@plurnk/plurnk-service 1.10.1 → 1.12.0

package/dist/core/Dispatcher.js

@@ -6,7 +6,9 @@ import Fork from "./fork.js";
 import WorkerCap from "./worker-cap.js";
 import { PathSyntax, TagSignal } from "@plurnk/plurnk-contracts";
 import Namespace from "./namespace.js";
-import LoopFlagsReader from "./LoopFlagsReader.js";
+import LoopPolicyReader from "./LoopPolicyReader.js";
+import CapabilityResolver from "./CapabilityResolver.js";
+import CapabilityPolicies from "./CapabilityPolicies.js";
 import ChannelWrite from "./ChannelWrite.js";
 import { ReadProjector } from "../content/index.js";
 import SchemeCtxImpl from "./caps/SchemeCtxImpl.js";
@@ -17,12 +19,13 @@ import TerminalResult from "./TerminalResult.js";
 import Results from "./results.js";
 import { OperationFailureError } from "./results.js";
 import EffectPolicy from "../schemes/EffectPolicy.js";
-import WorkerSettingsReader from "./worker-settings.js";
 import { CoreSchemeAdapterBase } from "./CoreSchemeServices.js";
 import { InvalidOperationResultError, } from "@plurnk/plurnk-schemes";
 import DurableStatement from "./DurableStatement.js";
 import ResourceMutations from "./ResourceMutations.js";
 import LogBody from "./LogBody.js";
+import LogVisibility from "./LogVisibility.js";
+import ErrorDetail from "./ErrorDetail.js";
 // SPEC {§scheme-surface}: writer must be in target scheme's manifest.writableBy.
 // OPEN/FOLD/READ/FIND are not gated — they curate the log or read, never mutating an entry.
 const MUTATING_OPS = new Set(["EDIT", "SEND", "COPY", "MOVE", "EXEC", "KILL", "FORK", "WORK"]);
@@ -38,6 +41,8 @@ const assertClassifyingSignal = (statement) => {
     if (statement.op === "EXEC")
         TagSignal.applied(statement.tags ?? null); // {§exec-tag-signal}
 };
+const primaryTargetOf = (statement) => statement.op === "COPY" || statement.op === "MOVE" ? statement.source.target : statement.target;
+const primaryLineMarkerOf = (statement) => statement.op === "COPY" || statement.op === "MOVE" ? statement.source.lineMarker : statement.lineMarker;
 // Op dispatch ({§op-methods-op-dispatch}): admission, operation-owner routing,
 // durable log writing, and proposal lifecycle.
 class Dispatcher {
@@ -79,6 +84,7 @@ class Dispatcher {
     #lifecycle;
     #resourceMutations;
     #entryAddresses;
+    #capabilities;
     constructor({ db, schemes, mimetypes, weigh, notices, proposals, interactions, executors, loopSignal, settleDerivations, streamEventNotify, wakeWorkerNotify, injectWorker, branchWorker, branchCompletionGate, cancelWorker, cancelDescendants, parkDeadlines, joinTargets, liveSubscriptions, entryAddresses }) {
         this.#db = db;
         this.#schemes = schemes;
@@ -101,13 +107,14 @@ class Dispatcher {
         this.#joinTargets = joinTargets ?? new Set();
         this.#liveSubscriptions = liveSubscriptions;
         this.#entryAddresses = entryAddresses;
+        this.#capabilities = new CapabilityResolver(db, schemes, executors);
         this.#lifecycle = new LoopLifecycle(db);
         this.#resourceMutations = new ResourceMutations({
             schemes,
             liveSubscriptions,
             run: (schemeName, statement, ctx) => this.#run(schemeName, statement, ctx),
             checkWritable: (statement, origin, workerId) => this.#checkWritable(statement, origin, workerId),
-            checkFlagsGate: (statement, loopId, workerId) => this.#checkFlagsGate(statement, loopId, workerId),
+            checkCapabilities: (statement, workspaceId, loopId, workerId) => this.#checkCapabilities(statement, workspaceId, loopId, workerId),
             editTargetIdentity: (statement, workspaceId, workerId) => this.#editTargetIdentity(statement, workspaceId, workerId),
             canonicalFilePath: (pathname, workspaceId) => this.#canonicalFilePath(pathname, workspaceId),
             prepareDataRepresentation: (args) => this.#prepareDataRepresentation({
@@ -283,21 +290,24 @@ class Dispatcher {
     }
     async dispatch(context) {
         assertClassifyingSignal(context.statement); // {§log-tag-signal}
-        const result = await this.#dispatchOne(context);
+        let result = await this.#dispatchOne(context);
         if (context.statement.op === "EDIT") {
+            // {§edit-batch-merges} — a proposal's apply result replaces the projected one; the
+            // statement's merge facts ride every EDIT result, whichever route produced it.
