@plurnk/plurnk-service 1.16.5 → 1.18.0

package/dist/server/DrainSupervisor.js

@@ -1,8 +1,10 @@
+var _a;
 import { setTimeout as delay } from "node:timers/promises";
 import { aggregateProviderAccounting } from "@plurnk/plurnk-providers";
 import { routeForSpec } from "./model-route.js";
 import ChannelWrite from "../core/ChannelWrite.js";
 import ErrorDetail from "../core/ErrorDetail.js";
+import { taskTiming } from "../core/LoopLifecycle.js";
 import { DEFAULT_LOOP_POLICY } from "../core/scheme-types.js";
 import Results, { OperationFailureError } from "../core/results.js";
 import { observed } from "../observe/spans.js";
@@ -13,7 +15,7 @@ import { execPollBackoffMs } from "./exec-poll-backoff.js";
 // Owns the worker-local queue consumer and every process-local edge that may
 // wake, cancel, or retire it. Daemon retains provider/process policy and the
 // external facade, supplying only the named capabilities below.
-export default class DrainSupervisor {
+class DrainSupervisor {
     #db;
     #lifecycle;
     #injectPrompt;
@@ -22,30 +24,26 @@ export default class DrainSupervisor {
     #runLoop;
     #loopUsage;
     #loopAttributions;
-    #takeParkDeadline;
     #cancelSubscription;
     #hasActiveStreams;
-    #isDetachedSubscription;
     #readSystemPrompt;
     #emitLogEntry;
     #emit;
     // The handle is the drain identity. Start/exit compare by reference so an
     // exiting drain cannot clobber a successor that raced in.
     #activeDrains = new Map();
-    #drainExitTasks = new Set();
-    #wakeTasks = new Set();
-    #wakeFailures = [];
+    #settlementTasks = new Set();
+    #settlementFailures = [];
     // One cancellation scope spans a worker's loops and streams. It outlives
     // any single drain and is replaced only after it has been aborted.
     #workerAborts = new Map();
-    #parkTimers = new Map();
-    #pollTimers = new Map();
+    #loopTimers = new Map();
     #pollBackoff = new Map();
     #drainLocks = new Map();
-    #owedWakes = new Set();
+    #admissionLocks = new Map();
     #completionWakeGates = new Map();
     #acceptingWork = false;
-    constructor({ db, lifecycle, injectPrompt, assertInjectionCompatibility, reconcilePrompts, runLoop, loopUsage, loopAttributions, takeParkDeadline, cancelSubscription, hasActiveStreams, isDetachedSubscription, readSystemPrompt, emitLogEntry, emit, }) {
+    constructor({ db, lifecycle, injectPrompt, assertInjectionCompatibility, reconcilePrompts, runLoop, loopUsage, loopAttributions, cancelSubscription, hasActiveStreams, readSystemPrompt, emitLogEntry, emit, }) {
         this.#db = db;
         this.#lifecycle = lifecycle;
         this.#injectPrompt = injectPrompt;
@@ -54,10 +52,8 @@ export default class DrainSupervisor {
         this.#runLoop = runLoop;
         this.#loopUsage = loopUsage;
         this.#loopAttributions = loopAttributions;
-        this.#takeParkDeadline = takeParkDeadline;
         this.#cancelSubscription = cancelSubscription;
         this.#hasActiveStreams = hasActiveStreams;
-        this.#isDetachedSubscription = isDetachedSubscription;
         this.#readSystemPrompt = readSystemPrompt;
         this.#emitLogEntry = emitLogEntry;
         this.#emit = emit;
@@ -71,28 +67,24 @@ export default class DrainSupervisor {
             if (!scope.signal.aborted)
                 scope.abort(reason);
         }
-        for (const timer of this.#pollTimers.values())
-            clearTimeout(timer);
-        for (const timer of this.#parkTimers.values())
+        for (const { timer } of this.#loopTimers.values())
             clearTimeout(timer);
         this.#pollBackoff.clear();
-        this.#pollTimers.clear();
-        this.#parkTimers.clear();
+        this.#loopTimers.clear();
     }
     async idle() {
         for (;;) {
             const pending = [
                 ...[...this.#activeDrains.values()].map(({ promise }) => promise),
-                ...this.#drainExitTasks,
-                ...this.#wakeTasks,
+                ...this.#settlementTasks,
             ];
             if (pending.length === 0)
                 break;
             await Promise.allSettled(pending);
         }
-        const failures = this.#wakeFailures.splice(0);
+        const failures = this.#settlementFailures.splice(0);
         if (failures.length > 0) {
-            throw new AggregateError(failures, "wake-on-completion settlement failed");
+            throw new AggregateError(failures, "worker lifecycle settlement failed");
         }
     }
     async inject(args) {
@@ -100,10 +92,23 @@ export default class DrainSupervisor {
             throw new Error("drain injection cannot combine an explicit policy with a fresh-loop policy");
         }
         const { workspaceId, workerId, prompt } = args;
-        const activeInjection = await this.#withDrainLock(workerId, async () => {
-            if (!this.#activeDrains.has(workerId))
-                return null;
-            const active = await this.#db.drain_current_loop_for_worker.get({ worker_id: workerId });
+        const delivery = await this.#withAdmissionLock(workspaceId, () => this.#withDrainLock(workerId, async () => {
+            if (!this.#acceptingWork)
+                throw new Error("The daemon is not accepting work.");
+            if (args.sourceLoopId !== undefined) {
+                const source = await this.#db.drain_message_source.get({
+                    loop_id: args.sourceLoopId,
+                });
+                if (source === undefined || source.workspace_id !== workspaceId) {
+                    throw new Error(`message source loop ${args.sourceLoopId} does not belong to workspace ${workspaceId}`);
+                }
+                if (source.status !== 102) {
+                    throw new OperationFailureError(Results.failure("daemon:admission", "source-not-running", 409, `The originating task is not running (status ${source.status}); no message was admitted.`, {}, { loopId: args.sourceLoopId, sourceStatus: source.status, retryable: false }));
+                }
+            }
+            const active = args.schedule === undefined
+                ? await this.#db.drain_current_loop_for_worker.get({ worker_id: workerId })
+                : undefined;
             if (active !== undefined) {
                 await this.#assertInjectionCompatibility({
                     workerId,
@@ -116,93 +121,61 @@ export default class DrainSupervisor {
                     ...(args.policy === undefined ? {} : { policy: args.policy }),
                 });
             }
-            const result = await this.#injectPrompt(workerId, prompt, args.openPaths ?? [], args.source);
+            const result = active === undefined ? null
+                : await this.#injectPrompt(active.id, prompt, args.openPaths ?? [], args.source);
             if (result !== null) {
                 // runLoop may already have parked in the database while this drain
                 // is still registered. Wake that state now; if it is still running,
                 // the serialized park-boundary check below supplies the wake edge.
