@plurnk/plurnk-service 1.3.12 → 1.4.0

package/dist/server/Daemon.js

@@ -1,6 +1,5 @@
 // Top-level daemon orchestrator. Owns the DB connection, engine, registries,
-// the plugin-module seam (#364: the daemon owns no transport).
-// SPEC §rpc.
+// the transport-free plugin-module seam ({§rpc}).
 import { readFile } from "node:fs/promises";
 import { resolve, dirname } from "node:path";
 import { execPollBackoffMs } from "./exec-poll-backoff.js";
@@ -10,37 +9,62 @@ import Engine from "../core/Engine.js";
 import ExecutorRegistry from "../core/ExecutorRegistry.js";
 import SchemeRegistry from "../core/SchemeRegistry.js";
 import { Mimetypes } from "@plurnk/plurnk-mimetypes";
+import { parsePath, Validator, } from "@plurnk/plurnk-contracts";
 import LogEntry from "./logEntry.js";
 import Envelope from "./envelope.js";
 import ClientInput from "./client-input.js";
-import ClientTurn from "./clientTurn.js";
+import JournalTurn from "../core/JournalTurn.js";
 import LoopDocs from "./loopDocs.js";
 import GitMembership from "../core/git-membership.js";
 import Fork from "../core/fork.js";
+import WorkerName from "../core/WorkerName.js";
 import LoopLifecycle from "../core/LoopLifecycle.js";
 import { promptLoopPrefix } from "../core/plurnk-uri.js";
 import { rulerCount } from "../core/token-ruler.js";
 import { parseAliasesFromEnv, resolveActiveAlias } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "../core/ProviderInstantiate.js";
 import { resolveLoopAlias } from "./loop-model.js";
-import Auto from "./auto.js";
-import NoProposals from "./noProposals.js";
 import { DEFAULT_LOOP_FLAGS } from "../core/scheme-types.js";
+import LoopFlagsReader from "../core/LoopFlagsReader.js";
+import Results, { OperationFailureError } from "../core/results.js";
+import WorkspaceGate from "../core/WorkspaceGate.js";
+import BranchBatches from "./BranchBatches.js";
+import ErrorDetail from "../core/ErrorDetail.js";
+import { observed, observedSync } from "../observe/spans.js";
+import { LOOP_TERMINALS, recordCounter } from "../observe/metrics.js";
+const clientActionFailure = (error) => {
+    if (error instanceof OperationFailureError)
+        return error.result;
+    console.error("Client action failed outside its operation result contract:", error);
+    return Results.failure("daemon:client", "action-threw", 500, "The client action failed outside its operation result contract.", {}, {
+        stage: "client-action",
+        retryable: false,
+    });
+};
+const daemonFailure = (owner, code, status, detail, extensions = {}) => new OperationFailureError(Results.failure(owner, code, status, detail, {}, extensions));
+const entryReadResult = (result) => Validator.assertEntryReadResult(result);
 export default class Daemon {
     #db;
     #engine;
+    #workspaceGate;
+    #branchBatches;
     #lifecycle;
     #schemes;
     #mimetypes;
+    #ownsMimetypes;
     #provider;
     #nodeModulesPath;
     #discoveryCwd;
-    #started = false; // start() runs once — boots discovery + plugin modules (#364: no listener, ever)
-    // The emit half of the broadcast, exposed as an in-process event source (#355). A transport
-    // module (plurnk-agui) subscribes and fans out to its OWN clients; core emits, never fans out
-    // for it. The WS fan-out below is legacy scaffolding that retires at the AG-UI+ cutover.
+    #started = false; // {§module-lifecycle}: one discovery/module boot; no listener
+    #capabilitiesPublished = false;
+    #modules = [];
+    #moduleClosers = [];
+    #moduleActions = new Map();
+    // {§methods-event-subscribe} — the broadcast's in-process event source. A transport
+    // module (plurnk-agui) subscribes and fans out to its OWN clients; core emits, never owns
+    // client transport or connection state.
     #eventSubscribers = new Set();
-    // Run-level drain registry. At most one drain per worker. The stored object
+    // Worker-level drain registry. At most one drain per worker. The stored object
     // is the drain's identity handle: start/exit compare it by reference so a
     // drain exiting never clobbers a successor that raced in, and a loop
     // enqueued during teardown is never stranded. A drain is a pure queue
@@ -48,23 +72,23 @@ export default class Daemon {
     // (subscriptions + Exec.idle), and a concluding stream routes through
     // inject() like any other loop source.
     #activeDrains = new Map();
-    // Per-run cancellation scope. Loops AND the streams they spawn (execs)
+    // Per-worker cancellation scope. Loops AND the streams they spawn (execs)
     // share this signal, so loop.cancel / shutdown abort it once and every
     // in-flight subscription tears down — even a spawn that registers AFTER the
     // cancel self-aborts against the already-aborted signal (no race). Outlives
     // any single (ephemeral) drain; replaced with a fresh controller once
-    // aborted so a later loop.run isn't born cancelled.
+    // aborted so a later runLoop request isn't born cancelled.
     #workerAborts = new Map();
     // grammar 0.74.20 EXEC `<T,P>` — per-worker hibernation poll-wake timer. When a loop parks at
-    // a park with a polled stream, a timer fires every P seconds to resume it (§exec-poll). One
+    // a park with a polled stream, a timer fires every P seconds to resume it ({§exec-poll}). One
     // per worker (the tightest cadence); cleared/replaced on each park and on cancel.
     #parkTimers = new Map();
     #pollTimers = new Map();
-    #pollBackoff = new Map(); // #521 — the exec-poll backoff step per worker (nth wake)
-    // Per-run drain-transition lock — see #withDrainLock (R4 / §worker-lifecycle-single-drain).
+    #pollBackoff = new Map(); // {§exec-poll} — backoff step per worker
+    // Per-worker drain-transition lock — see #withDrainLock (R4 / {§worker-lifecycle-single-drain}).
     #drainLocks = new Map();
-    // §worker-lifecycle-child-wake — runs OWED a wake: a child/stream conclusion fired while the worker was
-    // mid-turn (not yet slept), so #wakeParkedWorker could not resume it. A worker-run conclusion is a
+    // {§worker-lifecycle-child-wake} — workers owed a wake: a child/stream conclusion fired while the worker was
+    // mid-turn (not yet slept), so #wakeParkedWorker could not resume it. A child-worker conclusion is a
     // BOUNDED, lossless wake (a worker always concludes), so a hibernation awaiting one MUST return —
     // never deadlock. The drain honors the owed wake at the worker's next park, closing the conclude-
     // before-park race. (Only a live exec stream, unbounded absent a timeout, may hold a park open.)
@@ -81,7 +105,10 @@ export default class Daemon {
         this.#nodeModulesPath = nodeModulesPath ?? resolve(process.cwd(), "node_modules");
         this.#discoveryCwd = dirname(this.#nodeModulesPath);
         // Mimetypes owns discovery + detection; default mimetype text/markdown. (Token counting
-        // is NOT wired here — the engine's ruler below is §tokenomics-agnostic-ruler.)
+        // is NOT wired here — the engine's ruler below is {§tokenomics-agnostic-ruler}.)
+        // Constructor ownership is the lifecycle boundary
+        // ({§mimetype-owned-lifecycle}).
+        this.#ownsMimetypes = mimetypes === undefined;
         this.#mimetypes = mimetypes ?? new Mimetypes({
             defaultMimetype: "text/markdown",
             discoverOptions: { cwd: this.#discoveryCwd },
@@ -90,9 +117,60 @@ export default class Daemon {
         if (this.#provider !== null && bootSpec !== null) {
             ProviderInstantiate.registerInstance(this.#provider, bootSpec);
         }
+        this.#workspaceGate = new WorkspaceGate(async (workerId, rootWorkerId) => {
+            const row = await this.#db.branch_batch_worker_lineage.get({
+                worker_id: workerId,
+                root_worker_id: rootWorkerId,
+            });
+            return row !== undefined;
+        });
+        this.#branchBatches = new BranchBatches(db, this.#workspaceGate, {
+            settleWorkspace: async (workspaceId) => this.#engine.drainWorkspaceDerivations(workspaceId),
+            createChild: async ({ workspaceId, parentWorkerId, op, name, prompt, flags, origin }) => {
+                const providerSpec = resolveActiveAlias();
+                if (providerSpec === null)
+                    throw new Error("Branch worker: active provider has no resolvable alias");
+                const workerName = WorkerName.assert(name);
+                const workerId = op === "FORK"
+                    ? await Fork.fork(this.#db, parentWorkerId, workerName)
+                    : (await this.#db.fork_insert_worker.get({
+                        workspace_id: workspaceId,
+                        name: workerName,
+                        parent_worker_id: parentWorkerId,
+                        origin,
+                    }))?.id;
+                if (workerId === undefined)
+                    throw new Error("Branch worker insert returned no row");
+                const loopId = await this.#enqueueFreshLoop({
+                    workerId,
+                    prompt,
+                    providerSpec,
+                    flags,
+                });
+                return { workerId, loopId };
+            },
+            startChild: async (workspaceId, workerId, loopId) => {
+                const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
+                const started = await this.#ensureDrain({ workspaceId, workerId, systemPrompt });
+                if (started === null)
+                    throw new Error(`Branch worker ${workerId} already has a live drain`);
+                const result = await started.firstLoopPromise;
+                if (result.loopId !== loopId) {
+                    throw new Error(`Branch worker ${workerId} drained loop ${result.loopId}, expected ${loopId}`);
+                }
+                return result.result;
+            },
+            wakeParent: async (workspaceId, workerId) => {
+                const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
+                await this.#wakeParkedWorker(workspaceId, workerId, systemPrompt, false);
+            },
+            notify: (workspaceId, payload) => {
+                this.#broadcast({ workspaceId }, "workspace/branch-batch", payload);
+            },
+        });
         this.#engine = new Engine({
             db, schemes: this.#schemes, mimetypes: this.#mimetypes,
-            // §tokenomics-agnostic-ruler — the ONE model-facing token ruler (chars/2), NOT the
+            // {§tokenomics-agnostic-ruler} — the ONE model-facing token ruler (chars/2), NOT the
             // boot provider: token accounting is workspace-wide across many concurrent models, so
             // the write-time + catalog counts must be model-independent. Exact per-model counting
             // lives only at the packet-materialization fit-gate.
@@ -103,7 +181,7 @@ export default class Daemon {
             // Daemon.inject (active sister → fold; idle → enqueue + drain). The
             // daemon owns provider + the law-file system prompt; the worker scheme
             // handler carries neither. Fire-and-forget: the returned drain runs
-            // independently (the sister is its own worker). §machine-processes
+            // independently (the sister is its own worker). {§machine-processes}
             injectWorker: async ({ workspaceId, workerId, prompt, flags }) => {
                 if (this.#provider === null)
                     throw new Error("injectWorker: no provider configured");
@@ -114,39 +192,24 @@ export default class Daemon {
                 const { action, loopId } = await this.inject({ workspaceId, workerId, prompt, providerSpec, systemPrompt, ...(flags === undefined ? {} : { flags }) });
                 return { action, loopId };
             },
+            branchWorker: async (args) => this.#branchBatches.enqueue(args),
+            branchCompletionGate: async (workerId) => this.#branchBatches.completionGate(workerId),
+            acquireWorkspaceTurn: async (workspaceId, workerId) => this.#workspaceGate.acquireTurn(workspaceId, workerId),
+            workspaceTurnCompleted: async ({ turnId }) => this.#branchBatches.sealTurn(turnId),
             // worker:// KILL (terminate) — cancel the addressed worker subtree and
             // tear down its held streams before the operation completes.
             cancelWorker: async (workerId, reason) => this.#cancelWorkerTree(workerId, reason),
             cancelDescendants: async (workerId, reason) => this.#cancelTree(workerId, reason, false),
-            telemetryEventNotify: (workspaceId, payload) => this.notifyTelemetryEvent(workspaceId, payload),
+            noticeNotify: (workspaceId, payload) => this.notifyNotice(workspaceId, payload),
         });
         // Wire proposal-pending events to the loop/proposal WS notification.
         // Sessionid scopes the broadcast to clients on the same workspace.
         this.#engine.onProposalPending((event) => {
-            this.#broadcast({ workspaceId: event.workspaceId }, "loop/proposal", {
-                logEntryId: event.logEntryId,
-                workerId: event.workerId,
-                loopId: event.loopId,
-                turnId: event.turnId,
-                op: event.op,
-                target: event.target,
-                body: event.body,
-                attrs: event.attrs,
-                // event.flags is carried for discoverability — a client in
-                // loop-auto mode (event.flags.auto=true) knows to skip
-                // rendering review UI because the entry will resolve in-
-                // process before any human can react.
-                flags: event.flags,
-            });
+            const { workspaceId, ...proposal } = event;
+            this.#broadcast({ workspaceId }, "loop/proposal", proposal);
         });
-        // In-tree auto listener resolves proposals when persisted flags.auto is true.
-        Auto.attach(this.#engine, this.#db);
-        // Inverse policy: auto-REJECT proposals in-process when the loop's
-        // persisted flags.noProposals === true (client has no review channel).
-        // The model sees an ordinary 400, never the orchestration reason.
-        NoProposals.attachNoProposals(this.#engine, this.#db);
     }
-    // The client-interface seam (#355). A transport module subscribes to the daemon's in-process
+    // {§methods-event-subscribe}. A transport module subscribes to the daemon's in-process
     // event source: it receives every workspace-scoped engine event as `(workspaceId, method, params)`
     // and fans out to its OWN clients — core emits, it never fans out for the module. Returns an
     // unsubscribe. `workspaceId` is the event's workspace, or null for a global event (e.g. workspace/created).