+            result = this.#resourceMutations.withMergeFacts(context.statement, result);
             this.#resourceMutations.settleEdit(context.statement, result);
         }
         return result;
     }
     async #dispatchOne(context) {
-        const { statement, workspaceId, workerId, loopId, turnId, sequence, origin, onDispatch, } = context;
+        const { statement, workspaceId, workerId, loopId, turnId, sequence, origin, onDispatch, onSettled, } = context;
         const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, functionalityWorkerId: context.functionalityWorkerId, loopId, turnId, origin });
         const { functionalityWorkerId } = schemeCtx;
         let result;
         let curationPlan = null;
         let denial = this.#checkWritable(statement, origin, functionalityWorkerId);
         if (denial === null)
-            denial = await this.#checkFlagsGate(statement, loopId, functionalityWorkerId);
+            denial = await this.#checkCapabilities(statement, workspaceId, loopId, functionalityWorkerId);
         if (denial !== null) {
             result = denial;
         }
@@ -321,7 +331,9 @@ class Dispatcher {
                         origin,
                     });
                 }
-                else if (statement.op === "OPEN" || statement.op === "FOLD") {
+                else if (statement.op === "OPEN"
+                    || statement.op === "FOLD"
+                    || (statement.op === "KILL" && schemeNameOf(statement.target) === "log")) {
                     const curation = await this.#runLogCuration(statement, schemeCtx);
                     result = curation.result;
                     curationPlan = curation.plan;
@@ -342,22 +354,9 @@ class Dispatcher {
                     result = this.#handlePlan(statement);
                 }
                 else if (statement.op === "EXEC") {
-                    // {§worker-tool-admission} — the question runtime is admitted
-                    // per worker: a worker whose own rules don't request user input
-                    // gets the explicit not-available outcome, never a parked loop.
-                    if (("signal" in statement && typeof statement.signal === "string")
-                        && !(await WorkerSettingsReader.toolAvailable(this.#db, schemeCtx.functionalityWorkerId, statement.signal))) {
-                        result = _a.#failure("question-tool-unavailable", 404, "The question tool is not available to this worker.", {}, {
-                            stage: "tool-admission",
-                            recovery: "This worker does not request user input; continue from the available evidence.",
-                            retryable: false,
-                        });
-                    }
-                    else {
-                        // EXEC routes unconditionally to its operation owner. The
-                        // resolved runtime declaration owns body/target semantics.
-                        result = await this.#run("exec", statement, schemeCtx);
-                    }
+                    // EXEC routes unconditionally to its operation owner after
+                    // the shared capability resolver admits its runtime/tool.
+                    result = await this.#run("exec", statement, schemeCtx);
                 }
                 else {
                     result = await this.#run(schemeNameOf(statement.target), statement, schemeCtx); // {§op-methods-op-dispatch}
@@ -370,7 +369,7 @@ class Dispatcher {
                     result = err.result;
                 }
                 else {
-                    const scheme = schemeNameOf(statement.target);
+                    const scheme = schemeNameOf(primaryTargetOf(statement));
                     console.error(`Scheme '${scheme ?? "unknown"}' ${statement.op} threw outside its operation result contract:`, err);
                     result = _a.#failure("scheme-handler-threw", 500, `The '${scheme ?? "unknown"}' scheme did not produce a ${statement.op} result.`, {}, {
                         stage: "scheme-dispatch",
@@ -380,8 +379,8 @@ class Dispatcher {
                 }
             }
         }
-        // {§fold-open-meta-operations} — persist OPEN/FOLD for forensics;
-        // packet rendering suppresses their successful receipts.
+        // Persist log curation for forensics; packet rendering suppresses its
+        // successful receipts while the exact state effects remain durable.
         // A running-worker READ arms this turn's blocking collect.
         // {§join-blocking-collect}
         if (typeof result.awaitWorker === "string")
@@ -428,7 +427,9 @@ class Dispatcher {
                     ctx: schemeCtx,
                     ids: { workspaceId, workerId, functionalityWorkerId, loopId, turnId },
                 });
-                return this.#proposals.applyResolution(logEntryId, effective);
+                const post = await this.#proposals.applyResolution(logEntryId, effective);
+                await onSettled?.(logEntryId);
+                return post;
             }
             // Register the resolution waiter SYNCHRONOUSLY before any await
             // yields. A same-tick resolveProposal() (e.g. from a test that
@@ -448,6 +449,7 @@ class Dispatcher {
             }
             catch (cause) {
                 await this.#proposals.failPreparation(logEntryId, cause);
+                await onSettled?.(logEntryId);
                 throw cause;
             }
             const resolution = await resolutionPromise;
@@ -464,8 +466,10 @@ class Dispatcher {
                 ids: { workspaceId, workerId, functionalityWorkerId, loopId, turnId },
             });
             const post = await this.#proposals.applyResolution(logEntryId, effective);
+            await onSettled?.(logEntryId);
             return post;
         }
+        await onSettled?.(logEntryId);
         return result;
     }
     // {§op-look}: resolve a READ and return its content without writing a
@@ -479,11 +483,14 @@ class Dispatcher {
             throw new Error(`look resolves READ only; got ${statement.op}`);
         // turnId is a write-time FK only — a look writes no row, so 0 (no turn) is inert.