-                await this.#lifecycle.wake(result.loopId);
+                await this.#wakeLoop(workerId, result.loopId);
                 return { action: "injected_next_turn", loopId: result.loopId, turnSeq: result.turnSeq };
             }
-            return null;
-        });
-        if (activeInjection !== null)
-            return activeInjection;
-        // A parked worker resumes the same durable loop; a wake is not a new
-        // loop and cannot silently replace its policy/provider/turn ceiling.
-        if (!this.#activeDrains.has(workerId)) {
-            const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-            if (slept !== undefined) {
-                await this.#assertInjectionCompatibility({
-                    workerId,
-                    loopId: slept.id,
-                    providerSpec: args.providerSpec,
-                    providerSpecExplicit: args.providerSpecExplicit,
-                    reasoningPolicy: args.reasoningPolicy,
-                    ...(args.childProviderSpec === undefined ? {} : { childProviderSpec: args.childProviderSpec }),
-                    ...(args.turnCeiling === undefined ? {} : { turnCeiling: args.turnCeiling }),
-                    ...(args.policy === undefined ? {} : { policy: args.policy }),
-                });
-                const injected = await this.#injectPrompt(workerId, prompt, args.openPaths ?? [], args.source);
-                await this.#lifecycle.wake(slept.id);
-                const started = await this.ensureDrain({ workspaceId, workerId, systemPrompt: args.systemPrompt });
-                return {
-                    action: "injected_next_turn",
-                    loopId: slept.id,
-                    ...(injected?.turnSeq === undefined ? {} : { turnSeq: injected.turnSeq }),
-                    ...(started ?? {}),
-                };
-            }
-        }
-        const loopId = await this.enqueueFreshLoop({
-            workerId,
-            prompt,
-            ...(args.source === undefined ? {} : { source: args.source }),
-            providerSpec: args.providerSpec,
-            reasoningPolicy: args.reasoningPolicy,
-            childProviderSpec: args.childProviderSpec ?? null,
-            maxTurns: args.turnCeiling?.effective,
-            policy: args.policy ?? args.freshLoopPolicy,
-            openPaths: args.openPaths,
-        });
-        const started = await this.ensureDrain({ workspaceId, workerId, systemPrompt: args.systemPrompt });
-        return { action: "enqueued_new_loop", loopId, ...(started ?? {}) };
-    }
-    enqueueFreshLoop(args) {
-        return this.#withDrainLock(args.workerId, async () => {
-            const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: args.workerId });
-            if (seqRow === undefined)
-                throw new Error("enqueueFreshLoop: next-sequence query returned no row");
-            // {§worker-model-selection} — resolve the complete route before persistence;
-            // the loop snapshot stores the immutable route ids, never re-serialized JSON.
-            const modelRouteId = await routeForSpec(this.#db, args.providerSpec);
-            const spawnRouteId = await routeForSpec(this.#db, args.childProviderSpec);
-            const loopRow = await this.#db.drain_enqueue_loop.get({
-                worker_id: args.workerId,
-                sequence: seqRow.next,
-                prompt: args.prompt,
-                prompt_source: args.source ?? null,
-                model_route_id: modelRouteId,
-                spawn_model_route_id: spawnRouteId,
-                reasoning_policy: args.reasoningPolicy,
-                max_turns: args.maxTurns ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
+            const accepted = await this.#enqueueFreshLoop({
+                workerId,
+                prompt,
+                ...(args.source === undefined ? {} : { source: args.source }),
+                providerSpec: args.providerSpec,
+                reasoningPolicy: args.reasoningPolicy,
+                childProviderSpec: args.childProviderSpec ?? null,
+                maxTurns: args.turnCeiling?.effective,
+                policy: args.policy ?? args.freshLoopPolicy,
+                openPaths: args.openPaths,
+                schedule: args.schedule,
             });
-            if (loopRow === undefined)
-                throw new Error("enqueueFreshLoop: loop enqueue returned no row");
-            if (args.policy !== undefined) {
-                await this.#db.engine_set_loop_policy.run({
-                    loop_id: loopRow.id,
-                    policy: JSON.stringify({ ...DEFAULT_LOOP_POLICY, ...args.policy }),
-                });
-            }
-            if (args.openPaths !== undefined && args.openPaths.length > 0) {
-                await this.#db.engine_set_loop_open_paths.run({
-                    loop_id: loopRow.id,
-                    open_paths: JSON.stringify(args.openPaths),
-                });
+            return { action: "enqueued_new_loop", ...accepted };
+        }));
+        const started = await this.ensureDrain({ workspaceId, workerId, systemPrompt: args.systemPrompt });
+        return { ...delivery, ...(started ?? {}) };
+    }
+    async #enqueueFreshLoop(args) {
+        const now = Date.now();
+        if (args.schedule !== undefined) {
+            const { delayMs, intervalMs } = args.schedule;
+            if (!Number.isSafeInteger(delayMs) || delayMs < 0 || now + delayMs > 8.64e15
+                || (intervalMs !== undefined && (!Number.isSafeInteger(intervalMs) || intervalMs <= 0 || now + delayMs + intervalMs > 8.64e15))) {
+                throw new TypeError("task schedule requires nonnegative delay and positive interval in safe integer milliseconds within the supported date range");
             }
-            return loopRow.id;
+        }
+        // {§worker-model-selection} — resolve the complete route before persistence;
+        // the loop snapshot stores the immutable route ids, never re-serialized JSON.