@@ -155,55 +218,90 @@ export default class Daemon {
         this.#eventSubscribers.add(handler);
         return () => { this.#eventSubscribers.delete(handler); };
     }
-    // The client-interface seam (#355) — proposal HITL. A transport module reads the stopped-world
+    // {§methods-proposal-resolve} — proposal HITL. A transport module reads the stopped-world
     // proposals for a workspace (rendering each as a TOOL_CALL) and feeds back the human's decision. The
     // gate, validation, and applyResolution stay core (Engine.resolveProposal); the seam is the read +
     // the resolve, never the mechanism. `resolveProposal` throws for an unknown/already-resolved id.
     async pendingProposals(workspaceId) {
-        return this.#db.proposal_list_pending.all({ workspace_id: workspaceId });
+        const checkedWorkspaceId = ClientInput.assertId("pendingProposals", "workspaceId", workspaceId);
+        return this.#engine.pendingProposals(checkedWorkspaceId);
     }
     resolveProposal(logEntryId, resolution) {
-        this.#engine.resolveProposal(logEntryId, resolution);
+        const checkedLogEntryId = ClientInput.assertId("resolveProposal", "logEntryId", logEntryId);
+        const checkedResolution = ClientInput.assertProposalResolution("resolveProposal", resolution);
+        this.#engine.resolveProposal(checkedLogEntryId, checkedResolution);
     }
-    // The client-interface seam (#355) — drive/steer a loop. The module supplies only workspace/run/prompt;
+    // {§methods-loop-run} — drive/steer a loop. The module supplies only workspace/worker/prompt;
     // the provider and the law-file system prompt are core's and stay inside. Returns immediately — the
     // loop runs async and its outcome arrives on the event source (loop/terminated). `cancelDrain` (public)
     // is the cancel hook. Both funnel through the unified `inject`, which owns the drain lifecycle.
     async runLoop(args) {
-        const flags = ClientInput.normalizeLoopFlags("loop.run", args.flags);
-        // #414 — per-loop model selection: a client sends its alias/model on every loop, so a
-        // switch takes effect turn-to-turn. `model` (client-resolved <provider>/<model>, #90) wins
+        const workspaceId = ClientInput.assertId("runLoop", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("runLoop", "workerId", args.workerId);
+        const prompt = ClientInput.assertPrompt("runLoop", args.prompt);
+        const requestedMaxTurns = ClientInput.assertMaxTurns("runLoop", args.maxTurns);
+        const openPaths = ClientInput.assertOpenPaths("runLoop", args.openPaths);
+        const alias = ClientInput.assertOptionalSelector("runLoop", "alias", args.alias);
+        const model = ClientInput.assertOptionalSelector("runLoop", "model", args.model);
+        const flags = ClientInput.normalizeLoopFlags("runLoop", args.flags);
+        // {§methods-loop-run-model} — a client sends alias/model on every loop, so a
+        // switch takes effect turn-to-turn. `model` (client-resolved <provider>/<model>) wins
         // over `alias`; neither → the boot default. Instantiation is cached, so ping-ponging
         // between two models is cheap, and an unresolvable alias/model fails loud here.
-        const selection = await this.#resolveLoopProvider(args.alias, args.model);
-        if (selection === null)
-            throw new Error("runLoop: no provider configured");
+        const selection = await this.#resolveLoopProvider(alias, model);
+        if (selection === null) {
+            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this loop.", {}, {
+                stage: "provider-selection",
+                recovery: "Select a configured model provider.",
+                retryable: false,
+            }));
+        }
         const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-        // §machine-processes — the model NEVER runs in a client-origin run (its packets would carry
-        // client op.* rows). The module resolves the model worker via ensureModelWorker and passes it (or a
+        // {§machine-processes} — the model NEVER runs in a client-origin worker (its packets would carry
+        // client-action rows). The module resolves the model worker via ensureModelWorker and passes it (or a
         // fork); a client worker here is a caller error, refused loudly rather than silently rehomed.
-        const target = await this.#db.envelope_get_worker_by_id.get({ id: args.workerId });
-        if (target === undefined)
-            throw new Error(`runLoop: run ${args.workerId} not found`);
-        if (target.origin === "client")
-            throw new Error(`runLoop: run ${args.workerId} is a client worker — loops run in model workers (§machine-processes); resolve one with ensureModelWorker(workspaceId)`);
-        // §operator-config-max-turns-ceiling — the operator ceiling clamps a per-call maxTurns; a
+        const target = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
+        if (target === undefined) {
+            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
+        }
+        if (target.workspace_id !== workspaceId) {
+            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, {
+                workerId,
+                workspaceId,
+                actualWorkspaceId: target.workspace_id,
+                retryable: false,
+            });
+        }
+        if (target.origin === "client") {
+            throw daemonFailure("daemon:worker", "model-worker-required", 409, `Worker ${workerId} is not a model worker.`, {
+                workerId,
+                recovery: "Select or create a model worker for this loop.",
+                retryable: false,
+            });
+        }
+        // {§operator-config-max-turns-ceiling} — the operator ceiling clamps a per-call maxTurns; a
         // seam caller must not bypass operator policy (inject only DEFAULTS from env, never clamps).
         const ceiling = Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "-1");
-        const requested = args.maxTurns ?? ceiling;
+        const requested = requestedMaxTurns ?? ceiling;
         const maxTurns = ceiling < 0 ? requested : (requested < 0 ? ceiling : Math.min(requested, ceiling));
-        const { flags: _inputFlags, ...rest } = args;
+        const turnCeiling = {
+            effective: maxTurns,
+            source: requestedMaxTurns === undefined ? "implicit" : "explicit",
+        };
         const { action, loopId, turnSeq } = await this.inject({
-            ...rest,
+            workspaceId,
+            workerId,
+            prompt,
             ...(flags !== undefined ? { flags } : {}),
-            maxTurns,
+            ...(openPaths !== undefined ? { openPaths } : {}),
+            turnCeiling,
             providerSpec: selection,
             systemPrompt,
         });
-        return { action, loopId, ...(turnSeq !== undefined ? { turnSeq } : {}) };
+        return { status: 100, action, loopId, ...(turnSeq !== undefined ? { turnSeq } : {}) };
     }
-    // #414 — resolve a per-loop model override to a Provider (cached instances). `model`
-    // (<provider>/<model>, client-resolved #90) wins over a named `alias`; absent both, the
+    // {§methods-loop-run-model} — resolve a per-loop model override to a cached Provider. `model`
+    // (<provider>/<model>, client-resolved) wins over a named `alias`; absent both, the
     // boot default. A named alias missing from the env cascade, or a malformed model spec, throws
     // legibly rather than silently running the wrong model.
     async #resolveLoopProvider(alias, model) {
@@ -211,12 +309,27 @@ export default class Daemon {
         if (requested === null && this.#provider === null)
             return null;
         const spec = requested ?? resolveActiveAlias();
-        if (spec === null)
-            throw new Error("runLoop: boot provider has no resolvable alias");
-        // Resolve eagerly so loop.run fails before enqueue when the provider
+        if (spec === null) {
+            throw daemonFailure("daemon:provider", "active-alias-unresolved", 500, "The active provider has no resolvable alias.", { stage: "provider-selection", retryable: false });
+        }
+        // Resolve eagerly so runLoop fails before enqueue when the provider
         // cannot be constructed. The drain later retrieves this cached handle
         // from the loop's durable spec at the claim boundary.
-        await ProviderInstantiate.instantiateProvider(spec);
+        try {
+            await ProviderInstantiate.instantiateProvider(spec);
+        }
+        catch (cause) {
+            if (cause instanceof OperationFailureError)
+                throw cause;
+            console.error(`Provider alias '${spec.alias}' could not be instantiated:`, cause);
+            throw daemonFailure("daemon:provider", "provider-unavailable", 503, `Provider alias '${spec.alias}' is unavailable.`, {
+                alias: spec.alias,
+                provider: spec.provider,
+                model: spec.model,
+                stage: "provider-selection",
+                retryable: false,
+            });
+        }
         return spec;
     }
     async #providerSpecForLoop(loopId) {
@@ -245,9 +358,16 @@ export default class Daemon {
     async #assertLoopProvider(loopId, requested) {
         const selected = await this.#providerSpecForLoop(loopId);
         if (JSON.stringify(selected) !== JSON.stringify(requested)) {
-            throw new Error(`loop ${loopId}: provider selection is frozen at '${selected.alias}' (${selected.provider}/${selected.model}); `
-                + `requested '${requested.alias}' (${requested.provider}/${requested.model}). `
-                + "Cancel or conclude the loop before hot-swapping models.");
+            throw daemonFailure("daemon:provider", "loop-provider-conflict", 409, `Loop ${loopId} uses provider alias '${selected.alias}', not '${requested.alias}'.`, {
+                loopId,
+                selectedAlias: selected.alias,
+                selectedModel: `${selected.provider}/${selected.model}`,
+                requestedAlias: requested.alias,
+                requestedModel: `${requested.provider}/${requested.model}`,
+                stage: "loop-injection",
+                recovery: "Cancel or conclude the loop before selecting another provider.",
+                retryable: false,
+            });
         }
     }
     async #assertLoopMaxTurns(loopId, requested) {
@@ -257,29 +377,38 @@ export default class Daemon {
         if (durable === undefined)
             throw new Error(`inject: loop ${loopId} has no durable turn ceiling`);
         if (durable.max_turns !== requested) {
-            throw new Error(`inject: the prompt would fold into loop ${loopId} with maxTurns ${durable.max_turns}, not requested ${requested} — maxTurns is loop-scoped and immutable; cancel or conclude the loop before opening one with a different ceiling`);
+            throw daemonFailure("daemon:loop", "turn-ceiling-conflict", 409, `Loop ${loopId} has turn ceiling ${durable.max_turns}, not ${requested}.`, {
+                loopId,
+                selectedMaximumTurns: durable.max_turns,
+                requestedMaximumTurns: requested,
+                stage: "loop-injection",
+                recovery: "Cancel or conclude the loop before selecting another turn ceiling.",
+                retryable: false,
+            });
         }
     }
-    // §machine-processes — the workspace's model worker (created on first use), distinct from the client
-    // run so the model's packets never carry client op.* rows. The module binds its threads to this.
+    // {§methods-model-worker} — the workspace's model worker (created on first use), distinct from the client
+    // worker so the model's packets never carry client-action rows. The module binds its threads to this.
     ensureModelWorker(workspaceId) {
-        return Envelope.ensureModelWorker(this.#db, workspaceId);
+        return Envelope.ensureModelWorker(this.#db, ClientInput.assertId("worker.ensure-model", "workspaceId", workspaceId));
     }
-    // The op-dispatch hook (#355) — execute one parsed op on behalf of a client: journaled as a
+    // {§methods-op-mirror} — execute parsed ops on behalf of a client, journaled as a
     // client-origin turn (the log is core's, a client op is a first-class citizen), dispatched through
     // the engine, then emitted as log/entry on the event source. One seam op backs the whole op_*
     // family (read/edit/copy/find/fold/look/move/open/send/exec); the module parses at its edge with the
     // grammar package and hands over the statement, then fans the emitted entry out to its own clients.
     async dispatchAsClient(args) {
-        const { workspaceId, workerId, statement } = args;
+        const workspaceId = ClientInput.assertId("operation.dispatch", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("operation.dispatch", "workerId", args.workerId);
+        const { statement } = args;
         const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
         try {
             const result = await this.#dispatchClientStatement({ workspaceId, workerId, loopId: clientLoopId, statement });
-            await Envelope.closeClientLoop(this.#db, clientLoopId, 200);
+            await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
             return result;
         }
         catch (error) {
-            await Envelope.closeClientLoop(this.#db, clientLoopId, 499);
+            await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
             throw error;
         }
     }
@@ -288,7 +417,9 @@ export default class Daemon {
     // keep this promise (and segment) open across interrupt/resume; settlement closes
     // it. The journal is durable evidence for the action, not a second client lifecycle.
     async dispatchClientAction(args) {
-        const { workspaceId, workerId, statements } = args;
+        const workspaceId = ClientInput.assertId("operation.dispatch-batch", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("operation.dispatch-batch", "workerId", args.workerId);
+        const { statements } = args;
         if (statements.length === 0)
             return [];
         const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
@@ -297,58 +428,107 @@ export default class Daemon {
             for (const statement of statements) {
                 results.push(await this.#dispatchClientStatement({ workspaceId, workerId, loopId: clientLoopId, statement }));
             }
-            await Envelope.closeClientLoop(this.#db, clientLoopId, 200);
+            await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
             return results;
         }
         catch (error) {
-            await Envelope.closeClientLoop(this.#db, clientLoopId, 499);
+            await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
             throw error;
         }
     }
     async #dispatchClientStatement(args) {
         const { workspaceId, workerId, loopId, statement } = args;
-        const turnId = await ClientTurn.insertClientTurn(this.#db, loopId);
-        const entryIds = [];
-        const result = await this.#engine.dispatch({
-            statement, workspaceId, workerId, loopId, turnId, sequence: 1,
-            origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); },
-        });
-        for (const logEntryId of entryIds) {
-            const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
-            this.#broadcast({ workspaceId }, "log/entry", { entry });
+        const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
+        try {
+            const { id: turnId } = await JournalTurn.insert(this.#db, loopId);
+            const entryIds = [];
+            const result = await this.#engine.dispatch({
+                statement, workspaceId, workerId, loopId, turnId, sequence: 1,
+                origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); },
+            });
+            await this.#branchBatches.sealTurn(turnId);
+            for (const logEntryId of entryIds) {
+                const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
+                this.#broadcast({ workspaceId }, "log/entry", { entry });
+            }
+            return result;
+        }
+        finally {
+            release();
         }
-        return result;
     }
-    // op.look (#283/#358) — the pure READ-projection query on the seam: resolve a READ through the
-    // full scheme resolver and return its content, writing NO log row — the client's off-run
+    // {§op-look} — the pure READ-projection query on the seam: resolve a READ through the
+    // full scheme resolver and return its content, writing NO log row — the client's out-of-band
     // inspection primitive (the module rewrites LOOK→READ and parses at its edge, exactly like
     // dispatchClientAction). Its closed observation segment supplies the numeric loop coordinate
     // required by plugin context and relative log:/// addresses without impersonating an active
     // client lifecycle. It creates no turn or log row. Engine.look enforces READ-only.
