@plurnk/plurnk-service 1.6.0 → 1.7.0

package/dist/server/Daemon.js

@@ -2,16 +2,13 @@
 // the transport-free plugin-module seam ({§rpc}).
 import { readFile } from "node:fs/promises";
 import { resolve, dirname } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import { execPollBackoffMs } from "./exec-poll-backoff.js";
-import ChannelWrite from "../core/ChannelWrite.js";
-import { Paths } from "../index.js";
+import Paths from "../Paths.js";
 import Engine from "../core/Engine.js";
 import ExecutorRegistry from "../core/ExecutorRegistry.js";
 import SchemeRegistry from "../core/SchemeRegistry.js";
 import { Mimetypes } from "@plurnk/plurnk-mimetypes";
 import { RuntimeDeclaration } from "@plurnk/plurnk-execs";
-import { aggregateProviderAccounting } from "@plurnk/plurnk-providers";
+import DrainSupervisor from "./DrainSupervisor.js";
 import { parsePath, Validator, } from "@plurnk/plurnk-contracts";
 import LogEntry from "./logEntry.js";
 import Envelope from "./envelope.js";
@@ -23,19 +20,15 @@ import Fork from "../core/fork.js";
 import WorkerName from "../core/WorkerName.js";
 import LoopLifecycle from "../core/LoopLifecycle.js";
 import { promptLoopPrefix } from "../core/plurnk-uri.js";
-import { rulerCount } from "../core/token-ruler.js";
+import { contentWeight } from "../core/content-weight.js";
 import { parseAliasesFromEnv, resolveActiveAlias } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "../core/ProviderInstantiate.js";
 import { resolveLoopAlias } from "./loop-model.js";
-import { DEFAULT_LOOP_FLAGS } from "../core/scheme-types.js";
 import LoopFlagsReader from "../core/LoopFlagsReader.js";
 import Results, { OperationFailureError } from "../core/results.js";
 import WorkspaceGate from "../core/WorkspaceGate.js";
 import BranchBatches from "./BranchBatches.js";
-import ErrorDetail from "../core/ErrorDetail.js";
 import { observed, observedSync } from "../observe/spans.js";
-import { LOOP_TERMINALS, recordCounter } from "../observe/metrics.js";
-import { readOptimisticSettlementMs } from "../core/optimistic-settlement.js";
 const clientActionFailure = (error) => {
     if (error instanceof OperationFailureError)
         return error.result;
@@ -53,6 +46,7 @@ export default class Daemon {
     #workspaceGate;
     #branchBatches;
     #lifecycle;
+    #drains;
     #schemes;
     #mimetypes;
     #ownsMimetypes;
@@ -64,44 +58,11 @@ export default class Daemon {
     #modules = [];
     #moduleClosers = [];
     #moduleActions = new Map();
+    #workspaceCapabilityProviders = new Map();
     // {§methods-event-subscribe} — the broadcast's in-process event source. A transport
     // module (plurnk-agui) subscribes and fans out to its OWN clients; core emits, never owns
     // client transport or connection state.
     #eventSubscribers = new Set();
-    // Worker-level drain registry. At most one drain per worker. The stored object
-    // is the drain's identity handle: start/exit compare it by reference so a
-    // drain exiting never clobbers a successor that raced in, and a loop
-    // enqueued during teardown is never stranded. A drain is a pure queue
-    // consumer (claim → run → exit on empty queue); streams live independently
-    // (subscriptions + Exec.idle), and a concluding stream routes through
-    // inject() like any other loop source.
-    #activeDrains = new Map();
-    #drainExitTasks = new Set();
-    // Per-worker cancellation scope. Loops AND the streams they spawn (execs)
-    // share this signal, so loop.cancel / shutdown abort it once and every
-    // in-flight subscription tears down — even a spawn that registers AFTER the
-    // cancel self-aborts against the already-aborted signal (no race). Outlives
-    // any single (ephemeral) drain; replaced with a fresh controller once
-    // aborted so a later runLoop request isn't born cancelled.
-    #workerAborts = new Map();
-    // grammar 0.74.20 EXEC `<T,P>` — per-worker hibernation poll-wake timer. When a loop parks at
-    // a park with a polled stream, a timer fires every P seconds to resume it ({§exec-poll}). One
-    // per worker (the tightest cadence); cleared/replaced on each park and on cancel.
