@plurnk/plurnk-service 1.16.5 → 1.18.0

package/dist/server/Daemon.js

@@ -2,7 +2,6 @@
 // the transport-free plugin-module seam ({§rpc}).
 import { readFile } from "node:fs/promises";
 import { resolve, dirname } from "node:path";
-import { isDeepStrictEqual } from "node:util";
 import Paths from "../Paths.js";
 import Engine from "../core/Engine.js";
 import ExecutorRegistry from "../core/ExecutorRegistry.js";
@@ -11,29 +10,31 @@ import { Mimetypes } from "@plurnk/plurnk-mimetypes";
 import { RuntimeDeclaration } from "@plurnk/plurnk-execs";
 import { projectModelRoute, routeForSpec, specForRoute } from "./model-route.js";
 import { discoverDaemonModules } from "./module-discovery.js";
-import WorkerSettingsReader from "../core/worker-settings.js";
 import EffectPolicy from "../schemes/EffectPolicy.js";
 import QuestionTool, { questionRuntimeDecl } from "../schemes/QuestionTool.js";
 import DrainSupervisor from "./DrainSupervisor.js";
-import { CapabilityAdmission, Validator } from "@plurnk/plurnk-contracts";
+import Retention, { retentionPolicy } from "./Retention.js";
+import { Validator } from "@plurnk/plurnk-contracts";
 import LogEntry from "./logEntry.js";
-import Envelope from "./envelope.js";
+import Envelope, { projectWorkerRow } from "./envelope.js";
 import ClientInput from "./client-input.js";
 import Turn from "../core/Turn.js";
 import SkillsFunctionality from "./SkillsFunctionality.js";
+import PlurnkSkill from "./PlurnkSkill.js";
+import Skill from "../schemes/Skill.js";
 import MembersFunctionality from "./MembersFunctionality.js";
+import EnvFunctionality from "./EnvFunctionality.js";
 import Fork from "../core/fork.js";
 import WorkerControlAddress from "../core/WorkerControlAddress.js";
-import LoopLifecycle from "../core/LoopLifecycle.js";
+import LoopLifecycle, { taskTiming } from "../core/LoopLifecycle.js";
+import LoopPolicyReader from "../core/LoopPolicyReader.js";
 import { promptLoopPrefix } from "../core/plurnk-uri.js";
 import { contentWeight } from "../core/content-weight.js";
 import { parseAliasesFromEnv, resolveActiveRoute } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "../core/ProviderInstantiate.js";
-import LoopPolicyReader from "../core/LoopPolicyReader.js";
-import CapabilityPolicies from "../core/CapabilityPolicies.js";
 import Results, { OperationFailureError } from "../core/results.js";
 import WorkspaceGate from "../core/WorkspaceGate.js";
-import WorkerResidency from "./WorkerResidency.js";
+import WorkspaceResidency from "./WorkspaceResidency.js";
 import Functionality from "./Functionality.js";
 import { observed, observedSync } from "../observe/spans.js";
 import { listModelCatalog } from "./model-catalog.js";
@@ -67,6 +68,8 @@ export default class Daemon {
     #moduleActions = new Map();
     #residency;
     #functionality;
+    // {§retention-policy} — the operator's retention, run on a cadence and at shutdown.
+    #retention;
     #skills;
     #members;
     // {§methods-event-subscribe} — the broadcast's in-process event source. A transport
@@ -106,9 +109,9 @@ export default class Daemon {
             });
             return row !== undefined;
         });
-        // {§module-worker-residency} — residency, activation/cooling, and
+        // {§module-workspace-residency} — residency, activation/cooling, and
         // capability replacement live in their one owner; the Daemon delegates.
-        this.#residency = new WorkerResidency({
+        this.#residency = new WorkspaceResidency({
             db,
             engine: () => this.#engine,
             workspaceGate: this.#workspaceGate,
@@ -118,19 +121,32 @@ export default class Daemon {
         // adapter; Core hosts it, modules register adapters through the seam.
         this.#functionality = new Functionality({
             registerModuleAction: (registration) => this.registerModuleAction(registration),
-            registerWorkerCapabilityProvider: (owner, provider) => this.registerWorkerCapabilityProvider(owner, provider),
-            readWorkerModuleState: (workerId, owner) => this.readWorkerModuleState(workerId, owner),
-            replaceWorkerCapabilities: (replacement, options) => this.replaceWorkerCapabilities(replacement, options),
-            retainWorker: (workerId) => this.#residency.retain(workerId)
+            registerWorkspaceCapabilityProvider: (owner, provider) => this.registerWorkspaceCapabilityProvider(owner, provider),
+            readWorkspaceModuleState: (workspaceId, owner) => this.readWorkspaceModuleState(workspaceId, owner),
+            replaceWorkspaceCapabilities: (replacement, options) => this.replaceWorkspaceCapabilities(replacement, options),
+            readWorkerModuleState: (workerId, owner) => this.#residency.readWorkerModuleState(workerId, owner),
+            replaceWorkerModuleState: (workerId, owner, state) => this.#residency.replaceWorkerModuleState(workerId, owner, state),
+            mutateWorkspace: (workspaceId, owner, caller, run) => this.#residency.exclusively(workspaceId, owner, caller === "operation" ? "wait" : "try", run),
+            retainWorkspace: (workspaceId) => this.#residency.retain(workspaceId)
         });
         // {§skills-functionality} — Core's own family: standard Agent Skills.