     async look(args) {
-        const { workspaceId, workerId, statement } = args;
+        const workspaceId = ClientInput.assertId("operation.look", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("operation.look", "workerId", args.workerId);
+        const { statement } = args;
+        const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
         const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
         try {
             const result = await this.#engine.look({ statement, workspaceId, workerId, loopId: clientLoopId });
-            await Envelope.closeClientLoop(this.#db, clientLoopId, 200);
+            await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
             return result;
         }
         catch (error) {
-            await Envelope.closeClientLoop(this.#db, clientLoopId, 499);
+            await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
             throw error;
         }
+        finally {
+            release();
+        }
     }
-    // The log-read hook (#355) — a workspace's journal, the module's primary render input. The worker is
-    // ownership-verified against the workspace (a workspace reads only its own runs — the model worker included,
-    // #214); entries filter by loop/turn/since-id or the full L/T/S display coordinate. Core owns the
+    // {§methods-log-read} — a workspace's journal, the module's primary render input. The worker is
+    // ownership-verified against the workspace (a workspace reads only its own workers — the model worker included,
+    // {§methods-log-coordinate}); entries filter by loop/turn/since-id or the full L/T/S display coordinate. Core owns the
     // journal + the invariant; the module shapes the entries into AG-UI messages at its edge.
     async readLog(args) {
-        const { workspaceId, workerId } = args;
+        const workspaceId = ClientInput.assertId("log.read", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("log.read", "workerId", args.workerId);
         const target = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
-        if (target === undefined)
-            throw new Error(`run ${workerId} not found`);
-        if (target.workspace_id !== workspaceId)
-            throw new Error(`run ${workerId} is not in this workspace (${workspaceId})`);
+        if (target === undefined) {
+            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
+        }
+        if (target.workspace_id !== workspaceId) {
+            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, {
+                workerId,
+                workspaceId,
+                actualWorkspaceId: target.workspace_id,
+                retryable: false,
+            });
+        }
+        const coordinateFields = {
+            loopId: args.loopId,
+            turnId: args.turnId,
+            sinceId: args.sinceId,
+            loopSeq: args.loopSeq,
+            turnSeq: args.turnSeq,
+            sequence: args.sequence,
+        };
+        for (const [field, value] of Object.entries(coordinateFields)) {
+            if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+                throw daemonFailure("daemon:log", "coordinate-invalid", 400, `Log coordinate field '${field}' is not a non-negative safe integer.`, {
+                    field,
+                    value,
+                    stage: "log-read",
+                    recovery: "Use a non-negative integer coordinate.",
+                    retryable: false,
+                });
+            }
+        }
+        if (args.limit !== undefined && (!Number.isSafeInteger(args.limit) || args.limit < 1)) {
+            throw daemonFailure("daemon:log", "limit-invalid", 400, `Log limit ${args.limit} is not a positive safe integer.`, {
+                field: "limit",
+                value: args.limit,
+                stage: "log-read",
+                recovery: "Use a positive integer log limit.",
+                retryable: false,
+            });
+        }
         const rows = await this.#db.log_read_recent_ids.all({
             worker_id: workerId,
             loop_id: args.loopId ?? null, turn_id: args.turnId ?? null, since_id: args.sinceId ?? null,
@@ -360,7 +540,7 @@ export default class Daemon {
             entries.push(await LogEntry.fetchLogEntry(this.#db, r.id));
         return entries;
     }
-    // The metadata-read hooks (#355) — the module's render surface beyond the journal. Thin delegations
+    // {§methods} — the module's render surface beyond the journal. Thin delegations
     // into core's envelope / membership / provider machinery; the module fans the results into its own views.
     listProviders() {
         const active = resolveActiveAlias();
@@ -369,186 +549,368 @@ export default class Daemon {
                 const isActive = active !== null && active.alias === a.alias;
                 return {
                     alias: a.alias, provider: a.provider, model: a.model, active: isActive,
-                    // promptBudget = the EFFECTIVE prompt budget (window minus reserves, #345; named honestly #481) — the same
-                    // denominator loop-usage reports; known for the active alias, null elsewhere.
+                    // The same effective model-facing budget loop usage reports, including
+                    // optional virtual pressure; known for the active alias, null elsewhere.
                     promptBudget: isActive && this.#provider !== null ? this.#engine.promptBudgetFor(this.#provider) : null,
                 };
             }),
         };
     }
+    // {§client-display-capabilities} Core composes the installed family
+    // declarations; interface modules expose this contracts-owned wire without
+    // inventing presentation policy. `exec` is operation machinery, not an
+    // addressable URI scheme; its runtime-tag scheme faces remain discoverable.
+    async listClientDisplayCapabilities() {
+        const schemes = this.#schemes.list()
+            .filter((scheme) => scheme !== "exec")
+            .map((scheme) => {
+            const glyph = this.#schemes.manifestFor(scheme)?.glyph;
+            return {
+                kind: "scheme",
+                scheme,
+                display: glyph === undefined ? {} : { glyph },
+            };
+        });
+        const mimetypes = (await this.#mimetypes.displayMetadata())
+            .map(({ mimetype, glyph }) => ({
+            kind: "mimetype",
+            mimetype,
+            display: glyph.length === 0 ? {} : { glyph },
+        }));
+        return Validator.assertClientDisplayCapabilities([...schemes, ...mimetypes]);
+    }
     listWorkspaces() { return Envelope.listWorkspaces(this.#db); }
-    listWorkers(workspaceId) { return Envelope.listWorkersForWorkspace(this.#db, workspaceId); }
-    listPrompts(workspaceId, limit = 100) { return Envelope.listPromptsForWorkspace(this.#db, workspaceId, limit); }
-    listMembers(workspaceId) { return GitMembership.resolveMembershipEffects(this.#db, workspaceId, undefined); }
+    listWorkers(workspaceId) {
+        return Envelope.listWorkersForWorkspace(this.#db, ClientInput.assertId("workspace.workers", "workspaceId", workspaceId));
+    }
+    // {§methods-workspace-prompts}: root-conversation loop seeds, newest-first.
+    listPrompts(workspaceId, limit) {
+        const checkedWorkspaceId = ClientInput.assertId("workspace.prompts", "workspaceId", workspaceId);
+        const checkedLimit = ClientInput.assertLimit("workspace.prompts", limit);
+        return Envelope.listPromptsForWorkspace(this.#db, checkedWorkspaceId, checkedLimit ?? 100);
+    }
+    async listMembers(workspaceId) {
+        const checkedWorkspaceId = ClientInput.assertId("workspace.members", "workspaceId", workspaceId);
+        const release = await this.#workspaceGate.acquireTurn(checkedWorkspaceId, 0);
+        try {
+            return await GitMembership.resolveMembershipEffects(this.#db, checkedWorkspaceId, undefined);
+        }
+        finally {
+            release();
+        }
+    }
     listConstraints(workspaceId) {
-        return this.#db.crud_list_workspace_constraints.all({ workspace_id: workspaceId });
+        const checkedWorkspaceId = ClientInput.assertId("workspace.constraints", "workspaceId", workspaceId);
+        return this.#db.crud_list_workspace_constraints.all({ workspace_id: checkedWorkspaceId });
     }
     workspaceDerivationStatus(workspaceId) {
-        return this.#engine.workspaceDerivationStatus(workspaceId);
+        return this.#engine.workspaceDerivationStatus(ClientInput.assertId("workspace.derivation", "workspaceId", workspaceId));
     }
-    // Workspace lifecycle (#355): the module's workspace-management surface. Inputs arrive already validated
-    // at the module's edge ("I am the wall" — settings as the stored JSON string, constraints as a typed
-    // array, roots absolute); core owns the envelope, its reserved-name + name-uniqueness invariants,
+    // {§methods-workspace-create}: the module owns protocol decoding; core validates the typed seam
+    // inputs and owns the envelope, its reserved-name + name-uniqueness invariants,
     // membership resolution, warmWorkspaceDerivations, and the workspace/created emit. No connection state
     // (which client is on which workspace) lives here — that's the module's.
     async createWorkspace(args) {
-        // The SEAM fail-hards on malformed client input (#364 — validation flushed out of the
-        // retired WS handlers so every module inherits it): settings bag (#231/#232/#249/#328),
-        // constraints (#200), absolute projectRoot.
+        // The seam fails hard on malformed semantic input so every module inherits one wall:
+        // the settings bag
+        // ({§operator-config-workspace-settings}),
+        // constraints, and absolute projectRoot.
+        const name = ClientInput.assertOptionalName("workspace.create", "name", args.name);
         const projectRoot = ClientInput.assertProjectRoot("workspace.create", args.projectRoot);
         const settings = ClientInput.parseSettings(args.settings);
         const constraints = ClientInput.parseConstraints(args.constraints);
-        const envelope = await Envelope.createClientEnvelope(this.#db, { name: args.name, projectRoot, settings });
-        for (const { effect, glob } of constraints) {
-            await this.#db.crud_insert_workspace_constraint.run({ workspace_id: envelope.workspaceId, effect, glob });
-        }
-        if (constraints.length > 0)
-            await GitMembership.resolveGitMembership(this.#db, envelope.workspaceId, undefined);
-        await LoopDocs.materialize(this.#engine, this.#db, envelope.workspaceId);
-        void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
-        this.#broadcast("all", "workspace/created", { id: envelope.workspaceId, name: envelope.workspaceName, projectRoot: envelope.projectRoot });
-        return envelope;
+        return observed(// {§observability-boundary}
+        "workspace.create", {}, async (span) => {
+            const envelope = await Envelope.createClientEnvelope(this.#db, { name, projectRoot, settings });
+            span.setAttribute("workspace.id", envelope.workspaceId);
+            for (const { effect, glob } of constraints) {
+                await this.#db.crud_insert_workspace_constraint.run({ workspace_id: envelope.workspaceId, effect, glob });
+            }
+            if (constraints.length > 0)
+                await GitMembership.resolveGitMembership(this.#db, envelope.workspaceId, undefined);
+            await LoopDocs.materialize(this.#engine, this.#db, envelope.workspaceId);
+            void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
+            this.#broadcast("all", "workspace/created", { id: envelope.workspaceId, name: envelope.workspaceName, projectRoot: envelope.projectRoot });
+            return envelope;
+        });
     }
     async attachWorkspace(args) {
-        // attachToWorkspace owns the reserved-name + run-ownership invariants; the seam just delegates + warms.
-        const envelope = await Envelope.attachToWorkspace(this.#db, args.workspaceId, { workerId: args.workerId, workerName: args.workerName });
+        // attachToWorkspace owns the reserved-name + worker-ownership invariants; the seam just delegates + warms.
+        const workspaceId = ClientInput.assertId("workspace.attach", "workspaceId", args.workspaceId);
+        const workerId = args.workerId === undefined
+            ? undefined
+            : ClientInput.assertId("workspace.attach", "workerId", args.workerId);
+        const workerName = ClientInput.assertOptionalWorkerName("workspace.attach", "workerName", args.workerName);
+        const envelope = await Envelope.attachToWorkspace(this.#db, workspaceId, { workerId, workerName });
         void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
         return envelope;
     }
     async renameWorkspace(workspaceId, name) {
-        if (typeof name !== "string" || name.length === 0)
-            throw new Error("workspace.rename: name must be a non-empty string"); // seam fail-hard (#364)
-        const taken = await this.#db.envelope_get_workspace_by_name.get({ name });
-        if (taken !== undefined && taken.id !== workspaceId)
-            throw new Error(`a workspace named "${name}" already exists — pick another`);
-        return { id: workspaceId, name: await Envelope.updateWorkspaceName(this.#db, workspaceId, name) };
+        const checkedWorkspaceId = ClientInput.assertId("workspace.rename", "workspaceId", workspaceId);
+        const checkedName = ClientInput.assertOptionalName("workspace.rename", "name", name);
+        if (checkedName === undefined)
+            throw new Error("ClientInput.assertOptionalName accepted a required name as undefined");
+        return { id: checkedWorkspaceId, name: await Envelope.updateWorkspaceName(this.#db, checkedWorkspaceId, checkedName) };
     }
     async constrain(workspaceId, effect, glob) {
-        ClientInput.assertConstraint("workspace.constrain", effect, glob);
-        // Headless is FOREVER (owner ruling, 2026-07-11, matching the client SPEC): a workspace is
-        // born with its workspace pointer or never has one — so a 'repo' constraint on a headless
-        // workspace can never resolve. Refuse legibly instead of recording a forever-pending lie.
-        if (effect === "repo") {
-            const s = await this.#db.envelope_get_workspace.get({ id: workspaceId });
-            if (s?.project_root == null)
-                throw new Error("workspace.constrain: this workspace is headless — and headless is forever (a workspace pointer is set at workspace.create or never). A 'repo' overlay needs a workspace created with projectRoot.");
-        }
-        await this.#db.crud_insert_workspace_constraint.run({ workspace_id: workspaceId, effect, glob });
-        await GitMembership.resolveGitMembership(this.#db, workspaceId, undefined);
-        // Members may have just landed — begin warming now, but return the constraint response
-        // immediately. Awaiting the whole corpus here kept `/repo **` at the head of the client's
-        // command queue, so prompts appeared accepted while no turn could start until 100%.