-    #parkTimers = new Map();
-    #pollTimers = new Map();
-    #pollBackoff = new Map(); // {§exec-poll} — backoff step per worker
-    // Per-worker drain-transition lock — see #withDrainLock (R4 / {§worker-lifecycle-single-drain}).
-    #drainLocks = new Map();
-    // {§worker-lifecycle-child-wake} — workers owed a wake: a child/stream conclusion fired while the worker was
-    // mid-turn (not yet slept), so #wakeParkedWorker could not resume it. A child-worker conclusion is a
-    // BOUNDED, lossless wake (a worker always concludes), so a hibernation awaiting one MUST return —
-    // never deadlock. The drain honors the owed wake at the worker's next park, closing the conclude-
-    // before-park race. (Only a live exec stream, unbounded absent a timeout, may hold a park open.)
-    #owedWakes = new Set();
-    // {§worker-optimistic-settlement} — one non-sliding completion-wake batch
-    // per worker. Durable conclusions and client events land before this gate;
-    // only the parked loop's provider-dispatch requeue waits.
-    #completionWakeGates = new Map();
     constructor({ db, schemes, mimetypes, provider, nodeModulesPath, }) {
         this.#db = db;
         this.#lifecycle = new LoopLifecycle(db);
@@ -149,7 +110,7 @@ export default class Daemon {
                     }))?.id;
                 if (workerId === undefined)
                     throw new Error("Branch worker insert returned no row");
-                const loopId = await this.#enqueueFreshLoop({
+                const loopId = await this.#drains.enqueueFreshLoop({
                     workerId,
                     prompt,
                     providerSpec,
@@ -160,7 +121,7 @@ export default class Daemon {
             },
             startChild: async (workspaceId, workerId, loopId) => {
                 const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-                const started = await this.#ensureDrain({ workspaceId, workerId, systemPrompt });
+                const started = await this.#drains.ensureDrain({ workspaceId, workerId, systemPrompt });
                 if (started === null)
                     throw new Error(`Branch worker ${workerId} already has a live drain`);
                 const result = await started.firstLoopPromise;
@@ -171,7 +132,7 @@ export default class Daemon {
             },
             wakeParent: async (workspaceId, workerId) => {
                 const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-                await this.#settleCompletionWake(workspaceId, workerId, systemPrompt, false);
+                await this.#drains.settleCompletionWake(workspaceId, workerId, systemPrompt, false);
             },
             notify: (workspaceId, payload) => {
                 this.#broadcast({ workspaceId }, "workspace/branch-batch", payload);
@@ -179,13 +140,12 @@ export default class Daemon {
         });
         this.#engine = new Engine({
             db, schemes: this.#schemes, mimetypes: this.#mimetypes,
-            // {§tokenomics-agnostic-ruler} — the ONE model-facing token ruler (chars/2), NOT the
-            // boot provider: token accounting is workspace-wide across many concurrent models, so
-            // the write-time + catalog counts must be model-independent. Exact per-model counting
-            // lives only at the packet-materialization fit-gate.
-            tokenize: rulerCount,
+            // {§tokenomics-agnostic-ruler} — stored and catalog curation weights
+            // are workspace-wide across concurrent models, so they remain
+            // model-independent. Request-shaped token facts stay provider-owned.
+            weigh: contentWeight,
             streamEventNotify: (workspaceId, event) => this.notifyStreamEvent(workspaceId, event),
-            wakeWorkerNotify: (payload) => { void this.#handleWakeWorker(payload); },
+            wakeWorkerNotify: (payload) => this.#drains.notifyWakeWorker(payload),
             // worker:// loop-start primitive — spawn/fork/irc deliver through
             // Daemon.inject (active sister → fold; idle → enqueue + drain). The
             // daemon owns provider + the law-file system prompt; the worker scheme
@@ -218,16 +178,68 @@ export default class Daemon {
             workspaceTurnCompleted: async ({ turnId }) => this.#branchBatches.sealTurn(turnId),
             // worker:// KILL (terminate) — cancel the addressed worker subtree and
             // tear down its held streams before the operation completes.
