000, execWaitMs));
         timer.unref();
-        this.#pollTimers.set(runId, timer);
+        this.#pollTimers.set(workerId, timer);
     }
-    /** Resume `runId`'s slept (202) loop in place — the same 202→100 resume #handleWakeRun uses, minus a
+    /** Resume `workerId`'s slept (202) loop in place — the same 202→100 resume #handleWakeWorker uses, minus a
      *  wake payload. The shared wake primitive: a poll cadence (§exec-poll), a watched stream concluding,
-     *  or a child run finishing (§run-lifecycle topology join) all call this. A no-op if the run was
+     *  or a child worker finishing (§run-lifecycle topology join) all call this. A no-op if the worker was
      *  cancelled or isn't actually parked (no slept loop) — so calling it speculatively is safe. */
-    async #wakeParkedRun(sessionId, runId, provider, systemPrompt) {
-        const scope = this.#runAborts.get(runId);
-        if (scope?.signal.aborted === true && !this.#activeDrains.has(runId))
+    async #wakeParkedWorker(workspaceId, workerId, provider, systemPrompt) {
+        const scope = this.#workerAborts.get(workerId);
+        if (scope?.signal.aborted === true && !this.#activeDrains.has(workerId))
             return; // cancelled — no resurrection
-        const slept = await this.#db.drain_find_slept_loop.get({ run_id: runId });
+        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
         if (slept === undefined) {
-            // Not parked. If a drain is still ACTIVE, the run is mid-turn and about to park — the
+            // Not parked. If a drain is still ACTIVE, the worker is mid-turn and about to park — the
             // conclusion that fired this wake arrived before the 202 committed (the conclude-before-park
             // race). OWE the wake: the drain honors it at park so a worker-run hibernation never deadlocks.
             // (No active drain → already concluded/running; nothing to wake.)
-            if (this.#activeDrains.has(runId))
-                this.#owedWakes.add(runId);
+            if (this.#activeDrains.has(workerId))
+                this.#owedWakes.add(workerId);
             return;
         }
         await this.#db.drain_resume_slept_loop.run({ loop_id: slept.id });
         const started = await this.#ensureDrain({
-            sessionId, runId, provider, systemPrompt,
+            workspaceId, workerId, provider, systemPrompt,
             maxTurns: Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
         });
         started?.drainPromise?.catch((err) => {
             console.error("wake-parked resume drain failed:", err instanceof Error ? err.message : String(err));
         });
     }
-    /** A run's drain exited. If the run truly CONCLUDED — no 202-blocked loop, no open stream — then
+    /** A worker's drain exited. If the worker truly CONCLUDED — no 202-blocked loop, no open stream — then
      *  wake its PARENT in place if the parent is blocked on the join (the structured-concurrency join — a
-     *  child finishing is the wake edge for a parent that waited on it, §run-lifecycle-child-wake). A run
+     *  child finishing is the wake edge for a parent that waited on it, §worker-lifecycle-child-wake). A worker
      *  blocked at 202, or still holding a stream, is NOT concluded — its own wake edges drive it, not this.
-     *  The parent reads the child's deliverable from its own log (the §run-scheme-collect delta) on
+     *  The parent reads the child's deliverable from its own log (the §worker-scheme-collect delta) on
      *  resume — control edge here, never an injected prompt. Recurses up via the parent's own drain-exit. */
-    async #onDrainExit(sessionId, runId, provider, systemPrompt) {
-        const slept = await this.#db.drain_find_slept_loop.get({ run_id: runId });
+    async #onDrainExit(workspaceId, workerId, provider, systemPrompt) {
+        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
         if (slept !== undefined)
-            return; // parked at 202 — not concluded, the run is still alive
-        const openSubs = await this.#db.find_open_subscriptions_for_run.all({ run_id: runId });
+            return; // parked at 202 — not concluded, the worker is still alive
+        const openSubs = await this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId });
         if (openSubs.length > 0)
             return; // a stream still runs — its conclusion re-evaluates, not this exit
-        const parent = await this.#db.run_parent_id.get({ run_id: runId });
-        if (parent?.parent_run_id == null)
+        const parent = await this.#db.worker_parent_id.get({ worker_id: workerId });
+        if (parent?.parent_worker_id == null)
             return; // a root run — nobody to wake
-        await this.#wakeParkedRun(sessionId, parent.parent_run_id, provider, systemPrompt);
+        await this.#wakeParkedWorker(workspaceId, parent.parent_worker_id, provider, systemPrompt);
     }
     #broadcast(target, method, params) {
         if (target === "all") {
-            // A global engine event (e.g. session/created) — emitted to the seam with sessionId null (#355).
+            // A global engine event (e.g. workspace/created) — emitted to the seam with workspaceId null (#355).
             for (const sub of this.#eventSubscribers)
                 sub(null, method, params);
             return;
         }
-        const sessionId = target.sessionId;
+        const workspaceId = target.workspaceId;
         // Publish the raw event to the in-process source first (#355) — transport modules subscribe
         // here (plurnk-agui renders to AG-UI+). Each subscriber owns its own fan-out; core just emits.
         for (const sub of this.#eventSubscribers)
-            sub(sessionId, method, params);
-        // Scope-stamping onto the notification envelope (§notifications-envelope-carries-sessionid)
-        // is each subscriber's edge concern now — the seam hands (sessionId, method, params) raw.
+            sub(workspaceId, method, params);
+        // Scope-stamping onto the notification envelope (§notifications-envelope-carries-workspaceid)
+        // is each subscriber's edge concern now — the seam hands (workspaceId, method, params) raw.
     }
 }
 //# sourceMappingURL=Daemon.js.map