-        void this.#engine.warmWorkspaceDerivations(workspaceId).catch(() => { });
-        return { effect, glob };
+        const checkedWorkspaceId = ClientInput.assertId("workspace.constrain", "workspaceId", workspaceId);
+        const release = await this.#workspaceGate.acquireTurn(checkedWorkspaceId, 0);
+        try {
+            ClientInput.assertConstraint("workspace.constrain", effect, glob);
+            await this.#db.crud_insert_workspace_constraint.run({ workspace_id: checkedWorkspaceId, effect, glob });
+            await GitMembership.resolveGitMembership(this.#db, checkedWorkspaceId, undefined);
+            // Members may have just landed — begin warming now, but return the constraint response
+            // immediately so prompts do not wait for the complete derivation corpus.
+            void this.#engine.warmWorkspaceDerivations(checkedWorkspaceId).catch(() => { });
+            return { effect, glob };
+        }
+        finally {
+            release();
+        }
     }
     async unconstrain(workspaceId, effect, glob) {
-        ClientInput.assertConstraint("workspace.unconstrain", effect, glob);
-        await this.#db.crud_delete_workspace_constraint.run({ workspace_id: workspaceId, effect, glob });
-        await GitMembership.resolveGitMembership(this.#db, workspaceId, undefined);
-        void this.#engine.warmWorkspaceDerivations(workspaceId).catch(() => { });
-        return { effect, glob };
+        const checkedWorkspaceId = ClientInput.assertId("workspace.unconstrain", "workspaceId", workspaceId);
+        const release = await this.#workspaceGate.acquireTurn(checkedWorkspaceId, 0);
+        try {
+            ClientInput.assertConstraint("workspace.unconstrain", effect, glob);
+            await this.#db.crud_delete_workspace_constraint.run({ workspace_id: checkedWorkspaceId, effect, glob });
+            await GitMembership.resolveGitMembership(this.#db, checkedWorkspaceId, undefined);
+            void this.#engine.warmWorkspaceDerivations(checkedWorkspaceId).catch(() => { });
+            return { effect, glob };
+        }
+        finally {
+            release();
+        }
     }
-    // The entry-shape hook (#355) — one entry's channels + tags + metadata at a path. With channel+offset,
-    // returns just that channel's content sliced from the offset: the incremental streaming read (#192,
-    // the delta leaves storage, not the whole channel). The module renders growing output by re-polling.
+    // Contracts {§entry-read-result}: resolve through the scheme's address law,
+    // then project one owner-scoped entry without exposing persistence columns.
     async readEntry(args) {
-        const m = args.target.match(/^([a-z][a-z0-9+.-]*):\/\/(.*)$/);
-        if (m === null)
-            throw new Error(`readEntry: target must be URL-shaped (scheme://pathname); got: ${args.target}`);
-        if (args.offset !== undefined && args.channel === undefined)
-            throw new Error("readEntry: offset requires channel (which channel to slice)");
-        const scheme = m[1];
-        const pathname = m[2].split("#")[0];
-        const row = await this.#db.entry_read_lookup.get({ workspace_id: args.workspaceId, scheme, pathname });
-        if (row === undefined)
-            return { status: 404, entry: null };
-        let channelRows;
-        if (args.channel === undefined) {
-            channelRows = await this.#db.entry_read_channels.all({ entry_id: row.id });
+        const workspaceId = ClientInput.assertId("entry.read", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("entry.read", "workerId", args.workerId);
+        if (typeof args.target !== "string" || args.target.length === 0) {
+            throw daemonFailure("daemon:input", "target-invalid", 400, "target is not a non-empty string.", {
+                context: "entry.read",
+                field: "target",
+                stage: "input-validation",
+                recovery: "Provide an entry URI.",
+                retryable: false,
+            });
+        }
+        const channel = ClientInput.assertOptionalChannel("entry.read", args.channel);
+        const worker = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
+        if (worker === undefined) {
+            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
+        }
+        if (worker.workspace_id !== workspaceId) {
+            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, {
+                workerId,
+                workspaceId,
+                actualWorkspaceId: worker.workspace_id,
+                retryable: false,
+            });
+        }
+        const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
+        try {
+            let parsed;
+            try {
+                parsed = parsePath(args.target);
+            }
+            catch {
+                parsed = null;
+            }
+            if (parsed === null || parsed.kind !== "url") {
+                return entryReadResult(Results.failure("daemon:entry", "target-invalid", 400, `The entry target '${args.target}' is not URL-shaped.`, { entry: null }, {
+                    target: args.target,
+                    stage: "entry-read",
+                    recovery: "Use a scheme://path target.",
+                    retryable: false,
+                }));
+            }
+            if (args.offset !== undefined && channel === undefined) {
+                return entryReadResult(Results.failure("daemon:entry", "offset-channel-required", 400, "An entry offset requires a channel.", { entry: null }, {
+                    offset: args.offset,
+                    stage: "entry-read",
+                    recovery: "Select the channel to read from the offset.",
+                    retryable: false,
+                }));
+            }
+            if (args.offset !== undefined && (!Number.isSafeInteger(args.offset) || args.offset < 0)) {
+                return entryReadResult(Results.failure("daemon:entry", "offset-invalid", 400, `Entry offset ${args.offset} is not a non-negative safe integer.`, { entry: null }, {
+                    offset: args.offset,
+                    stage: "entry-read",
+                    recovery: "Use a non-negative integer offset.",
+                    retryable: false,
+                }));
+            }
+            if (parsed.username !== null || parsed.password !== null) {
+                return entryReadResult(Results.failure("daemon:entry", "userinfo-not-allowed", 400, "Entry target URL userinfo is not allowed.", { entry: null }, {
+                    stage: "entry-read",
+                    recovery: "Remove credentials from the entry URL.",
+                    retryable: false,
+                }));
+            }
+            const location = await this.#engine.resolveEntryAddress({
+                workspaceId,
+                workerId,
+                target: parsed,
+            });
+            if (location === null) {
+                return entryReadResult(Results.failure("daemon:entry", "entry-not-found", 404, "No visible entry exists at the requested target.", { entry: null }, { target: args.target }));
+            }
+            const row = await this.#db.entry_read_lookup.get({
+                workspace_id: workspaceId,
+                owner_id: location.ownerId,
+                scheme: location.scheme,
+                pathname: location.pathname,
+            });
+            if (row === undefined) {
+                return entryReadResult(Results.failure("daemon:entry", "entry-not-found", 404, `No visible entry exists at ${location.target}.`, { entry: null }, { target: location.target }));
+            }
+            let channelRows;
+            if (channel === undefined) {
+                channelRows = await this.#db.entry_read_channels.all({ entry_id: row.id });
+            }
+            else {
+                const r = await this.#db.entry_read_channel_slice.get({ entry_id: row.id, channel, offset: args.offset ?? 0 });
+                if (r === undefined) {
+                    const availableChannels = (await this.#db.entry_read_channels.all({ entry_id: row.id }))
+                        .map(({ name }) => name);
+                    return entryReadResult(Results.failure("daemon:entry", "channel-not-found", 404, `Channel #${channel} does not exist at ${location.target}.`, { entry: null }, {
+                        target: location.target,
+                        requestedChannel: channel,
+                        availableChannels,
+                        ...(availableChannels.length === 0
+                            ? {}
+                            : { recovery: `Use one of the available channels: ${availableChannels.map((channel) => `#${channel}`).join(", ")}.` }),
+                        retryable: false,
+                    }));
+                }
+                channelRows = [r];
+            }
+            const channels = {};
+            for (const c of channelRows) {
+                channels[c.name] = {
+                    content: c.content,
+                    contentOffset: c.contentOffset,
+                    contentLength: c.contentLength,
+                    mimetype: c.mimetype,
+                    tokens: c.tokens,
+                    state: c.state,
+                };
+            }
+            const tagRows = await this.#db.crud_read_tags.all({ entry_id: row.id });
+            return entryReadResult({
+                status: 200,
+                entry: {
+                    entryId: row.id,
+                    target: location.target,
+                    channels,
+                    tags: tagRows.map((tag) => tag.tag),
+                },
+            });
+        }
+        finally {
+            release();
         }
-        else {
-            const r = await this.#db.entry_read_channel_slice.get({ entry_id: row.id, channel: args.channel, offset: args.offset ?? 0 });
-            channelRows = r === undefined ? [] : [r];
-        }
-        const channels = {};
-        for (const c of channelRows)
-            channels[c.name] = { content: c.content, contentLength: c.contentLength, mimetype: c.mimetype, tokens: c.tokens, state: c.state };
-        const tagRows = await this.#db.crud_read_tags.all({ entry_id: row.id });
-        return { status: 200, entry: { id: row.id, scope: row.scope, workspaceId: row.workspace_id, scheme: row.scheme, pathname: row.pathname, channels, tags: tagRows.map((t) => t.tag) } };
     }
-    // The fork hook (#355) — branch a worker's log into a new worker in the same workspace (#228), sharing the
-    // workspace's world (entries + overlay), copying nothing of it. The module resolves the default (the
-    // workspace's model worker) from its own connection state and passes the concrete workerId; the seam owns the
-    // #366 — a fresh conversation worker: AG-UI threads map to RUNS (§machine-processes — the workspace
-    // is the workspace, the worker is the conversation). ensureModelWorker is the stable DEFAULT door,
-    // forkWorker the branching door (copies history); this is the fresh door — a named, empty-log,
-    // model-origin root that runLoop accepts. New chat = new conversation, same workspace.
+    // {§methods-conversation-worker}: a fresh conversation is a model-origin root worker with an empty private log.
+    // AG-UI threads map to these workers while the workspace world remains shared ({§machine-processes}).
     async createConversationWorker(args) {
-        const { workspaceId, name } = args;
-        if (name !== undefined && (typeof name !== "string" || name.length === 0))
-            throw new Error("run.create: name must be a non-empty string");
+        const workspaceId = ClientInput.assertId("worker.create", "workspaceId", args.workspaceId);
+        const name = ClientInput.assertOptionalWorkerName("worker.create", "name", args.name);
         const workspace = await this.#db.envelope_get_workspace.get({ id: workspaceId });
-        if (workspace === undefined)
-            throw new Error(`run.create: workspace ${workspaceId} not found`);
+        if (workspace === undefined) {
+            throw daemonFailure("daemon:workspace", "workspace-not-found", 404, `Workspace ${workspaceId} does not exist.`, { workspaceId });
+        }
         if (name !== undefined) {
-            if (Envelope.RESERVED_RUN_NAMES.has(name.toLowerCase()))
-                throw new Error(`run.create: name "${name}" is reserved for a non-client actor`);
             const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
-            if (taken !== undefined)
-                throw new Error(`run.create: a worker named "${name}" already exists — worker names are immutable, pick another`);
+            if (taken !== undefined) {
+                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId}.`, { workspaceId, name, recovery: "Choose another worker name.", retryable: false });
+            }
         }
-        const run = await Envelope.createModelWorker(this.#db, workspaceId, name);
-        return { workerId: run.id, workerName: run.name };
+        const worker = await Envelope.createModelWorker(this.#db, workspaceId, name);
+        return { workerId: worker.id, workerName: worker.name };
     }
-    // ownership check and the run-name namespace + uniqueness invariants (names are immutable — no rename).
+    // {§worker-scheme-fork} — branch a worker's log while sharing the workspace world.
+    // Core owns the workspace check and immutable worker-name admission.
     async forkWorker(args) {
-        if (args.name !== undefined && (typeof args.name !== "string" || args.name.length === 0))
-            throw new Error("run.fork: name must be a non-empty string"); // seam fail-hard (#364)
-        const { workspaceId, workerId, name } = args;
+        const workspaceId = ClientInput.assertId("worker.fork", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.fork", "workerId", args.workerId);
+        const name = ClientInput.assertOptionalWorkerName("worker.fork", "name", args.name);
         const owner = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
-        if (owner === undefined)
-            throw new Error(`forkWorker: run ${workerId} not found`);
-        if (owner.workspace_id !== workspaceId)
-            throw new Error(`forkWorker: run ${workerId} is not in workspace ${workspaceId}`);
+        if (owner === undefined) {
+            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
+        }
+        if (owner.workspace_id !== workspaceId) {
+            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, {
+                workerId,
+                workspaceId,
+                actualWorkspaceId: owner.workspace_id,
+                retryable: false,
+            });
+        }
         if (name !== undefined) {
-            if (Envelope.RESERVED_RUN_NAMES.has(name.toLowerCase()))
-                throw new Error(`forkWorker: name "${name}" is reserved for a non-client actor`);
             const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
-            if (taken !== undefined)
-                throw new Error(`forkWorker: a worker named "${name}" already exists — worker names are immutable, pick another`);
+            if (taken !== undefined) {
+                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId}.`, { workspaceId, name, recovery: "Choose another worker name.", retryable: false });
+            }
         }
         const branchWorkerId = await Fork.fork(this.#db, workerId, name);
         const branch = await this.#db.envelope_get_worker_by_id.get({ id: branchWorkerId });
         return { workerId: branchWorkerId, workerName: branch?.name ?? null, parentWorkerId: workerId };
     }
-    // The module-load hook (#355 / #289) — register a runtime into the live registry, driver-agnostic:
-    // the kernel knows nothing about MCP or any specific driver. The struct is the booth window agreed
-    // with the execs agent (execs-mcp installServer's hotload callback): framework types only — the decl
-    // (tag + glyph/example/documentation), the executor, the driver's probe result. RegistryEntry never
-    // leaves the kernel; it's wrapped here, mirroring boot. The engine's scheme-face arbitration
-    // (reserved / cross-family collision, #240) gates the tag before registering.