         const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, functionalityWorkerId: context.functionalityWorkerId, loopId, turnId: 0, origin });
-        const denial = await this.#checkFlagsGate(statement, loopId, schemeCtx.functionalityWorkerId);
+        const denial = await this.#checkCapabilities(statement, schemeCtx.workspaceId, loopId, schemeCtx.functionalityWorkerId);
         if (denial !== null)
             return denial;
         return this.#run(schemeNameOf(statement.target), statement, schemeCtx);
     }
+    capabilityProjection(workspaceId, workerId) {
+        return this.#capabilities.projection(workspaceId, workerId);
+    }
     // Resolve the client selector through the owning scheme before persistence
     // is consulted. Public schemes choose a semantic owner; core-owned authority
     // schemes may return the already-authorized principal key.
@@ -531,7 +538,13 @@ class Dispatcher {
         }
         return this.#entryAddresses.resolve({ target, routedScheme, handler, manifest, ctx });
     }
-    async #prepareDataRepresentation({ target, routedScheme, handler, manifest, ctx, publishedChannel, resolved: priorResolution, }) {
+    async #prepareDataRepresentation({ target, metadata, routedScheme, handler, manifest, ctx, publishedChannel, resolved: priorResolution, }) {
+        if (metadata !== null && manifest.metadataModifier !== true) {
+            return {
+                address: null,
+                result: _a.#failure("scheme-metadata-unsupported", 400, `Scheme '${routedScheme}' does not accept the {metadata} modifier.`, {}, { scheme: routedScheme, retryable: false }),
+            };
+        }
         const resolved = priorResolution ?? await this.#resolveDataEntryAddress({
             target, routedScheme, handler, manifest, ctx,
         });
@@ -555,6 +568,7 @@ class Dispatcher {
         });
         const prepared = Results.assertRepresentationPreparation(await handler.prepareRepresentation({
             target: selectionNeutralTarget,
+            metadata,
             authority: address.authority,
             pathname: address.pathname,
         }, preparationCtx));
@@ -584,7 +598,7 @@ class Dispatcher {
     #buildSchemeCtx(ids) {
         const { workspaceId, workerId, loopId, turnId, origin } = ids;
         const functionalityWorkerId = ids.functionalityWorkerId ?? workerId;
-        return {
+        const context = {
             db: this.#db,
             workspaceId, workerId, functionalityWorkerId, loopId, turnId,
             writer: origin,
@@ -597,11 +611,12 @@ class Dispatcher {
             // {§exec-stream} — a runtime scheme's default channel is its own (stdout), never the
             // catalog fallback `body`; resolved through the same registry the writable gate reads.
             defaultChannelFor: (scheme) => this.#schemes.defaultChannelFor(scheme, functionalityWorkerId),
-            settleDerivations: () => this.#settleDerivations(workspaceId),
-            pushNotice: (notice) => this.#notices.push(workspaceId, loopId, notice),
+            settleDerivations: () => this.#settleDerivations(context),
+            pushNotice: (notice) => this.#notices.push(workspaceId, workerId, loopId, notice),
             requestInteraction: (request) => this.#interactions.request(request, { workspaceId, workerId, loopId, turnId }, this.#loopSignal(loopId)),
             executors: this.#executors(),
         };
+        return context;
     }
     // SPEC {§scheme-surface}: engine rejects writes whose origin is outside the target
     // scheme's manifest.writableBy.
@@ -620,19 +635,27 @@ class Dispatcher {
         if (statement.op === "EXEC") {
             return this.#denyIfDisallowed("exec", origin, workerId);
         }
+        // {§stream-control} — a KILL of a runtime stream terminates the caller's own process; it
+        // writes nothing into that read-only output scheme (writableBy plugin), so the writer rule
+        // does not speak. Exec.kill scopes the stream to the caller ({§stream-owner-scoped}).
+        if (statement.op === "KILL") {
+            const target = schemeNameOf(statement.target);
+            if (target !== null && this.#schemes.isRuntimeScheme(target, workerId))
+                return null;
+        }
         // Worker control (FORK/WORK → worker://<name>, spawn or fork) is gated by worker://'s writableBy — its
         // body is a seed prompt, not a dst path, so the entry-COPY dst-parse below doesn't apply.