+        const modelRouteId = await routeForSpec(this.#db, args.providerSpec);
+        const spawnRouteId = await routeForSpec(this.#db, args.childProviderSpec);
+        const loopRow = await this.#db.drain_enqueue_loop.get({
+            worker_id: args.workerId,
+            prompt: args.prompt,
+            prompt_source: args.source ?? null,
+            model_route_id: modelRouteId,
+            spawn_model_route_id: spawnRouteId,
+            reasoning_policy: args.reasoningPolicy,
+            max_turns: args.maxTurns ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
+            policy: JSON.stringify({ ...DEFAULT_LOOP_POLICY, ...args.policy }),
+            open_paths: JSON.stringify(args.openPaths ?? []),
+            scheduled_at: args.schedule === undefined ? null : now + args.schedule.delayMs,
+            repeat_interval_ms: args.schedule?.intervalMs ?? null,
         });
+        if (loopRow === undefined)
+            throw new Error("enqueueFreshLoop: loop enqueue returned no row");
+        return { loopId: loopRow.id, ...taskTiming(loopRow) };
     }
     // Consume one worker's durable queue until a lock-held empty re-claim
     // relinquishes this exact drain identity.
@@ -221,7 +194,7 @@ export default class DrainSupervisor {
             rejectFirst = rej;
         });
         let firstSettled = false;
-        const claim = () => this.#db.drain_claim_next_loop.get({ worker_id: workerId });
+        const claim = () => this.#db.drain_claim_next_loop.get({ worker_id: workerId, now: Date.now() });
         const drainPromise = (async () => {
             let loopsDrained = 0;
             let lastResult = null;
@@ -248,6 +221,7 @@ export default class DrainSupervisor {
                             break;
                     }
                     currentLoopId = loopRow.id;
+                    this.#clearLoopTimer(loopRow.id);
                     const onSettled = async (logEntryId) => {
                         await this.#emitLogEntry(workspaceId, logEntryId).catch((error) => {
                             console.error("log/entry broadcast failed:", error instanceof Error ? error.message : String(error));
@@ -269,32 +243,11 @@ export default class DrainSupervisor {
                         return loopResult;
                     });
                     if (result.result.status === 202) {
-                        // The loop slept via SEND signal 202 — suspended, not terminated. Leave it at 202
+                        // The loop parked — suspended, not terminated. Leave it at 202
                         // (resumable); no loop/terminated, no orphan-reconcile. A stream conclusion
                         // through handleWakeWorker re-queues it; if it holds a polled stream, a poll timer
                         // wakes it every P to inspect ({§exec-poll}). {§worker-lifecycle-wake-liveness}.
-                        void this.schedulePollWake(workspaceId, workerId, systemPrompt).catch((err) => console.error("poll-wake scheduling failed:", err instanceof Error ? err.message : String(err)));
-                        // {§send-premature-terminate}/scoped SEND signal 202 — the park deadline:
-                        // dispatcher recorded the marker's seconds; a bounded park is woken at T
-                        // regardless of arrivals, so a park always has a next turn. -1 (indefinite:
-                        // the butler, a [300] ask) schedules nothing — irc/inject/conclusions wake it.
-                        // In-memory: a daemon restart drops pending deadlines.
-                        if (currentLoopId !== null) {
-                            const deadline = this.#takeParkDeadline(currentLoopId);
-                            const prior = this.#parkTimers.get(workerId);
-                            if (prior !== undefined) {
-                                clearTimeout(prior);
-                                this.#parkTimers.delete(workerId);
-                            }
-                            if (deadline !== undefined && deadline > 0) {
-                                const t = setTimeout(() => {
-                                    this.#parkTimers.delete(workerId);
-                                    void this.#wakeParkedWorker(workspaceId, workerId, systemPrompt).catch((err) => console.error("park-deadline wake failed:", err instanceof Error ? err.message : String(err)));
-                                }, deadline * 1000);
-                                t.unref();
-                                this.#parkTimers.set(workerId, t);
-                            }
-                        }
+                        await this.scheduleWakes(workspaceId, workerId, systemPrompt);
                         // Serialize the park boundary against active prompt injection.
                         // Whichever side arrives first owns a wake edge: injection wakes
                         // an already-parked loop, while this check wakes a prompt written
@@ -302,42 +255,37 @@ export default class DrainSupervisor {
                         const promptWaiting = await this.#withDrainLock(workerId, async () => {
                             const prefix = promptLoopPrefix(loopRow.sequence);
                             const undelivered = await this.#db.drain_undelivered_prompts_for_loop.get({
-                                owner_id: workerId,
+                                worker_id: workerId,
                                 pattern: `${prefix}%`,
                                 prefix_len: prefix.length,
                                 loop_id: loopRow.id,
                             });
                             if (undelivered === undefined)
                                 return false;
-                            await this.#lifecycle.wake(loopRow.id);
-                            return true;
+                            return this.#wakeLoop(workerId, loopRow.id);
                         });
                         if (promptWaiting) {
                             currentLoopId = null;
                             continue;
                         }
-                        // Honor an OWED wake ({§worker-lifecycle-child-wake}): a child/stream concluded while
-                        // this worker was mid-turn, before it slept — resume in place rather than park blind,
-                        // so a worker hibernation always returns. The loop is 202 here; reset to
-                        // claimable and the drain re-runs it on the next claim below.