-    hotloadRuntime(reg) {
-        const { decl, executor, availability } = reg;
-        this.#engine.hotloadRuntime(decl.name, {
+    async registerRuntime({ namespaceOwner, decl, executor, availability, scheme }) {
+        if (typeof namespaceOwner !== "string" || namespaceOwner.trim().length === 0) {
+            throw new Error("registerRuntime: namespaceOwner must be a non-empty string");
+        }
+        this.#engine.registerRuntime(decl.name, {
             executor,
+            namespaceOwner: { kind: "module", name: namespaceOwner },
             glyph: decl.glyph ?? "",
             example: decl.example ?? "",
             documentation: decl.documentation ?? "",
             available: availability.available,
             detail: availability.detail,
-        });
+        }, scheme);
+        if (this.#capabilitiesPublished) {
+            for (const workspace of await Envelope.listWorkspaces(this.#db)) {
+                await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
+            }
+        }
+    }
+    async registerScheme(name, handler) {
+        this.#schemes.register(name, handler);
+        if (this.#capabilitiesPublished) {
+            await this.#schemes.ready();
+            for (const workspace of await Envelope.listWorkspaces(this.#db)) {
+                await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
+            }
+        }
+    }
+    registerModuleAction(name, handler) {
+        if (name.length === 0)
+            throw new Error("registerModuleAction: action name must not be empty");
+        if (this.#moduleActions.has(name))
+            throw new Error(`module action '${name}' is already registered`);
+        this.#moduleActions.set(name, handler);
+    }
+    listModuleActions() {
+        return [...this.#moduleActions.keys()].toSorted();
+    }
+    async invokeModuleAction(name, params) {
+        const handler = this.#moduleActions.get(name);
+        if (handler === undefined)
+            throw new Error(`module action '${name}' is not registered`);
+        return handler(params);
     }
     get engine() { return this.#engine; }
     get provider() { return this.#provider; }
     get schemes() { return this.#schemes; }
     get mimetypes() { return this.#mimetypes; }
-    // The boot plug-point (#355 hook D) — register a plugin module before start(); its init runs at
-    // boot with the curated CoreSeam handle, where it opens its own transport/listener. Direct wiring, no
-    // plugin-kind abstraction: a second transport earns one if it ever appears. "Here's your handle."
-    // The init's return value is ignored — a module may hand back its instance (or nothing).
-    #moduleInits = [];
-    registerModule(init) {
-        this.#moduleInits.push(init);
+    registerModule(module) {
+        if (this.#started)
+            throw new Error("registerModule: modules must be registered before daemon start");
+        this.#modules.push(module);
     }
     async start() {
         if (this.#started)
@@ -557,18 +919,27 @@ export default class Daemon {
         // Mimetypes owns its own discovery scan over @plurnk/plurnk-mimetypes-*
         // packages; pre-warm it so first index render doesn't pay the cost.
         await this.#mimetypes.ready();
+        for (const name of await this.#mimetypes.skippedPackages()) {
+            console.warn(`mimetype discovery: '${name}' is discovered but untrusted (PLURNK_PLUGINS_TRUSTED_ONLY); not registered`);
+        }
         // Discover + probe the installed executor siblings, then hand the
-        // registry to the engine for exec dispatch (plurnk-service#181). The
+        // registry to the engine for exec dispatch ({§exec-registry-resolves}). The
         // shell is the default runtime, so its executor must boot usable.
         const executors = await ExecutorRegistry.build({ defaultRuntime: "sh", cwd: this.#discoveryCwd });
         this.#engine.setExecutors(executors);
-        // §exec — mint a scheme per runtime tag so exec output entries address by tag
+        // {§exec} — mint a scheme per runtime tag so exec output entries address by tag
         // authority (sh:///l/t/s). The "exec" scheme stays for the EXEC op dispatch.
         this.#schemes.registerRuntimeSchemes(executors);
         // Discover external @plurnk/plurnk-schemes-* siblings + register them
         // (agnostic, by plurnk.kind:"scheme"). They light up http://, etc. with
-        // no further engine change — #run wraps their ctx in SchemeCtxImpl (#195).
+        // no further engine change — #run wraps their context in SchemeCtxImpl ({§plugin-discovery}).
         await this.#schemes.discoverExternal(this.#discoveryCwd);
+        const setupSeam = this;
+        for (const module of this.#modules) {
+            if (module.close !== undefined)
+                this.#moduleClosers.push(module);
+            await module.setup?.(setupSeam);
+        }
         await this.#schemes.ready();
         // Reconcile the kernel-published documentation surface once per existing workspace.
         // Installed capabilities and operator configuration are now fully known; model loops
@@ -576,16 +947,28 @@ export default class Daemon {
         for (const workspace of await Envelope.listWorkspaces(this.#db)) {
             await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
         }
+        this.#capabilitiesPublished = true;
         await this.#recoverLifecycle();
-        // #364 — the daemon opens NO transport, ever: plugin modules open theirs via the seam.
-        for (const init of this.#moduleInits)
-            await init(this);
+        // {§module-lifecycle} — the daemon opens no transport. Modules start their listeners only
+        // after capability publication and durable lifecycle recovery are complete.
+        for (const module of this.#modules) {
+            const started = await module.start?.(this);
+            if (started !== undefined && !this.#moduleClosers.includes(started)) {
+                this.#moduleClosers.push(started);
+            }
+        }
     }
     async #recoverLifecycle() {
         await this.#db.recovery_fail_active_loops.run({});
+        await this.#db.recovery_fail_ownerless_proposals.run({});
         await this.#db.recovery_error_orphan_subscription_channels.run({});
         await this.#db.recovery_fail_orphan_subscriptions.run({});
         await this.#db.recovery_resume_unblocked_parks.run({});
+        await this.#branchBatches.recover();
+        const orphanSources = await this.#db.recovery_orphan_prompt_sources.all({});
+        for (const source of orphanSources) {
+            await this.#reconcileOrphanedPrompts(source.worker_id, source.loop_id);
+        }
         const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
         const queued = await this.#db.recovery_queued_workers.all({});
         for (const row of queued) {
@@ -607,6 +990,13 @@ export default class Daemon {
         if (!this.#started)
             return;
         this.#started = false;
+        // Stop accepting external work immediately, but do not await listener
+        // closure before cancelling active workers: an SSE connection may itself be
+        // waiting for the worker cancellation that follows.
+        const moduleClose = Promise.allSettled(this.#moduleClosers
+            .toReversed()
+            .map((module) => Promise.resolve().then(() => module.close())));
+        this.#moduleClosers = [];
         // Drain order: (1) abort in-flight loops via #activeDrains so
         // strike paths don't keep going, (2) await each drain's promise
         // to completion, (3) drain streaming schemes' background work
@@ -614,12 +1004,13 @@ export default class Daemon {
         // upstream — drain queries hit the DB right up until they exit.
         // Abort every worker's cancellation scope — stops in-flight loops AND the
         // streams (background execs) linked to them, so idle() doesn't block on
-        // a long-running command. Covers runs whose drain already exited but
+        // a long-running command. Covers workers whose drain already exited but
         // whose exec is still in flight.
         // Settle the stopped world FIRST: a drain paused at a pending proposal awaits a resolution
         // that will never arrive once clients are gone — allSettled(drains) below would deadlock
         // the stop forever (a daemon with a pending HITL proposal could not shut down).
         this.#engine.cancelAllProposals("daemon_stopping");
+        this.#branchBatches.beginStop();
         for (const scope of this.#workerAborts.values()) {
             if (!scope.signal.aborted)
                 scope.abort("daemon_stopping");
@@ -628,17 +1019,31 @@ export default class Daemon {
             clearTimeout(t); // drop pending hibernation poll-wakes
         this.#pollBackoff.clear();
         this.#pollTimers.clear();
-        // …and the park-DEADLINE timers (#432): a bounded park's timer fires #wakeParkedWorker after
+        // Cancel park-deadline timers before DB close; otherwise a late #wakeParkedWorker would run after
         // stop/db-close if left pending — an unhandled rejection (SqlRite closed) that abnormally
         // exits the worker under load. Symmetric with the poll-wakes above; both must be reaped.
         for (const t of this.#parkTimers.values())
             clearTimeout(t);
         this.#parkTimers.clear();
+        await this.#branchBatches.idle();
         const drainPromises = [...this.#activeDrains.values()].map((d) => d.promise);
         await Promise.allSettled(drainPromises);
-        await this.#drainStreamingSchemes();
-        await this.#engine.drainDerivations(); // active workspace warms finish before the db closes upstream
-        await this.#schemes.close();
+        const closeResults = await moduleClose;
+        const [streamingResult] = await Promise.allSettled([this.#drainStreamingSchemes()]);
+        const [derivationResult] = await Promise.allSettled([
+            this.#engine.drainDerivations(), // active workspace warms finish before the db closes upstream
+        ]);
+        const mimetypeResults = this.#ownsMimetypes
+            ? await Promise.allSettled([this.#mimetypes.dispose()])
+            : [];
+        const [schemeResult] = await Promise.allSettled([this.#schemes.close()]);
+        const closeErrors = [...closeResults, streamingResult, derivationResult, ...mimetypeResults, schemeResult]
+            .filter((result) => result.status === "rejected")
+            .flatMap((result) => result.reason instanceof AggregateError
+            ? [...result.reason.errors]
+            : [result.reason]);
+        if (closeErrors.length > 0)
+            throw new AggregateError(closeErrors, "daemon shutdown failed");
     }
     // Per-scheme idle awaits for clean shutdown. New streaming schemes
     // (SSE, WS) add themselves here as they land.
@@ -650,48 +1055,47 @@ export default class Daemon {
     /**
      * Emit a stream/event notification scoped to the workspace containing the
      * entry. ChannelWrite helpers (src/core/ChannelWrite.ts) invoke this when
-     * they update channel content or state. SPEC §notifications.
+     * they update channel content or state. SPEC {§notifications}.
      */
     notifyStreamEvent(workspaceId, event) {
         this.#broadcast({ workspaceId }, "stream/event", event);
     }
     /**
-     * Emit a telemetry/event notification scoped to the workspace containing
-     * the loop. TelemetryChannel.push invokes this for every TelemetryEvent
-     * (parse_error, strike, cycle, sudden_death, no_ops, max_commands_exceeded,
-     * action_failure) the moment it lands in the loop's telemetry buffer.
-     * SPEC §telemetry.
+     * Emit a transient notice scoped to the workspace containing the loop.
      */
-    notifyTelemetryEvent(workspaceId, payload) {
-        this.#broadcast({ workspaceId }, "telemetry/event", payload);
+    notifyNotice(workspaceId, payload) {
+        this.#broadcast({ workspaceId }, "notice/event", payload);
     }
     /**
      * Inject a prompt into a worker. Two paths:
-     *   - Active drain: writes a plurnk://prompt/<run>/<loop>/<next-turn> entry
-     *     via Engine.inject. Current loop sees the new prompt at its next
+     *   - Active drain: writes the next prompt:///<loop>/<N> entry via
+     *     Engine.inject. The current loop publishes it at its next
      *     turn. Returns immediately with {action: "injected_next_turn"}.
      *   - No active drain: enqueues a fresh loop with the prompt at
      *     status=100, starts a drain. Returns the drain promise so the
      *     caller can await full completion.
      *
-     * Rummy parallel: AgentLoop.inject(). Unified surface — both `loop.run`
-     * and wake-on-completion go through this method. §actor-boundary-passive-wake
+     * Both `runLoop` and wake-on-completion go through this method
+     * ({§actor-boundary-passive-wake}).
      */
-    // #368 — flags are LOOP-scoped (persisted per loop row; the packet's teaching follows them), so a
-    // prompt folding into a live/parked loop cannot re-flag it mid-flight — and it must never PRETEND
-    // to: an inject carrying flags that DIFFER from the target loop's effective flags is refused
-    // legibly (cancel the loop or omit the flags), never a silent posture discard. Identical or
-    // absent flags fold clean.
+    // {§methods-loop-run-fold-consistency} — a folded prompt cannot reconfigure its loop.
     async #assertFoldPosture(workerId, flags, loopId) {
         if (flags === undefined || Object.keys(flags).length === 0)
             return;
-        const row = loopId !== undefined
-            ? await this.#db.engine_get_loop_flags.get({ loop_id: loopId })
-            : await this.#db.drain_active_loop_flags.get({ worker_id: workerId });
-        const effective = { ...DEFAULT_LOOP_FLAGS, ...JSON.parse(row?.flags ?? "{}") };
-        const conflicts = Object.entries(flags).filter(([k, v]) => v !== undefined && effective[k] !== v).map(([k, v]) => `${k}: ${JSON.stringify(effective[k])} → ${JSON.stringify(v)}`);
+        const effective = await LoopFlagsReader.read(this.#db, loopId);
+        const requested = Object.entries(flags);
+        const conflicts = requested
+            .filter(([key, value]) => value !== undefined && effective[key] !== value)
+            .map(([key, value]) => `${key}: ${JSON.stringify(effective[key])} -> ${JSON.stringify(value)}`);
         if (conflicts.length > 0) {
-            throw new Error(`inject: the prompt would fold into a live loop whose flags differ (${conflicts.join(", ")}) — flags are loop-scoped and never change mid-flight. Cancel the loop (loop.cancel) and re-run with the new flags, or send the prompt without flags to adopt the loop's posture.`);
+            throw daemonFailure("daemon:loop", "loop-flags-conflict", 409, "The requested loop flags differ from the active loop flags.", {
+                workerId,
+                loopId,
+                conflicts,
+                stage: "loop-injection",
+                recovery: "Cancel the active loop before changing flags, or omit flags to keep its current posture.",
+                retryable: false,
+            });
         }
     }
     async inject(args) {
@@ -700,29 +1104,29 @@ export default class Daemon {
         // engine.inject returns null when no loop is currently executing, so
         // we enqueue a fresh loop below and ensure a drain claims it.
         if (this.#activeDrains.has(workerId)) {
-            await this.#assertFoldPosture(workerId, args.flags); // #368 — a fold never silently discards intent
             const active = await this.#db.drain_current_loop_for_worker.get({ worker_id: workerId });
             if (active !== undefined) {
+                await this.#assertFoldPosture(workerId, args.flags, active.id); // compare with the exact durable loop
                 await this.#assertLoopProvider(active.id, args.providerSpec);
-                await this.#assertLoopMaxTurns(active.id, args.maxTurns);
+                await this.#assertLoopMaxTurns(active.id, args.turnCeiling?.source === "explicit" ? args.turnCeiling.effective : undefined);
             }
-            const result = await this.#engine.inject(workerId, prompt);
+            const result = await this.#engine.inject(workerId, prompt, args.openPaths ?? []);
             if (result !== null) {
                 return { action: "injected_next_turn", loopId: result.loopId, turnSeq: result.turnSeq };
             }
         }
-        // #55 — a worker PARKED at 202 RESUMES that slept loop in place: the voice door (irc / loop.inject)
+        // {§worker-lifecycle-wake-requeue-not-terminal} — a worker parked at 202 resumes that loop in place:
         // is a wake edge like a stream/child conclusion, not a fresh loop that orphans the parked one
         // (which would leave the worker non-quiescent forever). engine.inject writes the message as the
         // slept loop's next-turn prompt (the directed message — distinct from the env door, which
-        // resumes promptless); then re-queue + drain it. §worker-lifecycle-wake-liveness.