-        this.#skills = new SkillsFunctionality({ db, ...skills });
+        this.#skills = new SkillsFunctionality({
+            db,
+            ...skills,
+            provided: async () => {
+                const tree = await PlurnkSkill.load(this.#nodeModulesPath);
+                return new Map([[tree.document.name, tree]]);
+            },
+        });
         this.#skills.attach(this.#functionality.register(this.#skills));
+        this.#schemes.register("skill", new Skill((workspaceId) => this.#skills.trees(workspaceId)));
         // {§members-functionality} — Core's own family: file membership on the same surface.
         this.#members = new MembersFunctionality({ db, engine: () => this.#engine });
         this.#functionality.register(this.#members);
+        // {§env-functionality} — Core's own family: the environment a Worker's commands run in.
+        this.#functionality.register(new EnvFunctionality(EnvFunctionality.defaultsReader(Paths.packageRoot, this.#nodeModulesPath)));
         this.#engine = new Engine({
-            db, schemes: this.#schemes, mimetypes: this.#mimetypes,
+            db, lifecycle: this.#lifecycle, schemes: this.#schemes, mimetypes: this.#mimetypes,
             // {§tokenomics-agnostic-ruler} — stored and catalog curation weights
             // are workspace-wide across concurrent models, so they remain
             // model-independent. Request-shaped token facts stay provider-owned.
@@ -143,14 +159,18 @@ export default class Daemon {
             // daemon owns provider + the law-file system prompt; the worker scheme
             // handler carries neither. Fire-and-forget: the returned drain runs
             // independently (the sister is its own worker). {§machine-processes}
-            injectWorker: async ({ workspaceId, workerId, sourceWorkerId, prompt, freshLoopPolicy, parentLoopId }) => {
+            injectWorker: async ({ workspaceId, workerId, sourceLoopId, prompt, freshLoopPolicy, spawn, schedule, environment }) => {
                 await this.#assertModelWorker(workspaceId, workerId);
-                const source = await this.#workerPromptSource(workspaceId, sourceWorkerId, workerId);
+                const sender = await this.#db.drain_message_source.get({ loop_id: sourceLoopId });
+                if (sender === undefined || sender.workspace_id !== workspaceId) {
+                    throw new Error(`injectWorker: source loop ${sourceLoopId} does not belong to workspace ${workspaceId}`);
+                }
+                const source = await this.#workerPromptSource(workspaceId, sender.worker_id, workerId);
                 const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
                 let providerSpec;
                 let childProviderSpec;
                 let reasoningPolicy;
-                if (parentLoopId === undefined) {
+                if (spawn !== true) {
                     // {§worker-model-selection} — the voice door addresses an
                     // existing worker. Its own durable generation policy is the
                     // receiver's identity; the daemon default and sender do not
@@ -164,24 +184,33 @@ export default class Daemon {
                     childProviderSpec = await this.#workerModels.resolveWorkerSpawnModel(workerId, undefined);
                 }
                 else {
-                    const parentPolicy = await this.#providerPolicyForLoop(parentLoopId);
+                    const parentPolicy = await this.#providerPolicyForLoop(sourceLoopId);
                     providerSpec = parentPolicy.childProviderSpec ?? parentPolicy.providerSpec;
                     reasoningPolicy = parentPolicy.reasoningPolicy;
                     // {§worker-model-selection} — lineage inheritance by value:
                     // the child begins with the spawning loop's effective spawn
                     // model and no separate override of its own.
                     childProviderSpec = null;
-                    await this.#db.worker_generation_policy_update.run({
-                        id: workerId,
+                    // {§worker-reasoning-source} — inherited by value, chosen by nobody on this worker.
+                    await this.#workerModels.persistGenerationPolicy(workerId, {
                         model_route_id: await routeForSpec(this.#db, providerSpec),
                         spawn_model_route_id: null,
-                        reasoning_policy: reasoningPolicy
+                        reasoning_policy: reasoningPolicy,
+                        reasoning_source: "default"
                     });
+                    // {§env-option} — the heading's environment lands as the child's own entries through the
+                    // family's add, after the copy it inherited at creation ({§functionality-scope}); names
+                    // were admitted at the operation, so a refusal here is a defect and throws.
+                    for (const [alias, value] of Object.entries(environment ?? {})) {
+                        await this.#functionality.invoke("env", "add", { alias, definition: { value } }, { workspaceId, workerId }, "operation");
+                    }
                 }
-                const { action, loopId } = await this.inject({
+                const { action, loopId, scheduledAt, intervalMinutes, recurrenceId } = await this.inject({
                     workspaceId,
                     workerId,
                     prompt,
+                    sourceLoopId,
+                    ...(schedule === undefined ? {} : { schedule }),
                     ...(source === undefined ? {} : { source }),
                     providerSpec,
                     reasoningPolicy,
@@ -189,14 +218,14 @@ export default class Daemon {
                     systemPrompt,
                     ...(freshLoopPolicy === undefined ? {} : { freshLoopPolicy })
                 });
-                return { action, loopId };
+                return { action, loopId, scheduledAt, intervalMinutes, recurrenceId };
             },
-            acquireWorkspaceTurn: async (workspaceId, workerId) => this.#workspaceGate.acquireTurn(workspaceId, workerId),
+            acquireWorkspaceTurn: async (workspaceId, workerId, signal) => this.#workspaceGate.acquireTurn(workspaceId, workerId, signal),
             // {§skills-hotload} — filesystem installers operate out of band.