         // {§machine-processes}
         if (this.#isWorkerControl(statement))
             return this.#denyIfDisallowed("worker", origin, workerId);
         if (statement.op === "COPY" || statement.op === "MOVE") {
-            const dst = statement.body?.target ?? null;
+            const dst = statement.destination.target;
             const dstScheme = schemeNameOf(dst);
             const dstDenial = this.#denyIfDisallowed(dstScheme, origin, workerId);
             if (dstDenial !== null)
                 return dstDenial;
             if (statement.op === "MOVE") {
-                const srcScheme = schemeNameOf(statement.target);
+                const srcScheme = schemeNameOf(statement.source.target);
                 if (srcScheme !== dstScheme) {
                     const srcDenial = this.#denyIfDisallowed(srcScheme, origin, workerId);
                     if (srcDenial !== null)
@@ -643,14 +666,14 @@ class Dispatcher {
         }
         const target = schemeNameOf(statement.target);
         const denial = this.#denyIfDisallowed(target, origin, workerId);
-        // {§send-target-recipient} — a model's SEND to a scheme it may not write (the prompt,
-        // the log) was meant as the reply; the writer rule is true and teaches nothing. Name the
-        // form: the reply carries no target, a SEND target is a recipient (#367).
+        // {§send-target-recipient} — SEND addresses recipients, not otherwise
+        // read-only resources. State that boundary without guessing whether the
+        // model intended a reply, deletion, or directed message.
         if (denial !== null && statement.op === "SEND" && origin === "model") {
-            return _a.#failure("send-target-not-a-recipient", 400, "`## SEND0 [200]` answers the active prompt with no target.", {}, {
+            return _a.#failure("send-target-not-a-recipient", 400, "The addressed scheme is not a SEND recipient.", {}, {
                 target: statement.target?.raw ?? String(target),
                 stage: "dispatch",
-                recovery: "A SEND target is a recipient — `## SEND0 (worker://<name>)` — or, with `[410]`, a resource to delete.",
+                recovery: "A targetless SEND answers the active prompt; a directed SEND requires a recipient that implements SEND.",
                 retryable: false,
             });
         }
@@ -674,92 +697,25 @@ class Dispatcher {
             retryable: false,
         }); // {§scheme-surface-writableby-403}
     }
-    // Per-loop flag gating. Schemes self-declare their flag affinity in
-    // their manifest (excludedInAsk / requiresWeb /
-    // requiresInteraction); SchemeRegistry.resolveForLoop returns the
-    // active set under the loop's persisted flags. A registered scheme outside
-    // that set returns 403; unknown names continue to their operation owner for
-    // the ordinary registration failure. Action-entry-as-outcome carries either.
-    async #checkFlagsGate(statement, loopId, functionalityWorkerId) {
-        const workerId = functionalityWorkerId;
-        // Broadcast SEND has no scheme to gate.
-        if (statement.op === "SEND" && statement.target === null)
-            return null;
-        const flags = await LoopFlagsReader.read(this.#db, loopId);
-        // Fast path: default flags gate nothing. (auto never gates.)
-        if (!flags.noWeb && !flags.noInteraction && flags.mode === "act")
+    // {§capability-admission} — one resolver gates every operation route before
+    // execution or proposal handling. Unknown routes continue to their ordinary
+    // owner; a known policy denial is one factual, non-presumptuous 403.
+    async #checkCapabilities(statement, workspaceId, loopId, functionalityWorkerId) {
+        const denied = await this.#capabilities.denial(statement, workspaceId, functionalityWorkerId, loopId);
+        if (denied === null)
             return null;
-        // {§mode-ask-read-only} — the ancient contract: an ask-mode loop NEVER changes the world. The
-        // filesystem writes (EDIT/COPY-dest/MOVE/KILL touching the `file` scheme — each proposes disk
-        // egress, {§membership}) are refused HERE, regardless of the scheme's read-activity, because
-        // `file` stays active for READs. The EXEC host runtime is refused by its excludedInAsk scheme
-        // below. This lived only in SPEC (line 65) with no anchor → no guard → it silently regressed.
-        if (flags.mode === "ask") {
-            const isFile = (t) => schemeNameOf(t) === "file";
-            // Each branch narrows statement.op so statement.body is correctly typed (COPY dest is a
-            // resource selection). EDIT/KILL write the target; COPY writes the dest;
-            // MOVE deletes the source AND writes the dest - any `file` touch is a write.
-            let writesFilesystem = false;
-            if (statement.op === "EDIT" || statement.op === "KILL")
-                writesFilesystem = isFile(statement.target);
-            else if (statement.op === "COPY")
-                writesFilesystem = isFile(statement.body?.target ?? null);
-            else if (statement.op === "MOVE")
-                writesFilesystem = isFile(statement.target) || isFile(statement.body?.target ?? null);
-            if (writesFilesystem) {
-                return _a.#failure("ask-mode-read-only", 403, `${statement.op} cannot change the filesystem in an ask-mode loop.`, {}, {
-                    mode: flags.mode,
-                    operation: statement.op,
-                    recovery: "Answer or advise the user without changing the filesystem.",
-                    retryable: false,
-                });
-            }
-        }
-        const active = this.#schemes.resolveForLoop(flags, workerId);
-        // {§mode-ask-read-only}: name the non-retryable restriction so the model changes course.