+        // resumes promptless); then re-queue + drain it. {§worker-lifecycle-wake-liveness}.
         if (!this.#activeDrains.has(workerId)) {
             const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
             if (slept !== undefined) {
-                await this.#assertFoldPosture(workerId, args.flags, slept.id); // #368 — the resume path drops nothing silently either
+                await this.#assertFoldPosture(workerId, args.flags, slept.id); // resume drops nothing silently
                 await this.#assertLoopProvider(slept.id, args.providerSpec);
-                await this.#assertLoopMaxTurns(slept.id, args.maxTurns);
-                const injected = await this.#engine.inject(workerId, prompt);
+                await this.#assertLoopMaxTurns(slept.id, args.turnCeiling?.source === "explicit" ? args.turnCeiling.effective : undefined);
+                const injected = await this.#engine.inject(workerId, prompt, args.openPaths ?? []);
                 await this.#lifecycle.wake(slept.id);
                 const started = await this.#ensureDrain({
                     workspaceId, workerId, systemPrompt: args.systemPrompt,
@@ -730,44 +1134,61 @@ export default class Daemon {
                 return { action: "injected_next_turn", loopId: slept.id, ...(injected?.turnSeq !== undefined ? { turnSeq: injected.turnSeq } : {}), ...(started ?? {}) };
             }
         }
-        // Enqueue a fresh loop. Persist flags on the row.
-        const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
-        if (seqRow === undefined)
-            throw new Error("inject: next-sequence query returned no row");
-        const loopRow = await this.#db.drain_enqueue_loop.get({
-            worker_id: workerId, sequence: seqRow.next, prompt,
-            provider_spec: JSON.stringify(args.providerSpec),
-            max_turns: args.maxTurns ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
+        const loopId = await this.#enqueueFreshLoop({
+            workerId,
+            prompt,
+            providerSpec: args.providerSpec,
+            maxTurns: args.turnCeiling?.effective,
+            flags: args.flags,
+            openPaths: args.openPaths,
         });
-        if (loopRow === undefined)
-            throw new Error("inject: loop enqueue returned no row");
-        const loopId = loopRow.id;
-        if (args.flags !== undefined) {
-            const merged = { ...DEFAULT_LOOP_FLAGS, ...args.flags };
-            await this.#db.engine_set_loop_flags.run({
-                loop_id: loopId, flags: JSON.stringify(merged),
-            });
-        }
-        // #260 — persist client-passed @file paths before the drain claims the loop, so turn 0 foists them.
-        if (args.openPaths !== undefined && args.openPaths.length > 0) {
-            await this.#db.engine_set_loop_open_paths.run({
-                loop_id: loopId, open_paths: JSON.stringify(args.openPaths),
-            });
-        }
         // Guarantee a drain claims the loop we just enqueued. #ensureDrain runs its
-        // check-and-start UNDER the per-worker drain lock (§worker-lifecycle-single-drain),
+        // check-and-start UNDER the per-worker drain lock ({§worker-lifecycle-single-drain}),
         // serialized against a draining sibling's teardown relinquish so the two can't
         // both register a drain (R4). A live drain re-claims the loop in its own
         // iteration or its lock-held exit re-claim, so it's never stranded.
-        // firstLoopPromise is present only when THIS call started the drain — loop.run
+        // firstLoopPromise is present only when THIS call started the drain — runLoop
         // keys its fast-path response on that.
         const started = await this.#ensureDrain({
             workspaceId, workerId, systemPrompt: args.systemPrompt,
         });
         return { action: "enqueued_new_loop", loopId, ...(started ?? {}) };
     }
+    async #enqueueFreshLoop(args) {
+        // {§worker-lifecycle-single-drain}: sequence allocation and insertion
+        // are one queue mutation; another accepted prompt cannot claim the gap.
+        return this.#withDrainLock(args.workerId, async () => {
+            const seqRow = await this.#db.loop_run_next_sequence.get({
+                worker_id: args.workerId,
+            });
+            if (seqRow === undefined)
+                throw new Error("enqueueFreshLoop: next-sequence query returned no row");
+            const loopRow = await this.#db.drain_enqueue_loop.get({
+                worker_id: args.workerId,
+                sequence: seqRow.next,
+                prompt: args.prompt,
+                provider_spec: JSON.stringify(args.providerSpec),
+                max_turns: args.maxTurns ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
+            });
+            if (loopRow === undefined)
+                throw new Error("enqueueFreshLoop: loop enqueue returned no row");
+            if (args.flags !== undefined) {
+                await this.#db.engine_set_loop_flags.run({
+                    loop_id: loopRow.id,
+                    flags: JSON.stringify({ ...DEFAULT_LOOP_FLAGS, ...args.flags }),
+                });
+            }
+            if (args.openPaths !== undefined && args.openPaths.length > 0) {
+                await this.#db.engine_set_loop_open_paths.run({
+                    loop_id: loopRow.id,
+                    open_paths: JSON.stringify(args.openPaths),
+                });
+            }
+            return loopRow.id;
+        });
+    }
     /**
-     * Start a drain for the given run. The drain claims queued loops via
+     * Start a drain for the given worker. The drain claims queued loops via
      * drain_claim_next_loop (atomic 100→102 flip), executes each via
      * Engine.runLoop, and re-checks. Stream-aware: when the queue is empty
      * but the worker has active subscriptions, the drain parks on a
@@ -775,7 +1196,7 @@ export default class Daemon {
      * exits when queue is empty AND no active subscriptions remain.
      *
      * Returns both `firstLoopPromise` (resolves once the first loop the
-     * drain processes completes — used by loop.run to give the caller a
+     * drain processes completes — used by runLoop to give the caller a
      * fast response containing their loop's result) and `drainPromise`
      * (resolves only when the whole drain finishes, queue+subs settled).
      */
@@ -798,7 +1219,7 @@ export default class Daemon {
         const drainPromise = (async () => {
             let loopsDrained = 0;
             let lastResult = null;
-            let currentLoopId = null; // the loop being drained — for the #204 abort→499 resolution below
+            let currentLoopId = null; // the loop being drained — for abort→499 settlement
             try {
                 while (true) {
                     controller.signal.throwIfAborted();
@@ -821,35 +1242,40 @@ export default class Daemon {
                             break;
                     }
                     currentLoopId = loopRow.id;
-                    // #598 — provider identity belongs to the claimed loop, not the
+                    // {§methods-loop-run-model} — provider identity belongs to the claimed loop, not the
                     // drain that happened to claim it. A drain can consume multiple
                     // queued loops; resolve each durable selection at this boundary.
                     const provider = await this.#providerForLoop(loopRow.id);
                     const onDispatch = (logEntryId) => {
-                        // #506 — a rejection here was a silent process-death vector (unhandled in a
-                        // fire-and-forget void); a log-broadcast failure must never crash the drain.
+                        // {§methods-event-subscribe} — a log-broadcast failure must never crash the drain.
                         void (async () => {
                             const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
                             this.#broadcast({ workspaceId }, "log/entry", { entry });
                         })().catch((e) => console.error("log/entry broadcast failed:", e instanceof Error ? e.message : String(e)));
                     };
-                    const result = await this.#engine.runLoop({
-                        provider, workspaceId, workerId, loopId: loopRow.id, maxTurns: loopRow.max_turns,
-                        messages: [
-                            { role: "system", content: systemPrompt },
-                            { role: "user", content: loopRow.prompt },
-                        ],
-                        origin: "model",
-                        onDispatch,
-                        signal: controller.signal,
+                    const result = await observed(// {§observability-boundary}
+                    "loop.run", { workspaceId, workerId, "loop.id": loopRow.id }, async (span) => {
+                        const loopResult = await this.#engine.runLoop({
+                            provider, workspaceId, workerId, loopId: loopRow.id, maxTurns: loopRow.max_turns,
+                            messages: [
+                                { role: "system", content: systemPrompt },
+                                { role: "user", content: loopRow.prompt },
+                            ],
+                            origin: "model",
+                            onDispatch,
+                            signal: controller.signal,
+                        });
+                        span.setAttribute("status", loopResult.result.status);
+                        recordCounter(LOOP_TERMINALS, { status: loopResult.result.status });
+                        return loopResult;
                     });
-                    if (result.finalStatus === 202) {
-                        // The loop SLEPT (parked via [102]<T>/<-1>) — suspended, not terminated. Leave it at 202
+                    if (result.result.status === 202) {
+                        // The loop slept via SEND[202] — suspended, not terminated. Leave it at 202
                         // (resumable); no loop/terminated, no orphan-reconcile. A stream conclusion
                         // (#handleWakeWorker) re-queues it; and if it holds a polled stream, a poll timer
-                        // wakes it every P to inspect (§exec-poll). §worker-lifecycle-wake-liveness.
+                        // wakes it every P to inspect ({§exec-poll}). {§worker-lifecycle-wake-liveness}.
                         void this.#schedulePollWake(workspaceId, workerId, systemPrompt).catch((err) => console.error("poll-wake scheduling failed:", err instanceof Error ? err.message : String(err)));
-                        // §send-premature-terminate/[102]<T> — the park DEADLINE (grammar 0.75.0): the
+                        // {§send-premature-terminate}/SEND[202]<T> — the park deadline:
                         // dispatcher recorded the marker's seconds; a bounded park is woken at T
                         // regardless of arrivals, so a park always has a next turn. -1 (indefinite:
                         // the butler, a [300] ask) schedules nothing — irc/inject/conclusions wake it.
@@ -871,37 +1297,44 @@ export default class Daemon {
                                 this.#parkTimers.set(workerId, t);
                             }
                         }
-                        // Honor an OWED wake (§worker-lifecycle-child-wake): a child/stream concluded while
+                        // Honor an OWED wake ({§worker-lifecycle-child-wake}): a child/stream concluded while
                         // this worker was mid-turn, before it slept — resume in place rather than park blind,
-                        // so a worker-run hibernation always returns. The loop is 202 here; reset to
+                        // so a worker hibernation always returns. The loop is 202 here; reset to
                         // claimable and the drain re-runs it on the next claim below.
                         if (this.#owedWakes.delete(workerId)) {
                             await this.#lifecycle.wake(loopRow.id);
+                            currentLoopId = null;
                             continue;
                         }
-                        // The loop is blocked at 202 on a live obligation (§wait-obligation-matrix);
+                        // The loop is blocked at 202 on a live obligation ({§wait-obligation-matrix});
                         // that obligation's conclusion is its wake edge (the owed-wake above covers the
                         // conclude-before-block race). An idle wait never reaches here — it concluded at dispatch.
+                        currentLoopId = null;
                         continue;
                     }
                     this.#owedWakes.delete(workerId); // the loop concluded (non-202) — no park to honor a held wake at
-                    const usage = await this.#engine.loopUsage(loopRow.id);
-                    const turnIds = await this.#lifecycle.turnIds(loopRow.id);
+                    const [usage, attributions, turnIds] = await Promise.all([
+                        this.#engine.loopUsage(loopRow.id),
+                        this.#engine.loopAttributions(loopRow.id),
+                        this.#lifecycle.turnIds(loopRow.id),
+                    ]);
                     this.#broadcast({ workspaceId }, "loop/terminated", {
                         workerId,
                         loopId: loopRow.id,
-                        finalStatus: result.finalStatus,
+                        result: result.result,
                         hitMaxTurns: result.hitMaxTurns,
                         turnIds,
                         usage,
+                        attributions,
                     });
                     loopsDrained++;
                     const loopResult = {
                         loopId: loopRow.id,
                         turnIds,
-                        finalStatus: result.finalStatus,
+                        result: result.result,
                         hitMaxTurns: result.hitMaxTurns,
                         usage,
+                        attributions,
                     };
                     lastResult = loopResult;
                     if (!firstSettled) {
@@ -909,67 +1342,96 @@ export default class Daemon {
                         resolveFirst(loopResult);
                     }
                     // A next-turn prompt this loop ended before consuming (a
-                    // wake conclusion or a loop.run-while-active) is promoted to
+                    // wake conclusion or a runLoop-while-active prompt) is promoted to
                     // a fresh queued loop so it's never silently dropped.