             // Republish under the workspace turn gate before packet assembly so
             // the first subsequent model turn sees their exact result.
-            workspaceTurnStarting: async ({ workspaceId, workerId }) => {
-                await this.#skills.refreshIfChanged({ workspaceId, workerId });
+            workspaceTurnStarting: async ({ workspaceId }) => {
+                await this.#skills.refreshIfChanged({ workspaceId });
             },
             // worker:// KILL (terminate) — cancel the addressed worker subtree and
             // tear down its held streams before the operation completes.
@@ -207,10 +236,11 @@ export default class Daemon {
                 this.#broadcast({ workspaceId }, "loop/packet", payload);
             }
         });
+        this.#retention = new Retention(db, retentionPolicy());
         this.#drains = new DrainSupervisor({
             db,
             lifecycle: this.#lifecycle,
-            injectPrompt: (workerId, prompt, openPaths, source) => this.#engine.inject(workerId, prompt, openPaths, source),
+            injectPrompt: (loopId, prompt, openPaths, source) => this.#engine.injectIntoLoop(loopId, prompt, openPaths, source),
             assertInjectionCompatibility: async ({ workerId, loopId, providerSpec, providerSpecExplicit, reasoningPolicy, childProviderSpec, turnCeiling, policy }) => {
                 await this.#assertFoldPosture(workerId, policy, loopId);
                 // An omitted selector keeps the loop's durable provider; only an
@@ -229,12 +259,12 @@ export default class Daemon {
                 // The drain callback is the final provider/model boundary. Every
                 // admission path, including boot recovery, terminates here.
                 await this.#assertModelWorker(workspaceId, workerId);
-                const releaseCapabilities = await this.#residency.acquire(workspaceId, workerId);
+                const releaseCapabilities = await this.#residency.acquire(workspaceId);
                 try {
                     // Worker settings can change while Functionality remains
                     // resident. Reconcile the worker-private discovery surface
                     // at the same pre-inference boundary used for activation.
-                    await this.#residency.reconcile(workspaceId, workerId);
+                    await this.#residency.reconcile(workspaceId);
                     const { provider, childProvider } = await this.#providersForLoop(loopId);
                     return await this.#engine.runLoop({
                         provider,
@@ -257,15 +287,8 @@ export default class Daemon {
             },
             loopUsage: (loopId) => this.#engine.loopUsage(loopId),
             loopAttributions: (loopId) => this.#engine.loopAttributions(loopId),
-            takeParkDeadline: (loopId) => {
-                const deadline = this.#engine.parkDeadlines.get(loopId);
-                this.#engine.parkDeadlines.delete(loopId);
-                return deadline;
-            },
             cancelSubscription: (subscriptionId) => this.#engine.cancelSubscription(subscriptionId),
             hasActiveStreams: (workerId) => this.#workerHasActiveStreams(workerId),
-            // {§exec-timeout} — a `<-1>` spawn is nobody's obligation.
-            isDetachedSubscription: (subscriptionId) => this.#schemes.get("exec")?.isDetachedSpawn?.(subscriptionId) === true,
             readSystemPrompt: () => readFile(Paths.instructionsSystem, "utf8"),
             emitLogEntry: async (workspaceId, logEntryId) => {
                 const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
@@ -469,58 +492,44 @@ export default class Daemon {
     }
     // {§methods-model-worker} — the workspace's model worker (created on first use), distinct from the client
     // worker so the model's packets never carry client-action rows. The module binds its threads to this.
-    // Optional worker settings ({§worker-settings}) ride the client's per-run declaration: merged in on
-    // creation AND on every subsequent ensure, so a client can change its mind between loops.
-    async ensureModelWorker(workspaceId, settings) {
+    async ensureModelWorker(workspaceId) {
         const checked = ClientInput.assertId("worker.ensure-model", "workspaceId", workspaceId);
-        const created = await Envelope.ensureModelWorker(this.#db, checked);
-        if (settings !== undefined)
-            await this.#mergeWorkerSettings(created, settings);
-        return created;
-    }
-    // {§worker-settings} — merge known keys into the worker's behavioral-rules bag.
-    // Validated at the boundary; unprovided keys keep their durable value.
-    async #mergeWorkerSettings(workerId, settings) {
-        const normalized = ClientInput.normalizeWorkerSettings(settings);
-        const current = await WorkerSettingsReader.read(this.#db, workerId);
-        const merged = {
-            capabilities: normalized.capabilities ?? current.capabilities
-        };
-        await this.#db.worker_settings_update.run({ id: workerId, settings: JSON.stringify(merged) });
-    }
-    // {§capability-policy-projection} — clients inspect the same complete cascade
-    // that dispatch and packet projection consume; the mutable Worker layer is
-    // never presented as if it were effective authority.
-    async readWorkerCapabilities(args) {
-        const workspaceId = ClientInput.assertId("worker.capabilities.get", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.capabilities.get", "workerId", args.workerId);
-        await this.#assertWorkerOwned(workspaceId, workerId);
-        return this.#engine.capabilityProjection(workspaceId, workerId);
-    }
-    // {§worker-settings} — replace the Worker's mutable policy, then return the
-    // resolver-owned projection so a narrowing ceiling cannot be mistaken for
-    // newly effective authority.