-        const restriction = flags.mode === "ask"
-            ? "this is an ask-mode (read-only) loop — you cannot run commands or take host actions here"
-            : flags.noWeb && flags.noInteraction ? "web and interaction are disabled for this loop"
-                : flags.noWeb ? "web access is disabled for this loop"
-                    : "interaction is disabled for this loop";
-        const checkScheme = (scheme) => {
-            if (scheme === null || !this.#schemes.has(scheme, workerId))
-                return null;
-            if (active.has(scheme))
-                return null;
-            return _a.#failure("scheme-unavailable", 403, `Scheme '${scheme}' is unavailable because ${restriction}.`, {}, {
-                scheme,
-                recovery: "Answer or advise the user without using the unavailable scheme.",
-                retryable: false,
-            });
-        };
-        const check = (target) => checkScheme(schemeNameOf(target));
-        if (this.#isWorkerControl(statement))
-            return check(statement.target); // body is a spawn/fork task, not a dst path
-        if (statement.op === "COPY" || statement.op === "MOVE") {
-            return check(statement.target) ?? check(statement.body?.target ?? null);
-        }
-        // {§exec-target-routing} — only a runtime-declared resource target adds
-        // source authority. Literal identifiers and path targets stay executor-local.
-        if (statement.op === "EXEC") {
-            const operationDenial = checkScheme("exec");
-            if (operationDenial !== null)
-                return operationDenial;
-            const requested = typeof statement.signal === "string" ? statement.signal : "";
-            const runtime = requested === "" ? "sh" : requested;
-            // {§manifest-flag-affinity} — a runtime alias is a registered scheme
-            // with its own affinity: the one resolver gates the selected runtime
-            // exactly as it gates the exec family (e.g. `question` under noInteraction).
-            const runtimeDenial = checkScheme(runtime);
-            if (runtimeDenial !== null)
-                return runtimeDenial;
-            const targetKind = this.#executors()?.entry(runtime, workerId)?.invocation.target?.kind;
-            if (targetKind !== "resource")
-                return null;
-            const sourceScheme = schemeNameOf(statement.target);
-            return sourceScheme === null || sourceScheme === "file" ? null : checkScheme(sourceScheme);
-        }
-        return check(statement.target);
+        const { descriptor, scope } = denied;
+        const route = [
+            descriptor.operation,
+            descriptor.scheme,
+            descriptor.runtime,
+            descriptor.tool,
+        ].filter((part) => part !== undefined).join("/");
+        return _a.#failure("capability-denied", 403, `Capability '${route}' is denied by ${scope} policy.`, {}, {
+            ...descriptor,
+            policyScope: scope,
+            retryable: false,
+        });
     }
     // Worker control is FORK/WORK (grammar 0.74.55), not COPY — its body
     // is the new worker's seed prompt, not a destination path. The COPY gates and ResourceMutations.handleCopy
@@ -793,10 +749,15 @@ class Dispatcher {
         if (denied !== null)
             return denied;
         const prompt = statement.body;
-        // {§worker-delegation-inherits-flags} — authority flows down the delegation edge: the child's live
-        // loop runs with ITS DELEGATOR'S flags. A flagless (non-auto) child's every side-effecting op
-        // proposes into a resolver-less void — 300s auto-cancel per attempt was the fan-out wedge.
-        const flags = await LoopFlagsReader.read(this.#db, ctx.loopId);
+        // {§worker-delegation-inherits-policy} — authority flows down the
+        // delegation edge. The child receives the delegator's complete loop
+        // policy and an immutable snapshot of its effective capability bound.
+        const policy = await LoopPolicyReader.read(this.#db, ctx.loopId);
+        const capabilityBound = await CapabilityPolicies.delegationBound(this.#db, ctx.workspaceId, ctx.workerId, policy);
+        const delegationPolicy = {
+            ...policy,
+            capabilities: capabilityBound,
+        };
         // A name is frozen per worker but reclaimable across time ({§machine-processes-worker-origin}): a LIVE
         // sister holding it is a 409 (legible, never a raw UNIQUE 500); a free/terminated name reclaims.
         const live = await this.#db.worker_live_by_name.get({ workspace_id: ctx.workspaceId, name });
@@ -804,6 +765,16 @@ class Dispatcher {
             return _a.#failure("worker-already-running", 409, `Worker '${name}' is already running.`, {}, { worker: name, retryable: false });
         }
         if (typeof statement.signal === "string") {
+            // {§branch-delegation-disabled} — off the model-facing surface until it is specified and
+            // witnessed end to end (#396); the batches stay behind the operator knob.