-                        if (this.#owedWakes.delete(workerId)) {
-                            await this.#lifecycle.wake(loopRow.id);
+                        // {§loop-wake-identity}: events observed by another loop
+                        // cannot consume this loop's completion wake.
+                        if (await this.#wakeLoop(workerId, loopRow.id, { eventOnly: true })) {
                             currentLoopId = null;
                             continue;
                         }
-                        // The loop is blocked at 202 on a live obligation ({§wait-obligation-matrix});
-                        // that obligation's conclusion is its wake edge (the owed-wake above covers the
-                        // conclude-before-block race). An idle wait never reaches here — it concluded at dispatch.
+                        // {§worker-wait-timing}: the wait now belongs to its
+                        // durable clock or completion obligations, not this drain.
                         currentLoopId = null;
                         continue;
                     }
-                    this.#owedWakes.delete(workerId); // the loop concluded (non-202) — no park to honor a held wake at
+                    this.#pollBackoff.delete(loopRow.id);
                     const [usage, attributions, turnIds] = await Promise.all([
                         this.#loopUsage(loopRow.id),
                         this.#loopAttributions(loopRow.id),
                         this.#lifecycle.turnIds(loopRow.id),
                     ]);
-                    this.#emit(workspaceId, "loop/terminated", {
+                    this.#publishTermination(workspaceId, {
                         workerId,
                         loopId: loopRow.id,
                         result: result.result,
@@ -396,7 +344,7 @@ export default class DrainSupervisor {
                             this.#loopAttributions(currentLoopId),
                         ]);
                         if (cancelled !== null) {
-                            this.#emit(workspaceId, "loop/terminated", {
+                            this.#publishTermination(workspaceId, {
                                 workerId,
                                 loopId: currentLoopId,
                                 result: cancelled,
@@ -450,7 +398,7 @@ export default class DrainSupervisor {
                             this.#loopUsage(currentLoopId),
                             this.#loopAttributions(currentLoopId),
                         ]);
-                        this.#emit(workspaceId, "loop/terminated", {
+                        this.#publishTermination(workspaceId, {
                             workerId,
                             loopId: currentLoopId,
                             result: settled,
@@ -474,21 +422,12 @@ export default class DrainSupervisor {
                 }
                 if (this.#activeDrains.get(workerId) === handle)
                     this.#activeDrains.delete(workerId);
+                await this.scheduleWakes(workspaceId, workerId, systemPrompt);
             }
             return { loopsDrained, lastResult };
         })();
         handle.promise = drainPromise;
         this.#activeDrains.set(workerId, handle);
-        // Topology join ({§worker-loop-lifecycle}): when this drain exits having CONCLUDED the worker, wake its parent
-        // if parked. Runs after the drain fully tears down (settled promise) so the quiescence check sees
-        // final state; speculative (#onDrainExit no-ops unless the worker concluded AND the parent is parked).
-        const drainExitTask = drainPromise.then(() => this.#onDrainExit(workspaceId, workerId, systemPrompt), () => this.#onDrainExit(workspaceId, workerId, systemPrompt));
-        this.#drainExitTasks.add(drainExitTask);
-        void drainExitTask.catch((err) => {
-            console.error(`parent wake after worker ${workerId} settlement failed:`, err);
-        }).finally(() => {
-            this.#drainExitTasks.delete(drainExitTask);
-        });
         // Swallow unhandled rejections (drain aborts with no awaiter); the
         // error already surfaced via firstLoopPromise or was logged inside.
         drainPromise.catch(() => { });
@@ -502,12 +441,20 @@ export default class DrainSupervisor {
     // A promise-chain mutex: each caller awaits the prior holder; the tail self-prunes
     // when idle so the Map stays bounded to workers mid-transition.
     #withDrainLock(workerId, fn) {
-        const prev = this.#drainLocks.get(workerId) ?? Promise.resolve();
+        return _a.#withLock(this.#drainLocks, workerId, fn);
+    }
+    // {§worker-causal-admission}: workspace control precedes worker queue control;
+    // neither encloses provider/tool execution or waits for a drain to finish.
+    #withAdmissionLock(workspaceId, fn) {
+        return _a.#withLock(this.#admissionLocks, workspaceId, fn);
+    }
+    static #withLock(locks, id, fn) {
+        const prev = locks.get(id) ?? Promise.resolve();
         const run = prev.then(fn, fn);
         const tail = run.catch(() => { });
-        this.#drainLocks.set(workerId, tail);
-        void tail.then(() => { if (this.#drainLocks.get(workerId) === tail)
-            this.#drainLocks.delete(workerId); });
+        locks.set(id, tail);
+        void tail.then(() => { if (locks.get(id) === tail)
+            locks.delete(id); });
         return run;
     }
     // The drain guarantee, serialized per worker via #withDrainLock so it can't race a
@@ -516,18 +463,33 @@ export default class DrainSupervisor {
     // or its lock-held exit re-claim → return null. A registered-but-ABORTING drain is
     // in teardown and won't claim, so we don't defer to it — start fresh, or the loop
     // strands on a cancel/resume race (I6 no-lost-loop). Otherwise start one.
-    ensureDrain(opts) {
-        return this.#withDrainLock(opts.workerId, async () => {
+    async ensureDrain(opts) {
+        let deferred = false;
+        const started = await this.#withDrainLock(opts.workerId, async () => {
+            if (!this.#acceptingWork)
+                return null;
             const existing = this.#activeDrains.get(opts.workerId);
             if (existing !== undefined && !existing.controller.signal.aborted)
                 return null;
+            if (await this.#db.drain_ready_loop.get({ worker_id: opts.workerId, now: Date.now() }) === undefined) {
+                deferred = true;
+                return null;
+            }
+            if (!this.#acceptingWork)
+                return null;
             return this.#startDrain(opts);
         });
+        if (deferred)
+            await this.scheduleWakes(opts.workspaceId, opts.workerId, opts.systemPrompt);
+        return started;
     }
     // Prompt promotion shares the worker lock with enqueue and drain teardown,
     // while Daemon retains the durable prompt-policy implementation.