-    async setWorkerCapabilities(args) {
-        const workspaceId = ClientInput.assertId("worker.capabilities.set", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.capabilities.set", "workerId", args.workerId);
-        await this.#assertWorkerOwned(workspaceId, workerId);
-        await this.#mergeWorkerSettings(workerId, { capabilities: args.policy });
-        return this.#engine.capabilityProjection(workspaceId, workerId);
+        return await Envelope.ensureModelWorker(this.#db, checked);
+    }
+    async readWorkspaceCapabilities(args) {
+        const workspaceId = ClientInput.assertId("workspace.capabilities.get", "workspaceId", args.workspaceId);
+        return this.#engine.capabilityProjection(workspaceId);
+    }
+    // {§workspace-capability-policy} Policy changes share the workspace's
+    // quiescent publication boundary; no in-flight proposal can change authority.
+    async setWorkspaceCapabilities(args) {
+        const workspaceId = ClientInput.assertId("workspace.capabilities.set", "workspaceId", args.workspaceId);
+        const settings = JSON.parse(ClientInput.parseSettings({ capabilities: args.policy }));
+        if (settings.capabilities === undefined)
+            throw daemonFailure("daemon:input", "capability-policy-required", 400, "policy is required.", { field: "policy", retryable: false });
+        return this.#residency.exclusively(workspaceId, "capabilities", "try", async () => {
+            const row = await this.#db.workspace_capability_policy_update.get({
+                workspace_id: workspaceId, policy: JSON.stringify(settings.capabilities),
+            });
+            if (row === undefined)
+                throw daemonFailure("daemon:workspace", "workspace-not-found", 404, `Workspace ${workspaceId} does not exist.`, { workspaceId });
+            return await this.#engine.capabilityProjection(workspaceId);
+        });
     }
     // {§worker-model-selection} — project a worker's durable model and spawn override
     // for a client-interface get/set surface. Ownership is checked at this boundary.
     async readWorkerModel(args) {
         const workspaceId = ClientInput.assertId("worker.model.get", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("worker.model.get", "workerId", args.workerId);
-        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertModelWorker(workspaceId, workerId);
         const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
         if (row === undefined)
             throw new Error(`worker ${workerId}: model route row missing`);
         const modelSpec = await specForRoute(this.#db, row.model_route_id);
         const spawnModelSpec = await specForRoute(this.#db, row.spawn_model_route_id);
         return {
-            model: modelSpec === null ? null : projectModelRoute(modelSpec, row.reasoning_policy),
-            spawnModel: spawnModelSpec === null ? null : projectModelRoute(spawnModelSpec, row.reasoning_policy)
+            model: modelSpec === null ? null : projectModelRoute(modelSpec, row.reasoning_policy, row.reasoning_source),
+            spawnModel: spawnModelSpec === null ? null : projectModelRoute(spawnModelSpec, row.reasoning_policy, row.reasoning_source)
         };
     }
     // {§worker-model-selection} — persist an explicit model selection onto the worker
@@ -528,31 +537,20 @@ export default class Daemon {
     async setWorkerModel(args) {
         const workspaceId = ClientInput.assertId("worker.model.set", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("worker.model.set", "workerId", args.workerId);
-        await this.#assertWorkerOwned(workspaceId, workerId);
-        await this.#assertWorkerSelectable(workerId);
+        await this.#assertModelWorker(workspaceId, workerId);
         const selector = ClientInput.assertSelector("worker.model.set", "selector", args.selector);
         const policy = await this.#workerModels.resolveWorkerModel(workerId, selector);
         if (policy === null) {
             throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this worker.", {}, { stage: "provider-selection", recovery: "Select a configured model provider.", retryable: false }));
         }
-        return projectModelRoute(policy.providerSpec, policy.reasoningPolicy);
-    }
-    async #reasoningSupportForWorker(workerId, row, providerSpec, policy) {
-        const provider = await this.#workerModels.providerForPolicy(providerSpec, policy);
-        if (row.spawn_model_route_id === null)
-            return provider.supportedReasoningPolicies;
-        const spawnSpec = await specForRoute(this.#db, row.spawn_model_route_id);
-        if (spawnSpec === null)
-            throw new Error(`worker ${workerId}: spawn model route is missing`);
-        const spawnProvider = await this.#workerModels.providerForPolicy(spawnSpec, policy);
-        return provider.supportedReasoningPolicies.filter((candidate) => spawnProvider.supportedReasoningPolicies.includes(candidate));
+        return projectModelRoute(policy.providerSpec, policy.reasoningPolicy, policy.reasoningSource);
     }
     // {§worker-reasoning-policy} — the worker's reasoning policy is durable and
     // provider-relative. A model-less worker remains explicitly uninitialized.