-                    await this.#reconcileOrphanedWake(workerId, loopRow.id);
+                    await this.#reconcileOrphanedPrompts(workerId, loopRow.id);
+                    currentLoopId = null;
                 }
             }
             catch (err) {
                 if (controller.signal.aborted) {
-                    // #204 / Model 3 — loop.cancel / shutdown aborted the live drain. A cancellation
-                    // is the loop's TERMINAL state (499), delivered via loop/terminated (loop.run no
+                    // {§methods-loop-cancel} — loop.cancel / shutdown aborted the live drain. A cancellation
+                    // is the loop's TERMINAL state (499), delivered via loop/terminated (runLoop no
                     // longer blocks to return it). A genuine error rejects firstLoopPromise.
                     const usage = currentLoopId === null
-                        ? { promptTokens: 0, completionTokens: 0, costUsd: 0, contextTokens: 0, promptBudget: null, meta: {} }
+                        ? { promptTokens: 0, completionTokens: 0, costUsd: 0, costs: [], contextTokens: 0, promptBudget: null, meta: {} }
                         : await this.#engine.loopUsage(currentLoopId);
+                    const attributions = currentLoopId === null
+                        ? []
+                        : await this.#engine.loopAttributions(currentLoopId);
+                    const message = ErrorDetail.preview(controller.signal.reason ?? "user_cancelled")
+                        || "no reason was supplied";
                     if (currentLoopId !== null) {
-                        // #380 (owner ruling) — the cancel is allowed but provenanced: the ROW goes
-                        // terminal 499 (a dead loop must never read as live 102, #311) carrying
-                        // terminated_by='cancel' + the abort reason as the abandonment message, and
-                        // the broadcast carries the same message. The abort reason is the client's
-                        // loop.cancel reason (cancelDrain threads it through scope.abort).
-                        const message = String(controller.signal.reason ?? "user_cancelled").slice(0, 500);
-                        const cancelled = await this.#lifecycle.finish(currentLoopId, 499, message, "cancel");
-                        if (cancelled) {
+                        // {§methods-loop-cancel}/{§worker-lifecycle-terminal-result} —
+                        // persist the exact 499 cancellation result before broadcasting it.
+                        const cancelled = await this.#lifecycle.finish(currentLoopId, Results.failure("lifecycle:cancel", "loop-cancelled", 499, `The loop was cancelled: ${message}.`, {}, {
+                            reason: message,
+                            stage: "loop",
+                            retryable: false,
+                        }), { terminatedBy: "cancel" });
+                        if (cancelled !== null) {
                             this.#broadcast({ workspaceId }, "loop/terminated", {
                                 workerId,
                                 loopId: currentLoopId,
-                                finalStatus: 499,
+                                result: cancelled,
                                 hitMaxTurns: false,
                                 turnIds: await this.#lifecycle.turnIds(currentLoopId),
                                 usage,
-                                message,
+                                attributions,
                             });
                         }
                     }
                     if (!firstSettled) {
                         firstSettled = true;
-                        resolveFirst({ loopId: currentLoopId ?? 0, turnIds: [], finalStatus: 499, hitMaxTurns: false, usage });
+                        resolveFirst({
+                            loopId: currentLoopId ?? 0,
+                            turnIds: [],
+                            result: currentLoopId === null
+                                ? Results.failure("lifecycle:cancel", "loop-cancelled", 499, `The loop was cancelled: ${message}.`, {}, {
+                                    reason: message,
+                                    stage: "loop",
+                                    retryable: false,
+                                })
+                                : await this.#lifecycle.result(currentLoopId)
+                                    ?? Results.failure("lifecycle:cancel", "loop-cancelled", 499, `The loop was cancelled: ${message}.`, {}, {
+                                        reason: message,
+                                        stage: "loop",
+                                        retryable: false,
+                                    }),
+                            hitMaxTurns: false,
+                            usage,
+                        });
                     }
                 }
                 else {
-                    // #265 — a genuine (non-abort) loop error must still reach the client. loop.run only
-                    // acked finalStatus:100, so loop/terminated is the sole outcome channel; the rejection
-                    // alone reaches no one (firstLoopPromise/drainPromise are .catch()'d). Broadcast 500
-                    // (failed) — distinct from an abort's 499 — for every error, not just the pre-first one.
-                    // #506 — the WHY must reach every forensic channel, not one. The old handler
-                    // fed only the loop row + broadcast; run54 died with the daemon log silent, zero
-                    // error telemetry, and a bare 500 — the cause (a stack) reachable nowhere. The
-                    // daemon-log line + the error telemetry event fire even when currentLoopId is null
-                    // or the row-write itself is what failed, so a death is never traceless again.
+                    // {§worker-lifecycle-terminal-result} — a non-abort drain
+                    // failure becomes an exact durable 500 and terminal notification;
+                    // daemon diagnostics retain the complete caught error.
                     console.error(`drain error (workspace ${workspaceId}, worker ${workerId}, loop ${currentLoopId ?? "?"}):`, err);
                     if (currentLoopId !== null) {
-                        this.notifyTelemetryEvent(workspaceId, { loopId: currentLoopId, event: { source: "daemon:drain", kind: "loop_error", level: "error", message: err instanceof Error ? err.message : String(err) } });
-                        // #311 — the failure must be first-class on BOTH surfaces: the loop row goes
-                        // terminal 500 carrying the cause (a dead loop must never read as live 102 —
-                        // the premature-terminate gate counts live loops), and the broadcast carries
-                        // the same message so a backend 400 (context overflow, auth, …) reaches the
-                        // client as text, never a contentless 500.
-                        const message = (err instanceof Error ? err.message : String(err)).slice(0, 500);
-                        await this.#lifecycle.finish(currentLoopId, 500, message);
-                        const usage = await this.#engine.loopUsage(currentLoopId);
+                        const failure = err instanceof OperationFailureError
+                            ? err.result
+                            : Results.failure("daemon:drain", "loop-threw", 500, "The loop failed outside its operation result contract.", {}, {
+                                stage: "loop",
+                                retryable: false,
+                            });
+                        const settled = await this.#lifecycle.finish(currentLoopId, failure)
+                            ?? await this.#lifecycle.result(currentLoopId);
+                        if (settled === null) {
+                            throw new Error(`drain could not settle loop ${currentLoopId}`, { cause: err });
+                        }
+                        const [usage, attributions] = await Promise.all([
+                            this.#engine.loopUsage(currentLoopId),
+                            this.#engine.loopAttributions(currentLoopId),
+                        ]);
                         this.#broadcast({ workspaceId }, "loop/terminated", {
-                            workerId, loopId: currentLoopId, finalStatus: 500, hitMaxTurns: false, turnIds: [], usage, message,
+                            workerId,
+                            loopId: currentLoopId,
+                            result: settled,
+                            hitMaxTurns: false,
+                            turnIds: await this.#lifecycle.turnIds(currentLoopId),
+                            usage,
+                            attributions,
                         });
                     }
                     if (!firstSettled) {
@@ -991,7 +1453,7 @@ export default class Daemon {
         })();
         handle.promise = drainPromise;
         this.#activeDrains.set(workerId, handle);
-        // Topology join (§run-lifecycle): when this drain exits having CONCLUDED the worker, wake its parent
+        // Topology join ({§worker-loop-lifecycle}): when this drain exits having CONCLUDED the worker, wake its parent
         // if parked. Runs after the drain fully tears down (settled promise) so the quiescence check sees
         // final state; speculative (#onDrainExit no-ops unless the worker concluded AND the parent is parked).
         void drainPromise.then(() => this.#onDrainExit(workspaceId, workerId, systemPrompt), () => this.#onDrainExit(workspaceId, workerId, systemPrompt)).catch((err) => {
@@ -1003,12 +1465,12 @@ export default class Daemon {
         firstLoopPromise.catch(() => { });
         return { firstLoopPromise, drainPromise };
     }
-    // Per-run drain-transition lock (R4 / §worker-lifecycle-single-drain). #ensureDrain's
+    // Per-worker drain-transition lock (R4 / {§worker-lifecycle-single-drain}). #ensureDrain's
     // start and a drain's teardown relinquish both run under it, serialized, so the two
     // can't interleave and register two drains for one worker. The critical section is the
     // registry decision only (never a loop's work) — a sub-ms hop at drain boundaries.
     // A promise-chain mutex: each caller awaits the prior holder; the tail self-prunes
-    // when idle so the Map stays bounded to runs mid-transition.
+    // when idle so the Map stays bounded to workers mid-transition.
     #withDrainLock(workerId, fn) {
         const prev = this.#drainLocks.get(workerId) ?? Promise.resolve();
         const run = prev.then(fn, fn);
@@ -1032,34 +1494,49 @@ export default class Daemon {
             return this.#startDrain(opts);
         });
     }
-    // After a loop terminates, promote any next-turn prompt it never consumed —
-    // an injected wake (stream conclusion) or a loop.run-while-active prompt
-    // that landed on a turn the loop didn't reach — into a fresh queued loop.
-    // The drain claims it on its next iteration, so a conclusion or client
-    // prompt is never silently dropped. Inherits the ended loop's flags.
-    async #reconcileOrphanedWake(workerId, endedLoopId) {
-        const endedSeq = (await this.#db.engine_loop_sequence.get({ loop_id: endedLoopId }))?.sequence ?? endedLoopId;
-        const prefix = promptLoopPrefix(endedSeq);
-        const orphan = await this.#db.drain_orphaned_prompt_for_loop.get({ loop_id: endedLoopId, owner_id: workerId, pattern: `${prefix}%` });
-        if (orphan === undefined)
-            return;
-        const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
-        if (seqRow === undefined)
-            throw new Error("reconcileOrphanedWake: next-sequence query returned no row");
-        const fresh = await this.#db.drain_enqueue_loop.get({
-            worker_id: workerId, sequence: seqRow.next, prompt: orphan.body,
-            provider_spec: orphan.provider_spec,
-            max_turns: (await this.#db.drain_get_loop_max_turns.get({ loop_id: endedLoopId }))?.max_turns
-                ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
+    // After a loop terminates, promote every next-turn frame it never consumed
+    // into one source-keyed queued loop. The first frame occupies the loop seed;
+    // later frames retain separate prompt entries and publish in the same turn.
+    // Re-entry and boot recovery complete that same queued identity.
+    async #reconcileOrphanedPrompts(workerId, endedLoopId) {
+        await this.#withDrainLock(workerId, async () => {
+            const endedSeq = (await this.#db.engine_loop_sequence.get({ loop_id: endedLoopId }))?.sequence ?? endedLoopId;
+            const prefix = promptLoopPrefix(endedSeq);
+            const frames = await this.#db.drain_orphaned_prompts_for_loop.all({ loop_id: endedLoopId, owner_id: workerId, pattern: `${prefix}%`, prefix_len: prefix.length });
+            const first = frames[0];
+            if (first === undefined)
+                return;
+            const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
+            if (seqRow === undefined)
+                throw new Error("reconcileOrphanedPrompts: next-sequence query returned no row");
+            const recovery = await this.#db.drain_enqueue_orphan_recovery_loop.get({
+                worker_id: workerId,
+                sequence: seqRow.next,
+                prompt: first.body,
+                flags: first.flags,
+                provider_spec: first.provider_spec,
+                max_turns: first.max_turns,
+                open_paths: first.open_paths ?? "[]",
+                orphan_source_loop_id: endedLoopId,
+            });
+            if (recovery === undefined)
+                throw new Error("reconcileOrphanedPrompts: enqueue returned no row");
+            if (recovery.status !== 100)
+                return;
+            const moved = await this.#db.drain_rehome_orphaned_prompt_frames.all({
+                owner_id: workerId,
+                source_loop_id: endedLoopId,
+                source_pattern: `${prefix}%`,
+                source_prefix_len: prefix.length,
+                target_prefix: promptLoopPrefix(recovery.sequence),
+            });
+            if (moved.length !== frames.length) {
+                throw new Error(`reconcileOrphanedPrompts: expected to re-home ${frames.length} frames, moved ${moved.length}`);
+            }
         });
-        if (fresh === undefined)
-            throw new Error("reconcileOrphanedWake: enqueue returned no row");
-        if (orphan.flags !== null) {
-            await this.#db.engine_set_loop_flags.run({ loop_id: fresh.id, flags: orphan.flags });
-        }
     }
     // The worker's cancellation scope — lazily created, and replaced once aborted
-    // so a later loop.run gets a live signal. The drain and the execs its loops
+    // so a later runLoop gets a live signal. The drain and the execs its loops
     // spawn all run under it.
     #workerSignal(workerId) {
         const existing = this.#workerAborts.get(workerId);
@@ -1089,19 +1566,22 @@ export default class Daemon {
                 scope.abort(reason);
         }
         await Promise.all(cancelled.workerIds.map(async (targetWorkerId) => this.#reapWorkerStreams(targetWorkerId)));
-        for (const { loopId, workerId: targetWorkerId } of cancelled.loops) {
+        for (const { loopId, workerId: targetWorkerId, result } of cancelled.loops) {
             const row = await this.#db.drain_get_worker_workspace.get({ worker_id: targetWorkerId });
             if (row === undefined)
                 continue;
-            const usage = await this.#engine.loopUsage(loopId);
+            const [usage, attributions] = await Promise.all([
+                this.#engine.loopUsage(loopId),
+                this.#engine.loopAttributions(loopId),
+            ]);
             this.#broadcast({ workspaceId: row.workspace_id }, "loop/terminated", {
                 workerId: targetWorkerId,
                 loopId,
-                finalStatus: 499,
+                result,
                 hitMaxTurns: false,
                 turnIds: await this.#lifecycle.turnIds(loopId),
                 usage,
-                message: reason.slice(0, 500),
+                attributions,
             });
         }
     }
@@ -1110,10 +1590,11 @@ export default class Daemon {
     }
     /**
      * Cancel the worker's in-flight work (loop.cancel). One abort, one scope: the
-     * run signal stops the running loop's turn generation AND tears down every
+     * worker signal stops the running loop's turn generation AND tears down every
      * stream linked to it — a background exec that outlived its loop, or even a
      * spawn that registers after this abort (it self-aborts against the aborted
-     * signal). Returns cancelled iff there was work. Queued loops stay enqueued.