-    reconcileOrphanedPrompts(workerId, endedLoopId) {
-        return this.#withDrainLock(workerId, () => this.#reconcilePrompts(workerId, endedLoopId));
+    async reconcileOrphanedPrompts(workerId, endedLoopId) {
+        const row = await this.#db.drain_get_worker_workspace.get({ worker_id: workerId });
+        if (row === undefined)
+            throw new Error(`prompt promotion worker ${workerId} does not exist`);
+        return this.#withAdmissionLock(row.workspace_id, () => this.#withDrainLock(workerId, () => this.#reconcilePrompts(workerId, endedLoopId)));
     }
     #workerSignal(workerId) {
         const existing = this.#workerAborts.get(workerId);
@@ -538,25 +500,26 @@ export default class DrainSupervisor {
         return fresh;
     }
     async #cancelTree(workerId, reason, includeRoot) {
-        const cancelled = await this.#lifecycle.cancelTree(workerId, reason, includeRoot);
-        for (const targetWorkerId of cancelled.workerIds) {
-            const pollTimer = this.#pollTimers.get(targetWorkerId);
-            if (pollTimer !== undefined) {
-                clearTimeout(pollTimer);
-                this.#pollTimers.delete(targetWorkerId);
-            }
-            const parkTimer = this.#parkTimers.get(targetWorkerId);
-            if (parkTimer !== undefined) {
-                clearTimeout(parkTimer);
-                this.#parkTimers.delete(targetWorkerId);
+        const owner = await this.#db.drain_get_worker_workspace.get({ worker_id: workerId });
+        if (owner === undefined)
+            throw new Error(`cancellation worker ${workerId} does not exist`);
+        const { cancelled, subscriptions } = await this.#withAdmissionLock(owner.workspace_id, async () => {
+            const cancelled = await this.#lifecycle.cancelTree(workerId, reason, includeRoot);
+            const subscriptions = (await Promise.all(cancelled.workerIds.map((id) => ChannelWrite.findOpenSubscriptionsForWorker(this.#db, id)))).flat();
+            for (const targetWorkerId of cancelled.workerIds) {
+                for (const [loopId, timer] of this.#loopTimers) {
+                    if (timer.workerId === targetWorkerId)
+                        this.#clearLoopTimer(loopId);
+                }
+                const scope = this.#workerAborts.get(targetWorkerId);
+                if (scope !== undefined && !scope.signal.aborted)
+                    scope.abort(reason);
             }
-            this.#pollBackoff.delete(targetWorkerId);
-            this.#owedWakes.delete(targetWorkerId);
-            const scope = this.#workerAborts.get(targetWorkerId);
-            if (scope !== undefined && !scope.signal.aborted)
-                scope.abort(reason);
-        }
-        await Promise.all(cancelled.workerIds.map(async (targetWorkerId) => this.#reapWorkerStreams(targetWorkerId)));
+            return { cancelled, subscriptions };
+        });
+        for (const { loopId } of cancelled.loops)
+            this.#pollBackoff.delete(loopId);
+        await Promise.all(subscriptions.map(({ id }) => this.#cancelSubscription(id)));
         for (const { loopId, workerId: targetWorkerId, result } of cancelled.loops) {
             const row = await this.#db.drain_get_worker_workspace.get({
                 worker_id: targetWorkerId,
@@ -567,7 +530,7 @@ export default class DrainSupervisor {
                 this.#loopUsage(loopId),
                 this.#loopAttributions(loopId),
             ]);
-            this.#emit(row.workspace_id, "loop/terminated", {
+            this.#publishTermination(row.workspace_id, {
                 workerId: targetWorkerId,
                 loopId,
                 result,
@@ -579,90 +542,55 @@ export default class DrainSupervisor {
         }
     }
     cancelWorkerTree(workerId, reason) {
-        return this.#cancelTree(workerId, reason, true);
+        return this.#trackSettlement(this.#cancelTree(workerId, reason, true), `cancelTree(${workerId})`);
     }
     cancelDescendants(workerId, reason) {
-        return this.#cancelTree(workerId, reason, false);
-    }
-    // {§worker-model-selection} — the 409 boundary: a worker with a live drain
-    // holding a loop, or a parked (slept) loop, owns active work; a model
-    // selection must not mutate underneath it.
-    async hasLiveWork(workerId) {
-        if (this.#activeDrains.has(workerId)) {
-            const active = await this.#db.drain_current_loop_for_worker.get({ worker_id: workerId });
-            if (active !== undefined)
-                return true;
-        }
-        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-        return slept !== undefined;
+        return this.#trackSettlement(this.#cancelTree(workerId, reason, false), `cancelDescendants(${workerId})`);
     }
     cancel(workerId, reason = "user_cancelled") {
         const hadDrain = this.#activeDrains.has(workerId);
         const hadWork = hadDrain || this.#hasActiveStreams(workerId);
-        const pollTimer = this.#pollTimers.get(workerId);
-        if (pollTimer !== undefined) {
-            clearTimeout(pollTimer);
-            this.#pollTimers.delete(workerId);
-        }
-        void this.cancelWorkerTree(workerId, reason).catch((error) => {
-            console.error(`cancelTree(${workerId}) failed:`, error);
-        });
+        void this.cancelWorkerTree(workerId, reason);
         return hadWork;
     }
-    async #reapWorkerStreams(workerId) {
-        const open = await ChannelWrite.findOpenSubscriptionsForWorker(this.#db, workerId);
-        await Promise.all(open.map(({ id }) => this.#cancelSubscription(id)));
-    }
     // {§module-shutdown-order}: the producer emits synchronously, while the
     // supervisor owns the asynchronous scheduler work and its shutdown truth.