     async readWorkerReasoning(args) {
         const workspaceId = ClientInput.assertId("worker.reasoning.get", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("worker.reasoning.get", "workerId", args.workerId);
-        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertModelWorker(workspaceId, workerId);
         await this.#workerModels.resolveWorkerModel(workerId, undefined);
         const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
         if (row === undefined)
@@ -561,17 +559,15 @@ export default class Daemon {
             if (row.reasoning_policy !== null) {
                 throw new Error(`worker ${workerId}: reasoning policy exists without a model route`);
             }
-            return { policy: null, supportedPolicies: [] };
+            return { policy: null, source: "default", supportedPolicies: [] };
         }
         if (row.reasoning_policy === null) {
             throw new Error(`worker ${workerId}: durable model has no reasoning policy`);
         }
-        const spec = await specForRoute(this.#db, row.model_route_id);
-        if (spec === null)
-            throw new Error(`worker ${workerId}: model route is missing`);
         return {
             policy: row.reasoning_policy,
-            supportedPolicies: await this.#reasoningSupportForWorker(workerId, row, spec, row.reasoning_policy)
+            source: row.reasoning_source,
+            supportedPolicies: await this.#workerModels.supportedPolicies(row)
         };
     }
     // {§worker-reasoning-policy} — mutate between loops, validate against both
@@ -586,8 +582,7 @@ export default class Daemon {
         catch (cause) {
             throw daemonFailure("daemon:input", "reasoning-policy-invalid", 400, cause instanceof Error ? cause.message : "The reasoning policy is invalid.", { field: "policy", retryable: false });
         }
-        await this.#assertWorkerOwned(workspaceId, workerId);
-        await this.#assertWorkerSelectable(workerId);
+        await this.#assertModelWorker(workspaceId, workerId);
         await this.#workerModels.resolveWorkerModel(workerId, undefined);
         const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
         if (row === undefined)
@@ -601,41 +596,26 @@ export default class Daemon {
                 retryable: false
             });
         }
-        const supportedPolicies = await this.#reasoningSupportForWorker(workerId, row, spec, policy);
-        await this.#db.worker_generation_policy_update.run({
-            id: workerId,
+        const supportedPolicies = await this.#workerModels.persistGenerationPolicy(workerId, {
             model_route_id: row.model_route_id,
             spawn_model_route_id: row.spawn_model_route_id,
-            reasoning_policy: policy
+            reasoning_policy: policy,
+            reasoning_source: "explicit"
         });
-        return { policy, supportedPolicies };
+        return { policy, source: "explicit", supportedPolicies };
     }
     // {§worker-model-selection} — persist the worker's spawn override; a null
     // selector means inherit (clears the override).
     async setWorkerSpawnModel(args) {
         const workspaceId = ClientInput.assertId("worker.child.set", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("worker.child.set", "workerId", args.workerId);
-        await this.#assertWorkerOwned(workspaceId, workerId);
-        await this.#assertWorkerSelectable(workerId);
+        await this.#assertModelWorker(workspaceId, workerId);
         const selector = ClientInput.assertChildSelector("worker.child.set", args.selector);
         const spec = await this.#workerModels.resolveWorkerSpawnModel(workerId, selector);
         if (spec === null)
             return null;
         const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
-        return projectModelRoute(spec, row?.reasoning_policy ?? null);
-    }
-    // {§worker-model-selection} — a selection must not mutate underneath active
-    // work: a live or parked loop is a precise 409, never a silent retroactive
-    // switch of the immutable loop snapshot.
-    async #assertWorkerSelectable(workerId) {
-        if (await this.#drains.hasLiveWork(workerId)) {
-            throw daemonFailure("daemon:worker", "worker-loop-active", 409, `Worker ${workerId} has a live or parked loop; select a model after concluding or cancelling it.`, {
-                workerId,
-                stage: "model-selection",
-                recovery: "Conclude or cancel the active loop before selecting a model.",
-                retryable: false
-            });
-        }
+        return projectModelRoute(spec, row?.reasoning_policy ?? null, row?.reasoning_source ?? "default");
     }
     async #assertWorkerOwned(workspaceId, workerId) {
         const owner = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
@@ -647,8 +627,9 @@ export default class Daemon {
         }
     }
     // {§machine-processes} — provider inference is an exclusive capability of a
-    // model worker. The same assertion is used by early client admissions and
-    // the final drain callback, so recovery and internal callers cannot bypass it.
+    // model worker. The same assertion is used by early client admissions, the final
+    // drain callback, and the model, reasoning, and spawn-model controls
+    // ({§worker-model-selection}), so recovery and internal callers cannot bypass it.
     async #assertModelWorker(workspaceId, workerId) {
         const worker = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
         if (worker === undefined) {
@@ -666,7 +647,7 @@ export default class Daemon {
             throw daemonFailure("daemon:worker", "model-worker-required", 409, `Worker ${workerId} is not a model worker.`, {
                 workerId,
                 actualOrigin: worker.origin,
-                recovery: "Select or create a model worker for this loop.",
+                recovery: "Select or create a model worker.",
                 retryable: false
             });
         }
@@ -687,20 +668,19 @@ export default class Daemon {
     // grammar package and hands over the statement, then fans the emitted entry out to its own clients.
     // {§functionality-model-mutation} — await every queued Functionality
     // publication (a Worker's accepted mutation publishes at its turn boundary).