+     * signal). Returns cancelled iff there was process-local work; durable
+     * unresolved loops in the worker tree are terminalized independently.
      */
     cancelDrain(workerId, reason = "user_cancelled") {
         const hadDrain = this.#activeDrains.has(workerId);
@@ -1135,12 +1616,12 @@ export default class Daemon {
     }
     // Does the worker have an in-flight stream (a background exec)? Used only for
     // loop.cancel's cancelled=true/false answer; the teardown itself rides the
-    // run signal. Duck-typed like #drainStreamingSchemes.
+    // worker signal. Duck-typed like #drainStreamingSchemes.
     #workerHasActiveStreams(workerId) {
         const exec = this.#schemes.get("exec");
         return exec?.hasActiveSpawns?.(workerId) ?? false;
     }
-    // The contract-routed reap (§worker-lifecycle-total-reap): durable rows enumerate
+    // The contract-routed reap ({§worker-lifecycle-total-reap}): durable rows enumerate
     // every open subscription; the live registry invokes its exact callable owner.
     // The worker signal is only the fast path. An exec mid-spawn or a background exec
     // from a past loop is caught regardless of listener timing. Idempotent — a stream
@@ -1156,29 +1637,27 @@ export default class Daemon {
      * loop needed. Otherwise we open a fresh loop with the synthetic
      * summary as the user prompt so the model gets a chance to react.
      *
-     * Skipped on closeStatus=499 (aborted): the model already knows about
+     * Skipped on result.status=499 (aborted): the model already knows about
      * its own SEND[499], and a forcefully-cancelled loop's spawn-abort
      * shouldn't resurrect into a wake loop (defeats the cancel).
-     *
-     * Rummy parallel: plugins/stream/stream.js stream/completed wake:true.
      */
     async #handleWakeWorker(payload) {
-        // §search-gate — settle the dedup registration: promote on a 200 conclusion, drop on
+        // {§search-gate} — settle the dedup registration: promote on a 200 conclusion, drop on
         // failure (a dead search must never serve as a duplicate). No-op for non-search streams.
-        this.#engine.searchGate.settle(payload.target.replace(/^[a-z+.-]+:\/\//, "/").replace(/^\/+/, "/"), payload.closeStatus);
+        this.#engine.searchGate.settle(payload.target.replace(/^[a-z+.-]+:\/\//, "/").replace(/^\/+/, "/"), payload.result.status);
         // Aborted streams don't wake — the abort was deliberate.
-        if (payload.closeStatus === 499) {
+        if (payload.result.status === 499) {
             this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                 ...payload, wakeAction: "skipped-aborted",
             });
             return;
         }
-        // No resurrection (§worker-lifecycle-no-resurrection): a non-499 completion whose
-        // run was CANCELLED (idle + its scope aborted) must not start a fresh drain —
+        // No resurrection ({§worker-lifecycle-no-resurrection}): a non-499 completion whose
+        // worker was cancelled (idle + its scope aborted) must not start a fresh drain —
         // the cancel was deliberate. The deliverable is already in the channel/log and
-        // surfaces as a `collect` environment delta (§env-delta) if the worker is read or
-        // resumed; we just don't inject a turn. (An active run folds the wake into its
-        // next turn via inject below; a resumed run is active, never aborted, so it is
+        // surfaces as a `collect` environment delta ({§env-delta}) if the worker is read or
+        // resumed; we just don't inject a turn. (An active worker folds the wake into its
+        // next turn via inject below; a resumed worker is active, never aborted, so it is
         // unaffected.)
         const scope = this.#workerAborts.get(payload.workerId);
         if (scope?.signal.aborted === true && !this.#activeDrains.has(payload.workerId)) {
@@ -1189,12 +1668,12 @@ export default class Daemon {
         }
         try {
             const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-            // A slept (202) loop means the worker PARKED ([102]<T>/<-1>) → RESUME it IN PLACE: re-queue
+            // A slept (202) loop means the worker parked via SEND[202] → resume it in place: re-queue
             // it (202→100) so the drain re-claims and CONTINUES it (seq>1 → no re-foist). Checked
             // FIRST: the slept status is the worker's true disposition regardless of a draining
             // sibling mid-teardown (the #ensureDrain lock serializes the re-claim). No fresh loop,
             // no summary-as-prompt — the resumed loop reads the concluded stream's own state from
-            // the manifest. §worker-lifecycle-wake-liveness.
+            // the manifest. {§worker-lifecycle-wake-liveness}.
             const slept = await this.#db.drain_find_slept_loop.get({ worker_id: payload.workerId });
             if (slept !== undefined) {
                 await this.#lifecycle.wake(slept.id);
@@ -1211,7 +1690,7 @@ export default class Daemon {
                 return;
             }
             // No slept loop. A live loop surfaces the concluded stream ambiently via the
-            // environment-observation injector (§exec-stream) on its next turn — there is no prompt
+            // environment-observation injector ({§exec-stream}) on its next turn — there is no prompt
             // to inject and NO task to overwrite. The obsolete "automated environment update"
             // synthesis (which clobbered the model's actual goal) is retired; just tell the client.
             if (this.#activeDrains.has(payload.workerId)) {
@@ -1220,7 +1699,7 @@ export default class Daemon {
                 });
                 return;
             }
-            // No slept loop, no active drain — nothing to resume (e.g. a SEND[200]-done run whose
+            // No slept loop, no active drain — nothing to resume (e.g. a SEND[200]-done worker whose
             // streams were swept). Surface the conclusion without opening a loop.
             this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
                 ...payload, wakeAction: "no-loop",
@@ -1234,8 +1713,8 @@ export default class Daemon {
      * grammar 0.74.20 EXEC `<T,P>` — schedule a hibernation poll-wake. Called when a loop parks at
      * a park; if the worker holds an open polled stream, arm a timer for its tightest cadence P that
      * resumes the slept loop so the model inspects progress. While the loop is ACTIVE there is no
-     * poll work — ambient folded stream deltas already surface progress (§exec-stream); the wake
-     * matters only across hibernation. A wake-edge-less 202 (no polled stream) gets no timer. §exec-poll
+     * poll work — ambient folded stream deltas already surface progress ({§exec-stream}); the wake
+     * matters only across hibernation. A wake-edge-less 202 (no polled stream) gets no timer. {§exec-poll}
      */
     async #schedulePollWake(workspaceId, workerId, systemPrompt) {
         const existing = this.#pollTimers.get(workerId);
@@ -1249,14 +1728,8 @@ export default class Daemon {
             return;
         }
         const pollSec = row?.poll_seconds ?? null;
-        // #521 (§exec-poll, owner-ruled) — the poll cadence for a parked exec stream:
-        //   explicit <,P> (P>0)  → fixed cadence P, reset the backoff (today's behavior).
-        //   explicit <,0>        → poll_seconds=0 stored → blind opt-out (an exec a model wants unwatched).
-        //   absent <,P> + a LIVE stream → EXPONENTIAL BACKOFF (base*2^min(step,turns-1)), so a hung
-        //     exec is no longer park-blind-forever: the model regains a turn every tick to read
-        //     partial output and re-park a slow long-runner or KILL a stuck one (no auto-kill — only
-        //     the model tells a silent deadlock from a silent `cargo build`).
-        //   no open stream at all → nothing to poll (a child-join park is woken by the child terminal).
+        // {§exec-poll} — a positive explicit cadence wins, zero opts out,
+        // and an absent cadence uses the worker's exponential-backoff step.
         let delayMs;
         if (pollSec !== null && pollSec > 0) {
             this.#pollBackoff.delete(workerId);
@@ -1276,7 +1749,7 @@ export default class Daemon {
             this.#pollBackoff.set(workerId, step + 1);
         }
         // Floored by the post-EXEC breath (PLURNK_SERVICE_EXEC_WAIT_MS) so a `<…,1>` can't wake the loop
-        // faster than a turn settles — §exec-poll.
+        // faster than a turn settles — {§exec-poll}.
         const execWaitMs = Number(process.env.PLURNK_SERVICE_EXEC_WAIT_MS ?? "0");
         const timer = setTimeout(() => {
             this.#pollTimers.delete(workerId);
@@ -1286,10 +1759,10 @@ export default class Daemon {
         this.#pollTimers.set(workerId, timer);
     }
     /** Resume `workerId`'s slept (202) loop in place — the same 202→100 resume #handleWakeWorker uses, minus a
-     *  wake payload. The shared wake primitive: a poll cadence (§exec-poll), a watched stream concluding,
-     *  or a child worker finishing (§run-lifecycle topology join) all call this. A no-op if the worker was
+     *  wake payload. The shared wake primitive: a poll cadence ({§exec-poll}), a watched stream concluding,
+     *  or a child worker finishing ({§worker-loop-lifecycle} topology join) all call this. A no-op if the worker was
      *  cancelled or isn't actually parked (no slept loop) — so calling it speculatively is safe. */
-    async #wakeParkedWorker(workspaceId, workerId, systemPrompt) {
+    async #wakeParkedWorker(workspaceId, workerId, systemPrompt, oweIfActive = true) {
         const scope = this.#workerAborts.get(workerId);
         if (scope?.signal.aborted === true && !this.#activeDrains.has(workerId))
             return; // cancelled — no resurrection
@@ -1297,9 +1770,9 @@ export default class Daemon {
         if (slept === undefined) {
             // Not parked. If a drain is still ACTIVE, the worker is mid-turn and about to park — the
             // conclusion that fired this wake arrived before the 202 committed (the conclude-before-park
-            // race). OWE the wake: the drain honors it at park so a worker-run hibernation never deadlocks.
+            // race). Owe the wake: the drain honors it at park so a worker hibernation never deadlocks.
             // (No active drain → already concluded/running; nothing to wake.)
-            if (this.#activeDrains.has(workerId))
+            if (oweIfActive && this.#activeDrains.has(workerId))
                 this.#owedWakes.add(workerId);
             return;
         }
@@ -1313,9 +1786,9 @@ export default class Daemon {
     }
     /** A worker's drain exited. If the worker truly CONCLUDED — no 202-blocked loop, no open stream — then
      *  wake its PARENT in place if the parent is blocked on the join (the structured-concurrency join — a
-     *  child finishing is the wake edge for a parent that waited on it, §worker-lifecycle-child-wake). A worker
+     *  child finishing is the wake edge for a parent that waited on it, {§worker-lifecycle-child-wake}). A worker
      *  blocked at 202, or still holding a stream, is NOT concluded — its own wake edges drive it, not this.
-     *  The parent reads the child's deliverable from its own log (the §worker-scheme-collect delta) on
+     *  The parent reads the child's deliverable from its own log (the {§worker-scheme-collect} delta) on
      *  resume — control edge here, never an injected prompt. Recurses up via the parent's own drain-exit. */
     async #onDrainExit(workspaceId, workerId, systemPrompt) {
         const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
@@ -1326,13 +1799,11 @@ export default class Daemon {
             return; // a stream still runs — its conclusion re-evaluates, not this exit
         const parent = await this.#db.worker_parent_id.get({ worker_id: workerId });
         if (parent?.parent_worker_id == null)
-            return; // a root run — nobody to wake
+            return; // a root worker — nobody to wake
         await this.#wakeParkedWorker(workspaceId, parent.parent_worker_id, systemPrompt);
     }
-    // #506 — a SUBSCRIBER throw must never propagate into engine control flow: a transport
-    // module's bad socket rethrowing through the emitter was the run54/55 death class (an
-    // unhandled rejection in the one then-uncaught dispatch void). The transport's failure is
-    // its own — logged loudly per event, never the engine's crash.
+    // {§methods-event-subscribe} — subscriber failures are transport-local:
+    // log them at this boundary and never re-enter engine control flow.
     #emitTo(workspaceId, method, params) {
         for (const sub of this.#eventSubscribers) {
             try {
@@ -1344,16 +1815,19 @@ export default class Daemon {
         }
     }
     #broadcast(target, method, params) {
-        if (target === "all") {
-            // A global engine event (e.g. workspace/created) — emitted to the seam with workspaceId null (#355).
-            this.#emitTo(null, method, params);
-            return;
-        }
-        // Publish the raw event to the in-process source first (#355) — transport modules subscribe
-        // here (plurnk-agui renders to AG-UI+). Each subscriber owns its own fan-out; core just emits.
-        // Scope-stamping onto the notification envelope (§notifications-envelope-carries-workspaceid)
-        // is each subscriber's edge concern now — the seam hands (workspaceId, method, params) raw.
-        this.#emitTo(target.workspaceId, method, params);
+        observedSync(// {§observability-boundary}
+        "stream.broadcast", { method, ...(target === "all" ? {} : { "workspace.id": target.workspaceId }) }, () => {
+            if (target === "all") {
+                // {§notifications-envelope-carries-workspaceid}: global events carry workspaceId null.
+                this.#emitTo(null, method, params);
+                return;
+            }
+            // {§methods-event-subscribe}: publish to the in-process source; transport modules subscribe
+            // here (plurnk-agui renders to AG-UI+). Each subscriber owns its own fan-out; core just emits.
+            // Scope-stamping onto the notification envelope ({§notifications-envelope-carries-workspaceid})
+            // is each subscriber's edge concern now — the seam hands (workspaceId, method, params) raw.
+            this.#emitTo(target.workspaceId, method, params);
+        });
     }
 }
 //# sourceMappingURL=Daemon.js.map