     notifyWakeWorker(payload) {
-        const task = this.#handleWakeWorker(payload);
-        this.#wakeTasks.add(task);
-        void task.then(() => { this.#wakeTasks.delete(task); }, (error) => {
-            this.#wakeTasks.delete(task);
-            this.#wakeFailures.push(error);
-            console.error("wake-on-completion failed:", error);
+        this.#trackSettlement(this.#handleWakeWorker(payload), "wake-on-completion");
+    }
+    #trackSettlement(task, label) {
+        this.#settlementTasks.add(task);
+        void task.then(() => { this.#settlementTasks.delete(task); }, (error) => {
+            this.#settlementTasks.delete(task);
+            this.#settlementFailures.push(error);
+            console.error(`${label} failed:`, error);
         });
+        return task;
     }
     async #handleWakeWorker(payload) {
-        const { entryOwnerId, workspaceId, ...wake } = payload;
-        const conclusion = { ...wake, workerId: entryOwnerId };
-        // Aborted streams don't wake — the abort was deliberate.
-        if (payload.result.status === 499) {
-            this.#emit(workspaceId, "stream/concluded", {
-                ...conclusion, wakeAction: "skipped-aborted",
-            });
-            return;
-        }
-        // No resurrection ({§worker-lifecycle-no-resurrection}): a non-499 completion whose
-        // worker was cancelled (idle + its scope aborted) must not start a fresh drain —
-        // the cancel was deliberate. The deliverable is already in the channel/log and
-        // surfaces as a `collect` environment delta ({§env-delta}) if the worker is read or
-        // resumed; we just don't inject a turn. (An active worker folds the wake into its
-        // next turn via inject below; a resumed worker is active, never aborted, so it is
-        // unaffected.)
+        const { workspaceId, ...conclusion } = payload;
+        // {§worker-lifecycle-no-resurrection}: scope cancellation, not the
+        // command's result code, prevents a wake. Cancelling one command still
+        // produces an observation owed to its live worker.
         const scope = this.#workerAborts.get(payload.workerId);
-        if (scope?.signal.aborted === true && !this.#activeDrains.has(payload.workerId)) {
+        if (scope?.signal.aborted === true) {
             this.#emit(workspaceId, "stream/concluded", {
-                ...conclusion, wakeAction: "skipped-cancelled",
+                ...conclusion, wakeAction: payload.result.status === 499 ? "skipped-aborted" : "skipped-cancelled",
             });
             return;
         }
         const systemPrompt = await this.#readSystemPrompt();
-        // A slept (202) loop means the worker parked via SEND signal 202 → resume it in place: re-queue
-        // it (202→100) so the drain re-claims and CONTINUES it (seq>1 → no re-foist). Checked
-        // FIRST: the slept status is the worker's true disposition regardless of a draining
-        // sibling mid-teardown (the ensureDrain lock serializes the re-claim). No fresh loop,
-        // no summary-as-prompt — the resumed loop reads the concluded stream's own state from
-        // the manifest. {§worker-lifecycle-wake-liveness}.
+        // {§notifications-stream-concluded}: publish the terminal stream fact
+        // before settlement. Rechecked wait identities, not this event, decide
+        // whether any loop actually resumes.
         const slept = await this.#db.drain_find_slept_loop.get({ worker_id: payload.workerId });
         if (slept !== undefined) {
             // {§worker-optimistic-settlement} — publish this conclusion now,
             // then let the worker-local gate coalesce only the provider
             // dispatch. Concurrent stream/child callbacks join that one gate.
-            const settlement = this.settleCompletionWake(workspaceId, payload.workerId, systemPrompt, false);
+            const settlement = this.settleCompletionWake(workspaceId, payload.workerId, systemPrompt);
             this.#emit(workspaceId, "stream/concluded", {
-                ...conclusion, wakeAction: "resumed-loop", wakeLoopId: slept.id,
+                ...conclusion, wakeAction: "wake-pending",
             });
             await settlement;
             return;
@@ -677,77 +605,130 @@ export default class DrainSupervisor {
             });
             return;
         }
-        // No slept loop, no active drain — nothing to resume (e.g. a SEND-200-done worker whose
+        // No slept loop, no active drain — nothing to resume (e.g. a completed worker whose
         // streams were swept). Surface the conclusion without opening a loop.