-    async settleFunctionality(workerId) {
-        await this.#functionality.settle(workerId);
+    async settleFunctionality(workspaceId) {
+        await this.#functionality.settle(workspaceId);
     }
     async dispatchAsClient(args) {
         const workspaceId = ClientInput.assertId("operation.dispatch", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("operation.dispatch", "workerId", args.workerId);
-        const functionalityWorkerId = ClientInput.assertId("operation.dispatch", "functionalityWorkerId", args.functionalityWorkerId);
         const { statement } = args;
-        await this.#assertWorkerOwned(workspaceId, functionalityWorkerId);
-        const releaseCapabilities = await this.#residency.acquire(workspaceId, functionalityWorkerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        const releaseCapabilities = await this.#residency.acquire(workspaceId);
         try {
             const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
             try {
-                const result = await this.#dispatchClientStatement({ workspaceId, workerId, functionalityWorkerId, loopId: clientLoopId, statement });
+                const result = await this.#dispatchClientStatement({ workspaceId, workerId, loopId: clientLoopId, statement });
                 await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
                 return result;
             }
@@ -717,23 +697,25 @@ export default class Daemon {
     // loop, regardless of how many statements op.parse produced. Each statement is one
     // ordinary operation turn; a proposal may keep that turn and loop open across
     // interrupt/resume until settlement.
+    executorTags(workspaceId) {
+        return this.#engine.executorTags(workspaceId);
+    }
     async dispatchClientAction(args) {
         const workspaceId = ClientInput.assertId("operation.dispatch-batch", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("operation.dispatch-batch", "workerId", args.workerId);
-        const functionalityWorkerId = ClientInput.assertId("operation.dispatch-batch", "functionalityWorkerId", args.functionalityWorkerId);
         const { statements } = args;
         if (statements.length === 0)
             return [];
-        await this.#assertWorkerOwned(workspaceId, functionalityWorkerId);
-        // {§actor-boundary-attached-functionality} — the attached Worker's
-        // Functionality is what the client operation executes in.
-        const releaseCapabilities = await this.#residency.acquire(workspaceId, functionalityWorkerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        // {§actor-boundary-attached-functionality} The client retains its journal;
+        // the workspace supplies policy and the shared runtime environment.
+        const releaseCapabilities = await this.#residency.acquire(workspaceId);
         try {
             const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
             try {
                 const results = [];
                 for (const statement of statements) {
-                    results.push(await this.#dispatchClientStatement({ workspaceId, workerId, functionalityWorkerId, loopId: clientLoopId, statement }));
+                    results.push(await this.#dispatchClientStatement({ workspaceId, workerId, loopId: clientLoopId, statement }));
                 }
                 await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
                 return results;
@@ -748,9 +730,10 @@ export default class Daemon {
         }
     }
     async #dispatchClientStatement(args) {
-        const { workspaceId, workerId, functionalityWorkerId, loopId, statement } = args;
+        const { workspaceId, workerId, loopId, statement } = args;
         const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
         try {
+            await this.#residency.reconcile(workspaceId);
             const { id: turnId } = await Turn.open(this.#db, {
                 loopId,
                 producer: "client",
@@ -760,7 +743,7 @@ export default class Daemon {
             try {
                 const entryIds = [];
                 const result = await this.#engine.dispatch({
-                    statement, workspaceId, workerId, functionalityWorkerId, loopId, turnId, sequence: 1,
+                    statement, workspaceId, workerId, loopId, turnId, sequence: 1,
                     origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); }
                 });
                 await Turn.complete(this.#db, turnId, result.status);
@@ -793,19 +776,25 @@ export default class Daemon {
     // dispatchClientAction). Its closed observation segment supplies the numeric loop coordinate
     // required by plugin context and relative log:/// addresses without impersonating an active
     // client lifecycle. It creates no turn or log row. Engine.look enforces READ-only.
+    // {§op-look} — the segment is the acting worker's; the READ resolves as the perspective worker.
     async look(args) {
         const workspaceId = ClientInput.assertId("operation.look", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("operation.look", "workerId", args.workerId);
-        const functionalityWorkerId = ClientInput.assertId("operation.look", "functionalityWorkerId", args.functionalityWorkerId);
+        const perspective = args.perspectiveWorkerId === undefined
+            ? workerId
+            : ClientInput.assertId("operation.look", "perspectiveWorkerId", args.perspectiveWorkerId);
         const { statement } = args;
-        await this.#assertWorkerOwned(workspaceId, functionalityWorkerId);
-        const releaseCapabilities = await this.#residency.acquire(workspaceId, functionalityWorkerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        if (perspective !== workerId)
+            await this.#assertWorkerOwned(workspaceId, perspective);
+        const releaseCapabilities = await this.#residency.acquire(workspaceId);
         try {
             const releaseWorkspace = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
             try {
+                await this.#residency.reconcile(workspaceId);
                 const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
                 try {
-                    const result = await this.#engine.look({ statement, workspaceId, workerId, functionalityWorkerId, loopId: clientLoopId });
+                    const result = await this.#engine.look({ statement, workspaceId, workerId: perspective, loopId: clientLoopId });
                     await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
                     return result;
                 }
@@ -899,7 +888,7 @@ export default class Daemon {
             });
         if (row === undefined || row.workspace_id !== workspaceId)
             return null;
-        const { workspace_id: _workspaceId, ...projection } = row;
+        const { workspace_id: _workspaceId, ...projection } = projectWorkerRow(row);
         return projection;
     }
     async listWorkerLoops(args) {
@@ -916,6 +905,7 @@ export default class Daemon {
             promptSource: row.promptSource,
             terminatedAt: row.terminatedAt,
             packetCount: row.packetCount,
+            ...taskTiming(row),
             terminalResult: row.terminalResult === null
                 ? null
                 : Validator.assertOperationResult(JSON.parse(row.terminalResult))
@@ -976,13 +966,10 @@ export default class Daemon {
         if (name !== undefined) {
             const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
             if (taken !== undefined) {
-                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId}.`, { workspaceId, name, recovery: "Choose another worker name.", retryable: false });
+                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId} by a ${taken.origin} worker.`, { workspaceId, name, actualOrigin: taken.origin, recovery: "Choose another worker name.", retryable: false });
             }
         }
         const worker = await Envelope.createModelWorker(this.#db, workspaceId, name);
-        if (args.settings !== undefined) {
-            await this.#mergeWorkerSettings(worker.id, args.settings);
-        }
         return { workerId: worker.id, workerName: worker.name };
     }
     // {§worker-scheme-fork} — branch a worker's log while sharing the workspace world.