+            if (process.env.PLURNK_SERVICE_BRANCH_DELEGATION !== "1") {
+                return _a.#failure("branch-delegation-disabled", 501, `${statement.op} takes no signal; branch delegation is not offered.`, {}, {
+                    worker: name,
+                    signal: statement.signal,
+                    recovery: `Spawn without a signal: \`## ${statement.op}0 (worker://${name})\` with the prompt as the body.`,
+                    retryable: false,
+                });
+            }
             if (this.#branchWorker === undefined)
                 throw new Error("branch worker control: branchWorker capability absent");
             const child = await this.#branchWorker({
@@ -815,7 +786,7 @@ class Dispatcher {
                 name,
                 branch: statement.signal,
                 prompt,
-                flags,
+                policy: delegationPolicy,
                 origin: ctx.writer,
             });
             return {
@@ -826,13 +797,13 @@ class Dispatcher {
         }
         if (statement.op === "FORK") {
             // Branch the current worker's log into a named sister.
-            const branchWorkerId = await Fork.fork(this.#db, ctx.workerId, name, (scheme) => this.#schemes.entryInheritanceForStoredScheme(scheme, ctx.workerId));
+            const branchWorkerId = await Fork.fork(this.#db, ctx.workerId, name, capabilityBound, (scheme) => this.#schemes.entryInheritanceForStoredScheme(scheme, ctx.workerId));
             await ctx.injectWorker({
                 workspaceId: ctx.workspaceId,
                 workerId: branchWorkerId,
                 sourceWorkerId: ctx.workerId,
                 prompt,
-                flags,
+                freshLoopPolicy: delegationPolicy,
                 parentLoopId: ctx.loopId,
             });
             return { status: 200, body: name };
@@ -841,6 +812,7 @@ class Dispatcher {
         const row = await this.#db.fork_insert_worker.get({
             workspace_id: ctx.workspaceId, name, parent_worker_id: ctx.workerId, origin: ctx.writer,
             fork_snapshot: 0,
+            capability_bound: JSON.stringify(capabilityBound),
         });
         if (row === undefined)
             throw new Error("worker spawn: worker insert returned no row");
@@ -849,7 +821,7 @@ class Dispatcher {
             workerId: row.id,
             sourceWorkerId: ctx.workerId,
             prompt,
-            flags,
+            freshLoopPolicy: delegationPolicy,
             parentLoopId: ctx.loopId,
         });
         return { status: 200, body: name };
@@ -869,8 +841,8 @@ class Dispatcher {
         }
         const manifest = this.#schemes.manifestFor(schemeName, ctx.functionalityWorkerId);
         const coordinate = entryCoordinateOf(path, manifest?.authority ?? "namespace");
-        // Log targets use the same killable dispatch as streams; erasure is their
-        // permanent curation operation. {§turn-ops-log-curation}
+        // log:/// KILL has already gone through the projection-curation owner.
+        // This path owns scheme-specific world and process KILL semantics.
         // Process-KILL: any scheme whose handler exposes kill() aborts a live stream — the
         // exec handler, registered as "exec" + under every runtime tag (sh/node), so a tag-
         // addressed stream (sh:///l/t/s) routes here, not to deleteEntry. {§exec}
@@ -997,11 +969,10 @@ class Dispatcher {
             }, this.#weighContent),
             state: "resolved", outcome: null,
             attrs: JSON.stringify(durableAttrs),
+            initial_folded: LogVisibility.serialize(folded ? LogVisibility.FOLDED : LogVisibility.OPEN),
         });
         if (row === undefined)
             throw new Error("Dispatcher.#writeActionlessEntry: insert returned no row");
-        if (folded)
-            await this.#db.engine_fold_log_entry.run({ id: row.id });
         return row.id;
     }
     // {§turn-ops-entry} — preserve exact admitted source beside, never instead
@@ -1026,7 +997,7 @@ class Dispatcher {
             },
         });
     }
-    // PLAN — the model's complete current Plan. An ordinary op: dispatched like any
+    // PLAN — one installment of the model's running work journal. An ordinary op: dispatched like any
     // other, logged, and broadcast to the client as a log entry — but a pure no-op for
     // state (PLAN ∉ MUTATING_OPS); its body serializes into the log row's tx, no effect.
     #handlePlan(statement) {
@@ -1047,6 +1018,7 @@ class Dispatcher {
             modelCallId,
         });
         context.onDispatch?.(logEntryId);
+        await context.onSettled?.(logEntryId);
         return result;
     }
     // {§send-premature-terminate} — the unified PENDING SET, judged at the terminal's OWN dispatch
@@ -1061,23 +1033,20 @@ class Dispatcher {
         const openSubs = await this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId });
         const execHandler = this.#schemes.get("exec");
         if (openSubs.length > 0 || execHandler?.hasActiveSpawns?.(workerId) === true)
-            pending.push("surviving streams");
+            pending.push("streams");
         const liveChild = await this.#db.engine_worker_has_live_child.get({ worker_id: workerId });
         if (liveChild !== undefined)
-            pending.push("surviving workers");
+            pending.push("workers");
         const boundaries = await this.#nextPacketBoundaries(workerId, turnId);
         if (boundaries.retrievals)
-            pending.push("this turn's receipts (READ/FIND/OPEN/BARE results and EDIT/COPY/MOVE effects land in the NEXT packet's Log)");
+            pending.push("receipts");
         // A stream that closed successfully is banked, not pending: concluding on its own
         // success is legitimate and its output stays in the Log. A failed close is an unseen
         // failure — named exactly (bench#5 requiem #9) so the model reads it, not guesses.