         this.#emit(workspaceId, "stream/concluded", {
             ...conclusion, wakeAction: "no-loop",
         });
     }
-    async schedulePollWake(workspaceId, workerId, systemPrompt) {
-        const existing = this.#pollTimers.get(workerId);
-        if (existing !== undefined) {
-            clearTimeout(existing);
-            this.#pollTimers.delete(workerId);
+    #clearLoopTimer(loopId) {
+        const current = this.#loopTimers.get(loopId);
+        if (current === undefined)
+            return;
+        clearTimeout(current.timer);
+        this.#loopTimers.delete(loopId);
+    }
+    async scheduleWakes(workspaceId, workerId, systemPrompt) {
+        await this.#withDrainLock(workerId, async () => {
+            if (!this.#acceptingWork)
+                return;
+            const waits = await this.#lifecycle.parked(workerId);
+            const queued = await this.#db.drain_scheduled_loops.all({ worker_id: workerId });
+            if (!this.#acceptingWork)
+                return;
+            for (const [loopId, timer] of this.#loopTimers) {
+                if (timer.workerId === workerId && !waits.some(({ id }) => id === loopId)
+                    && !queued.some(({ id }) => id === loopId))
+                    this.#clearLoopTimer(loopId);
+            }
+            for (const wait of waits) {
+                if (wait.wait_poll_interval === null && wait.wait_poll_at === null) {
+                    const interval = await this.#inheritedPollMs(workerId, wait.id);
+                    if (!this.#acceptingWork)
+                        return;
+                    if (interval !== null) {
+                        wait.wait_poll_at = Date.now() + interval;
+                        await this.#lifecycle.inheritPoll(wait.id, wait.wait_revision, wait.wait_poll_at);
+                    }
+                }
+                const dueAt = Math.min(wait.wait_deadline_at ?? Infinity, wait.wait_poll_at ?? Infinity);
+                if (!Number.isFinite(dueAt))
+                    continue;
+                this.#armTimer(workspaceId, workerId, systemPrompt, wait.id, 202, wait.wait_revision, dueAt);
+            }
+            for (const task of queued) {
+                this.#armTimer(workspaceId, workerId, systemPrompt, task.id, 100, task.wait_revision, task.scheduled_at);
+            }
+        });
+    }
+    #armTimer(workspaceId, workerId, systemPrompt, loopId, status, revision, dueAt) {
+        if (!this.#acceptingWork)
+            return;
+        const prior = this.#loopTimers.get(loopId);
+        if (prior?.revision === revision && prior.status === status && prior.dueAt === dueAt)
+            return;
+        this.#clearLoopTimer(loopId);
+        const timer = setTimeout(() => {
+            if (this.#loopTimers.get(loopId)?.timer !== timer)
+                return;
+            this.#loopTimers.delete(loopId);
+            this.#trackSettlement(this.#wakeTimedLoop(workspaceId, workerId, systemPrompt, loopId, status, revision), "wake-on-completion");
+        }, Math.max(1, Math.min(dueAt - Date.now(), 2_147_483_647)));
+        timer.unref();
+        this.#loopTimers.set(loopId, { workerId, status, revision, dueAt, timer });
+    }
+    async #wakeTimedLoop(workspaceId, workerId, systemPrompt, loopId, status, revision) {
+        if (!this.#acceptingWork)
+            return;
+        if (status === 100 || await this.#wakeLoop(workerId, loopId, { revision, dueAt: Date.now() })) {
+            await this.ensureDrain({ workspaceId, workerId, systemPrompt });
         }
+        else {
+            // A capped timer or backwards clock may fire before the durable due time.
+            await this.scheduleWakes(workspaceId, workerId, systemPrompt);
+        }
+    }
+    async #inheritedPollMs(workerId, loopId) {
         const row = await this.#db.drain_worker_min_poll.get({ worker_id: workerId });
+        if (!this.#acceptingWork)
+            return null;
         if ((row?.open_count ?? 0) === 0) {
-            this.#pollBackoff.delete(workerId);
-            return;
+            this.#pollBackoff.delete(loopId);
+            return null;
         }
         const pollSec = row?.poll_seconds ?? null;
         // {§exec-poll} — a positive explicit cadence wins, zero opts out,
         // and an absent cadence uses the worker's exponential-backoff step.
         let delayMs;
         if (pollSec !== null && pollSec > 0) {
-            this.#pollBackoff.delete(workerId);
+            this.#pollBackoff.delete(loopId);
             delayMs = pollSec * 1000;
         }
         else if (pollSec === 0) {
-            this.#pollBackoff.delete(workerId);
-            return; // explicit opt-out
+            this.#pollBackoff.delete(loopId);
+            return null; // explicit opt-out
         }
         else {
             // An open stream without an explicit cadence uses the stream polling floor.
             // Child joins never enter this branch: durable child settlement is their only wake edge.
             const base = Number(process.env.PLURNK_SERVICE_EXEC_POLL_SEC ?? "60");
             const turns = Number(process.env.PLURNK_SERVICE_EXEC_POLL_TURNS ?? "8");
-            const step = this.#pollBackoff.get(workerId) ?? 0;
+            const step = this.#pollBackoff.get(loopId) ?? 0;
             delayMs = execPollBackoffMs(step, base, turns);
-            this.#pollBackoff.set(workerId, step + 1);
+            this.#pollBackoff.set(loopId, step + 1);
         }
         // Floored by the optimistic settlement cap so a `<…,1>` cannot wake a
         // parked loop faster than the preceding turn's settlement scale.
-        const optimisticWaitMs = readOptimisticSettlementMs();
-        const timer = setTimeout(() => {
-            this.#pollTimers.delete(workerId);
-            void this.#wakeParkedWorker(workspaceId, workerId, systemPrompt);
-        }, Math.max(delayMs, optimisticWaitMs));
-        timer.unref();
-        this.#pollTimers.set(workerId, timer);
+        return Math.max(delayMs, readOptimisticSettlementMs());
     }
-    /** Resume `workerId`'s slept (202) loop in place — the same 202→100 resume handleWakeWorker uses, minus a
-     *  wake payload. The shared wake primitive: a poll cadence ({§exec-poll}), a watched stream concluding,
-     *  or a child worker finishing ({§worker-loop-lifecycle} topology join) all call this. A no-op if the worker was
-     *  cancelled or isn't actually parked (no slept loop) — so calling it speculatively is safe. */
-    async #wakeParkedWorker(workspaceId, workerId, systemPrompt, oweIfActive = true) {
+    async #wakeLoop(workerId, loopId, condition = {}) {
+        // {§worker-lifecycle-durable-disposition}: test admission at the mutation,
+        // after asynchronous prompt, completion, or deadline selection.
+        if (!this.#acceptingWork || this.#workerAborts.get(workerId)?.signal.aborted)
+            return false;
+        return this.#lifecycle.wake(loopId, condition);
+    }
+    async #wakeParkedWorker(workspaceId, workerId, systemPrompt) {
         if (!this.#acceptingWork)
             return;
-        const scope = this.#workerAborts.get(workerId);
-        if (scope?.signal.aborted === true && !this.#activeDrains.has(workerId))
-            return; // cancelled — no resurrection
-        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-        if (slept === undefined) {
-            // Not parked. If a drain is still ACTIVE, the worker is mid-turn and about to park — the
-            // conclusion that fired this wake arrived before the 202 committed (the conclude-before-park
-            // race). Owe the wake: the drain honors it at park so a worker hibernation never deadlocks.