@@ -1006,10 +993,10 @@ export default class Daemon {
         if (name !== undefined) {
             const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
             if (taken !== undefined) {
-                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId}.`, { workspaceId, name, recovery: "Choose another worker name.", retryable: false });
+                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId} by a ${taken.origin} worker.`, { workspaceId, name, actualOrigin: taken.origin, recovery: "Choose another worker name.", retryable: false });
             }
         }
-        const branchWorkerId = await Fork.fork(this.#db, workerId, name, await CapabilityPolicies.delegationBound(this.#db, workspaceId, workerId), (scheme) => this.#schemes.entryInheritanceForStoredScheme(scheme, workerId));
+        const branchWorkerId = await Fork.fork(this.#db, workerId, name);
         const branch = await this.#db.envelope_get_worker_by_id.get({ id: branchWorkerId });
         return { workerId: branchWorkerId, workerName: branch?.name ?? null, parentWorkerId: workerId };
     }
@@ -1095,7 +1082,7 @@ export default class Daemon {
         }
         let releaseCapabilities;
         if (context.scope === "workspace") {
-            ClientInput.assertId(`module action '${name}'`, "workspaceId", context.workspaceId);
+            releaseCapabilities = await this.#residency.acquire(context.workspaceId);
         }
         else if (context.scope === "worker") {
             const workspaceId = ClientInput.assertId(`module action '${name}'`, "workspaceId", context.workspaceId);
@@ -1104,25 +1091,34 @@ export default class Daemon {
             if (worker === undefined || worker.workspace_id !== workspaceId) {
                 throw daemonFailure("daemon:module-action", "worker-not-found", 404, `Worker ${workerId} does not exist in workspace ${workspaceId}.`, { workspaceId, workerId, retryable: false });
             }
-            releaseCapabilities = await this.#residency.acquire(workspaceId, workerId);
+            releaseCapabilities = await this.#residency.acquire(workspaceId);
         }
         try {
+            if (context.scope === "worker") {
+                const release = await this.#workspaceGate.acquireTurn(context.workspaceId, context.workerId);
+                try {
+                    await this.#residency.reconcile(context.workspaceId);
+                }
+                finally {
+                    release();
+                }
+            }
             return await registration.handler(params, context);
         }
         finally {
             releaseCapabilities?.();
         }
     }
-    registerWorkerCapabilityProvider(namespaceOwner, provider) {
+    registerWorkspaceCapabilityProvider(namespaceOwner, provider) {
         this.#residency.registerProvider(namespaceOwner, provider);
     }
     registerFunctionalityAdapter(adapter) {
         return this.#functionality.register(adapter);
     }
-    async readWorkerModuleState(workerId, namespaceOwner) {
-        return this.#residency.readModuleState(workerId, namespaceOwner);
+    async readWorkspaceModuleState(workspaceId, namespaceOwner) {
+        return this.#residency.readModuleState(workspaceId, namespaceOwner);
     }
-    async replaceWorkerCapabilities(replacement, options = {}) {
+    async replaceWorkspaceCapabilities(replacement, options = {}) {
         await this.#residency.replace(replacement, options);
     }
     get engine() { return this.#engine; }
@@ -1139,6 +1135,7 @@ export default class Daemon {
             throw new Error("daemon already started");
         this.#started = true;
         this.#drains.start();
+        this.#retention.start((cause) => { console.error("retention pass failed:", cause instanceof Error ? cause.message : String(cause)); });
         // Mimetypes owns its own discovery scan over @plurnk/plurnk-mimetypes-*
         // packages; pre-warm it so first index render doesn't pay the cost.
         await this.#mimetypes.ready();
@@ -1150,9 +1147,9 @@ export default class Daemon {
         // shell is the default runtime, so its executor must boot usable.
         const executors = await ExecutorRegistry.build({ defaultRuntime: "sh", cwd: this.#discoveryCwd });
         this.#engine.setExecutors(executors);
-        this.#engine.setFunctionalityDocuments((workerId) => this.#functionality.documents(workerId));
+        this.#engine.setFunctionalityDocuments((workspaceId) => this.#functionality.documents(workspaceId));
         // {§question-tool} — the native request-user-input runtime, process-wide;
-        // per-worker admission gates its doc visibility and dispatch ({§worker-settings}).