-        const failedStreams = boundaries.streamTerminations
-            .filter(({ closeStatus }) => closeStatus >= 400)
-            .map(({ handle }) => handle);
-        if (failedStreams.length > 0)
-            pending.push(`failed stream results that land in the NEXT packet's Log: ${failedStreams.join("; ")}`);
+        if (boundaries.streamTerminations.some(({ closeStatus }) => closeStatus >= 400))
+            pending.push("failed-stream-results");
         if (boundaries.childTerminations)
-            pending.push("worker results that arrived during this turn (they land NEXT turn)");
+            pending.push("worker-results");
         return pending;
     }
     // Results cross an observation boundary only when they have appeared in a packet;
@@ -1109,16 +1078,15 @@ class Dispatcher {
         return failedRows.length;
     }
     static #unobservedFailures(failCount) {
-        return _a.#failure("unobserved-failures", 409, `Completion was refused because ${failCount} failed operation(s) from this turn have not been observed.`, {}, {
+        return _a.#failure("unobserved-failures", 409, `This turn produced ${failCount} failed operation result(s) that have not yet entered a packet.`, {}, {
             failures: failCount,
             stage: "completion",
-            recovery: "Review the failed log items before concluding.",
             retryable: false,
         });
     }
     // J — a live obligation to WAIT on: a spawned child or an open stream (NOT retrievals, which land
     // next turn regardless). The wait-side twin of #pendingSet's stream+child legs ({§wait-obligation-matrix}).
-    async #hasLiveWork(workerId) {
+    async hasLiveWork(workerId) {
         const openSubs = await this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId });
         if (openSubs.length > 0)
             return true;
@@ -1165,8 +1133,9 @@ class Dispatcher {
         // retrieval (R) just lands next turn, so the wait continues.
         if (status === 202) {
             const marks = statement.lineMarker?.marks[0];
-            const seconds = typeof marks === "number" ? marks : -1; // bare 202 / absent T = indefinite, bounded by the join
-            if (await this.#hasLiveWork(workerId)) {
+            // `<T>` is MINUTES, held in seconds; bare 202 / absent T = indefinite, bounded by the join.
+            const seconds = typeof marks === "number" ? (marks > 0 ? marks * 60 : marks) : -1;
+            if (await this.hasLiveWork(workerId)) {
                 if (!await this.#lifecycle.park(loopId)) {
                     return _a.#statusResult(await this.#lifecycle.status(loopId), "loop-already-terminal", "The loop was already terminal when SEND attempted to wait.");
                 }
@@ -1214,19 +1183,17 @@ class Dispatcher {
                 if (pending.length > 0) {
                     // A receipts-only refusal needs no KILL/park remedy menu: the results simply
                     // arrive in the next packet. Streams and children retain their remedy steer.
-                    const receiptsOnly = pending.every((k) => k.startsWith("this turn's receipts"));
+                    const receiptsOnly = pending.every((kind) => kind === "receipts");
                     if (receiptsOnly) {
-                        return _a.#failure("retrieval-results-unobserved", 409, "Last turn both performed operations whose receipts land in the next packet and attempted to terminate. Retrievals and mutations force an additional turn so their results can be reviewed.", {}, {
+                        return _a.#failure("retrieval-results-unobserved", 409, "Completion preceded this turn's operation results; they enter the next packet.", {}, {
                             pending: [...pending],
                             stage: "completion",
-                            recovery: "Review the results, then use only `# PLAN0` and `## SEND0 [200]` to conclude.",
                             retryable: false,
                         });
                     }
-                    return _a.#failure("work-remains", 409, `Completion was refused while work remains: ${pending.join("; ")}.`, {}, {
+                    return _a.#failure("work-remains", 409, "Completion encountered pending work or results.", {}, {
                         pending: [...pending],
                         stage: "completion",
-                        recovery: "Resolve the listed pending work before concluding.",
                         retryable: false,
                     });
                 }
@@ -1241,7 +1208,11 @@ class Dispatcher {
             const branchDenial = await this.#branchCompletionGate?.(workerId) ?? null;
             if (branchDenial !== null)
                 return branchDenial;
-            const failure = _a.#failure("scope-abandoned", 499, raw === "" ? "The worker abandoned its scope." : raw);
+            const reason = raw === "" ? null : ErrorDetail.preview(raw);
+            const failure = _a.#failure("scope-abandoned", 499, "The worker ended its scope with SEND[499].", {}, {
+                ...(reason === null ? {} : { reason }),
+                retryable: false,
+            });
             const seqs = await this.#db.engine_loop_turn_seqs.get({
                 loop_id: loopId,
                 turn_id: turnId,
@@ -1253,7 +1224,7 @@ class Dispatcher {
             const finished = await this.#lifecycle.finish(loopId, failure);
             if (finished === null)
                 return _a.#statusResult(await this.#lifecycle.status(loopId), "loop-already-terminal", "The loop was already terminal when SEND attempted to abandon it.");
-            await this.#cancelDescendants?.(workerId, raw === "" ? "parent abandoned its scope" : raw);
+            await this.#cancelDescendants?.(workerId, reason ?? "parent worker ended its scope with SEND[499]");
             return failure;
         }
         // Every other signal — 102 bare, 202 (retired as a terminal; now ordinary mid-comms), 1xx —
@@ -1287,6 +1258,27 @@ class Dispatcher {
         const addressedScheme = statement.target?.kind === "url" ? statement.target.scheme : null;
         if (manifest === undefined)
             throw new Error(`scheme '${schemeName}' has no manifest`);
+        // Metadata belongs to the handler that receives it. EXEC over a
+        // non-file resource is the one split route: exec hosts the operation,
+        // while the canonically routed source scheme receives the metadata.