-            // (No active drain → already concluded/running; nothing to wake.)
-            if (this.#activeDrains.has(workerId)) {
-                if (oweIfActive)
-                    this.#owedWakes.add(workerId);
+        const waits = await this.#lifecycle.parked(workerId);
+        let woke = false;
+        for (const wait of waits) {
+            if (await this.#wakeLoop(workerId, wait.id, { revision: wait.wait_revision, eventOnly: true })) {
+                this.#clearLoopTimer(wait.id);
+                woke = true;
             }
-            return;
         }
-        const woke = await this.#lifecycle.wake(slept.id);
         if (!woke)
             return;
         const started = await this.ensureDrain({
@@ -760,14 +741,11 @@ export default class DrainSupervisor {
         });
     }
     async #workerHasLiveObligation(workerId) {
-        const [openSubscriptions, liveChild] = await Promise.all([
-            this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId }),
-            this.#db.engine_worker_has_live_child.get({ worker_id: workerId }),
-        ]);
-        // {§exec-timeout} — a `<-1>` spawn outlives the loop and is nobody's obligation.
-        return openSubscriptions.some(({ id }) => !this.#isDetachedSubscription(id)) || liveChild !== undefined;
-    }
-    settleCompletionWake(workspaceId, workerId, systemPrompt, oweIfActive = true) {
+        // {§worker-obligations} — the same row the completion gate reads.
+        const held = await this.#db.worker_live_obligations.get({ worker_id: workerId });
+        return held !== undefined && (held.streams === 1 || held.workers === 1);
+    }
+    settleCompletionWake(workspaceId, workerId, systemPrompt) {
         const existing = this.#completionWakeGates.get(workerId);
         if (existing !== undefined) {
             existing.conclusions++;
@@ -781,23 +759,23 @@ export default class DrainSupervisor {
             promise: completed.promise,
         };
         this.#completionWakeGates.set(workerId, gate);
-        void this.#runCompletionWake(workspaceId, workerId, systemPrompt, oweIfActive, gate).then(completed.resolve, completed.reject).finally(() => {
+        void this.#runCompletionWake(workspaceId, workerId, systemPrompt, gate).then(completed.resolve, completed.reject).finally(() => {
             if (this.#completionWakeGates.get(workerId) === gate) {
                 this.#completionWakeGates.delete(workerId);
             }
         });
         return gate.promise;
     }
-    async #runCompletionWake(workspaceId, workerId, systemPrompt, oweIfActive, gate) {
+    async #runCompletionWake(workspaceId, workerId, systemPrompt, gate) {
         const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
         if (slept === undefined) {
             this.#releaseCompletionWake(workerId, gate);
-            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt, oweIfActive);
+            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt);
         }
         const timeoutMs = readOptimisticSettlementMs();
         if (timeoutMs === 0 || !(await this.#workerHasLiveObligation(workerId))) {
             this.#releaseCompletionWake(workerId, gate);
-            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt, false);
+            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt);
         }
         return observed("worker.wake.settlement", { "window.ms": timeoutMs }, async (span) => {
             const startedAt = performance.now();
@@ -829,7 +807,7 @@ export default class DrainSupervisor {
             this.#releaseCompletionWake(workerId, gate);
             if (release === "cancelled")
                 return;
-            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt, false);
+            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt);
         });
     }
     #releaseCompletionWake(workerId, gate) {
@@ -837,24 +815,18 @@ export default class DrainSupervisor {
             this.#completionWakeGates.delete(workerId);
         }
     }
-    /** A worker's drain exited. If the worker truly CONCLUDED — no 202-blocked loop, no open stream — then
-     *  wake its PARENT in place if the parent is blocked on the join (the structured-concurrency join — a
-     *  child finishing is the wake edge for a parent that waited on it, {§worker-lifecycle-child-wake}). A worker
-     *  blocked at 202, or still holding a stream, is NOT concluded — its own wake edges drive it, not this.
-     *  The parent reads the child's deliverable from its own log (the {§worker-scheme-collect} delta) on
-     *  resume — control edge here, never an injected prompt. Recurses up via the parent's own drain-exit. */
-    async #onDrainExit(workspaceId, workerId, systemPrompt) {
-        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-        if (slept !== undefined)
-            return; // parked at 202 — not concluded, the worker is still alive
-        const openSubs = (await this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId }))
-            .filter(({ id }) => !this.#isDetachedSubscription(id)); // {§exec-timeout} — `<-1>` is nobody's obligation
-        if (openSubs.length > 0)
-            return; // a stream still runs — its conclusion re-evaluates, not this exit
+    #publishTermination(workspaceId, event) {
+        this.#emit(workspaceId, "loop/terminated", event);
+        this.#trackSettlement(this.#notifyParentCompletion(workspaceId, event.workerId), "wake-on-completion");
+    }
+    // {§worker-lifecycle-child-wake}: completion belongs to a task, not drain teardown.
+    async #notifyParentCompletion(workspaceId, workerId) {
         const parent = await this.#db.worker_parent_id.get({ worker_id: workerId });
         if (parent?.parent_worker_id == null)
-            return; // a root worker — nobody to wake
-        await this.settleCompletionWake(workspaceId, parent.parent_worker_id, systemPrompt);
+            return;
+        await this.settleCompletionWake(workspaceId, parent.parent_worker_id, await this.#readSystemPrompt());
     }
 }
+_a = DrainSupervisor;
+export default DrainSupervisor;
 //# sourceMappingURL=DrainSupervisor.js.map