+        // workspace admission gates its doc visibility and dispatch ({§workspace-capability-policy}).
         await this.#engine.registerRuntimes([{
                 tag: "question",
                 entry: {
@@ -1166,10 +1163,10 @@ export default class Daemon {
                     detail: "in-process"
                 }
             }]);
-        // {§effect-policy-tunable} — invalid operator policy fails boot, not the first EXEC.
+        // {§effect-policy-tunable} — invalid operator policy fails boot, not the first execution.
         EffectPolicy.validateConfiguration();
         // {§exec} — mint a scheme per runtime tag so exec output entries address by tag
-        // authority (sh:///l/t/s). The "exec" scheme stays for the EXEC op dispatch.
+        // authority (sh:///l/t/s). The "exec" scheme stays for execution dispatch.
         this.#schemes.registerRuntimeSchemes(executors);
         // Discover external @plurnk/plurnk-schemes-* siblings + register them
         // (agnostic, by plurnk.kind:"scheme"). They light up http://, etc. with
@@ -1207,7 +1204,6 @@ export default class Daemon {
         await this.#db.recovery_fail_active_loops.run({});
         await this.#db.recovery_settle_open_provider_requests.run({});
         await this.#db.recovery_fail_open_model_calls.run({});
-        await this.#db.recovery_fail_open_embedding_calls.run({});
         await this.#db.recovery_fail_open_turns.run({});
         await this.#db.recovery_fail_ownerless_proposals.run({});
         await this.#db.recovery_remove_ownerless_client_interactions.run({});
@@ -1246,7 +1242,7 @@ export default class Daemon {
             });
         }
         for (const row of parked) {
-            await this.#drains.schedulePollWake(row.workspace_id, row.worker_id, systemPrompt);
+            await this.#drains.scheduleWakes(row.workspace_id, row.worker_id, systemPrompt);
         }
     }
     // {§crash-only-stop} — the settle deadline. Default 30s; an operator can
@@ -1267,6 +1263,7 @@ export default class Daemon {
         // already between queue claim and activation must observe its own abort,
         // not misclassify orderly shutdown as a capability failure.
         const derivationAbort = new DOMException("daemon stopping", "AbortError");
+        this.#retention.stop();
         this.#engine.cancelAllProposals("daemon_stopping");
         this.#engine.cancelDerivations(derivationAbort);
         this.#drains.beginStop("daemon_stopping");
@@ -1328,15 +1325,22 @@ export default class Daemon {
         // conclusion notifications. Join the supervisor-owned async tails only
         // after those producers settle, before the caller may close SQLite.
         const wakeResult = await settle("drains idle (wake)", () => this.#drains.idle());
+        // {§db-maintenance-optimize} — the last database step before the caller closes SQLite:
+        // planner statistics refreshed on the writer, bounded by SQLite's own analysis limit.
+        // {§retention-policy} — the operator's retention runs once more before the statistics.
+        const collectResult = await settle("retention", () => this.#retention.run());
+        const optimizeResult = await settle("database optimize", () => this.#db.maintenance_optimize.run({}));
         const closeErrors = [
             moduleResult,
             functionalityResult,
             drainResult,
             streamingResult,
             derivationResult,
+            collectResult,
             ...(mimetypeResult === null ? [] : [mimetypeResult]),
             schemeResult,
             wakeResult,
+            optimizeResult,
         ]
             .filter((result) => result.status === "rejected")
             .flatMap((result) => result.reason instanceof AggregateError
@@ -1382,9 +1386,6 @@ export default class Daemon {
             .filter(([key, value]) => {
             if (value === undefined)
                 return false;
-            if (key === "capabilities") {
-                return !isDeepStrictEqual(CapabilityAdmission.intersect([effective.capabilities]), CapabilityAdmission.intersect([value]));
-            }
             return effective[key] !== value;
         })
             .map(([key, value]) => `${key}: ${JSON.stringify(effective[key])} -> ${JSON.stringify(value)}`);
@@ -1407,16 +1408,12 @@ export default class Daemon {
     async #reconcileOrphanedPrompts(workerId, endedLoopId) {
         const endedSeq = (await this.#db.engine_loop_sequence.get({ loop_id: endedLoopId }))?.sequence ?? endedLoopId;
         const prefix = promptLoopPrefix(endedSeq);
-        const frames = await this.#db.drain_orphaned_prompts_for_loop.all({ loop_id: endedLoopId, owner_id: workerId, pattern: `${prefix}%`, prefix_len: prefix.length });
+        const frames = await this.#db.drain_orphaned_prompts_for_loop.all({ loop_id: endedLoopId, worker_id: workerId, pattern: `${prefix}%`, prefix_len: prefix.length });
         const first = frames[0];
         if (first === undefined)
             return;
-        const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
-        if (seqRow === undefined)
-            throw new Error("reconcileOrphanedPrompts: next-sequence query returned no row");
         const recovery = await this.#db.drain_enqueue_orphan_recovery_loop.get({
             worker_id: workerId,
-            sequence: seqRow.next,
             prompt: first.body,
             prompt_source: first.prompt_source,
             policy: first.policy,
@@ -1432,7 +1429,7 @@ export default class Daemon {
         if (recovery.status !== 100)
             return;
         const moved = await this.#db.drain_rehome_orphaned_prompt_frames.all({
-            owner_id: workerId,
+            worker_id: workerId,
             source_loop_id: endedLoopId,
             source_pattern: `${prefix}%`,
             source_prefix_len: prefix.length,