+        const metadataScheme = schemeName === "exec"
+            && statement.target?.kind === "url"
+            && statement.target.scheme !== "file"
+            ? schemeNameOf(statement.target) ?? schemeName
+            : schemeName;
+        const metadataManifest = metadataScheme === schemeName
+            ? manifest
+            : this.#schemes.manifestFor(metadataScheme, ctx.functionalityWorkerId);
+        if (statement.metadata !== null && metadataManifest === undefined) {
+            return _a.#failure("scheme-not-found", 501, `Scheme '${metadataScheme}' is not registered.`, {}, { scheme: metadataScheme, retryable: false });
+        }
+        if (statement.metadata !== null && metadataManifest?.metadataModifier !== true) {
+            return _a.#failure("scheme-metadata-unsupported", 400, `Scheme '${metadataScheme}' does not accept the {metadata} modifier.`, {}, {
+                scheme: metadataScheme,
+                operation: statement.op,
+                retryable: false,
+            });
+        }
         const publishedChannel = statement.target?.kind === "url"
             ? statement.target.fragment ?? manifest.defaultChannel
             : manifest.defaultChannel;
@@ -1379,6 +1371,7 @@ class Dispatcher {
                 ? { address: null, result: null }
                 : await this.#prepareDataRepresentation({
                     target: statement.target,
+                    metadata: statement.metadata,
                     routedScheme: schemeName,
                     handler: handler,
                     manifest,
@@ -1412,10 +1405,6 @@ class Dispatcher {
             return _a.#failure("operation-not-implemented", 501, `Scheme '${schemeName}' does not implement ${statement.op}.`, {}, {
                 scheme: schemeName,
                 operation: statement.op,
-                // {§send-target-recipient} — a model's SEND to a file path was meant as the reply.
-                ...(statement.op === "SEND"
-                    ? { recovery: "`## SEND0 [200]` answers the active prompt with no target. A SEND target is a recipient — `## SEND0 (worker://<name>)` — or, with `[410]`, a resource to delete." }
-                    : {}),
                 retryable: false,
             });
         }
@@ -1430,6 +1419,7 @@ class Dispatcher {
         if (exactTarget && statement.target !== null) {
             const prepared = await this.#prepareDataRepresentation({
                 target: statement.target,
+                metadata: statement.metadata,
                 routedScheme: schemeName,
                 handler: handler,
                 manifest,
@@ -1504,10 +1494,11 @@ class Dispatcher {
     }
     async #writeLog({ statement, result, workspaceId, workerId, functionalityWorkerId, loopId, turnId, sequence, origin, curationPlan, modelCallId, }) {
         const durableStatement = DurableStatement.project(statement);
-        const target = this.#extractTarget(durableStatement.target, functionalityWorkerId);
+        const target = this.#extractTarget(primaryTargetOf(durableStatement), functionalityWorkerId);
         await this.#canonColumns(target, workspaceId); // {§fs-answer-in-canon}
-        const lineMarkerJson = "lineMarker" in durableStatement && durableStatement.lineMarker !== null
-            ? JSON.stringify(durableStatement.lineMarker)
+        const lineMarker = primaryLineMarkerOf(durableStatement);
+        const lineMarkerJson = lineMarker !== null
+            ? JSON.stringify(lineMarker)
             : null;
         // A proposal (status 202 from a side-effecting op) is written to the log in
         // state='proposed' until the proposal lifecycle resolves it; attrs holds the
@@ -1607,6 +1598,7 @@ class Dispatcher {
             state: isProposed ? "proposed" : "resolved",
             outcome: null,
             attrs,
+            initial_folded: LogVisibility.serialize(LogVisibility.OPEN),
         });
         // {§exec-tag-signal} — an EXEC row's signal is its runtime; its tag signal classifies
         // through the same idempotent primitive the log-write trigger uses for tag operations.