-            cancelWorker: async (workerId, reason) => this.#cancelWorkerTree(workerId, reason),
-            cancelDescendants: async (workerId, reason) => this.#cancelTree(workerId, reason, false),
+            cancelWorker: async (workerId, reason) => this.#drains.cancelWorkerTree(workerId, reason),
+            cancelDescendants: async (workerId, reason) => this.#drains.cancelDescendants(workerId, reason),
             noticeNotify: (workspaceId, payload) => this.notifyNotice(workspaceId, payload),
         });
+        this.#drains = new DrainSupervisor({
+            db,
+            lifecycle: this.#lifecycle,
+            injectPrompt: (workerId, prompt, openPaths) => this.#engine.inject(workerId, prompt, openPaths),
+            assertInjectionCompatibility: async ({ workerId, loopId, providerSpec, childProviderSpec, turnCeiling, flags, }) => {
+                await this.#assertFoldPosture(workerId, flags, loopId);
+                await this.#assertLoopProvider(loopId, providerSpec);
+                if (childProviderSpec !== undefined) {
+                    await this.#assertLoopChildProvider(loopId, childProviderSpec);
+                }
+                await this.#assertLoopMaxTurns(loopId, turnCeiling?.source === "explicit" ? turnCeiling.effective : undefined);
+            },
+            reconcilePrompts: (workerId, endedLoopId) => this.#reconcileOrphanedPrompts(workerId, endedLoopId),
+            runLoop: async ({ workspaceId, workerId, loopId, maxTurns, prompt, systemPrompt, signal, onDispatch, }) => {
+                const { provider, childProvider } = await this.#providersForLoop(loopId);
+                return this.#engine.runLoop({
+                    provider,
+                    childProvider,
+                    workspaceId,
+                    workerId,
+                    loopId,
+                    maxTurns,
+                    messages: [
+                        { role: "system", content: systemPrompt },
+                        { role: "user", content: prompt },
+                    ],
+                    origin: "model",
+                    signal,
+                    onDispatch,
+                });
+            },
+            loopUsage: (loopId) => this.#engine.loopUsage(loopId),
+            loopAttributions: (loopId) => this.#engine.loopAttributions(loopId),
+            takeParkDeadline: (loopId) => {
+                const deadline = this.#engine.parkDeadlines.get(loopId);
+                this.#engine.parkDeadlines.delete(loopId);
+                return deadline;
+            },
+            settleSearch: (target, status) => this.#engine.searchGate.settle(target, status),
+            cancelSubscription: (subscriptionId) => this.#engine.cancelSubscription(subscriptionId),
+            hasActiveStreams: (workerId) => this.#workerHasActiveStreams(workerId),
+            readSystemPrompt: () => readFile(Paths.instructionsSystem, "utf8"),
+            emitLogEntry: async (workspaceId, logEntryId) => {
+                const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
+                this.#broadcast({ workspaceId }, "log/entry", { entry });
+            },
+            emit: (workspaceId, method, params) => this.#broadcast({ workspaceId }, method, params),
+        });
         // Wire proposal-pending events to the loop/proposal WS notification.
         // Sessionid scopes the broadcast to clients on the same workspace.
         this.#engine.onProposalPending((event) => {
             const { workspaceId, ...proposal } = event;
             this.#broadcast({ workspaceId }, "loop/proposal", proposal);
         });
+        this.#engine.onClientInteractionPending((event) => {
+            const { workspaceId, ...interaction } = event;
+            this.#broadcast({ workspaceId }, "loop/interaction", interaction);
+        });
     }
     // {§methods-event-subscribe}. A transport module subscribes to the daemon's in-process
     // event source: it receives every workspace-scoped engine event as `(workspaceId, method, params)`
@@ -251,6 +263,15 @@ export default class Daemon {
         const checkedResolution = ClientInput.assertProposalResolution("resolveProposal", resolution);
         this.#engine.resolveProposal(checkedLogEntryId, checkedResolution);
     }
+    async pendingClientInteractions(workspaceId) {
+        const checkedWorkspaceId = ClientInput.assertId("pendingClientInteractions", "workspaceId", workspaceId);
+        return this.#engine.pendingClientInteractions(checkedWorkspaceId);
+    }
+    async resolveClientInteraction(interactionId, resolution) {
+        const checkedInteractionId = ClientInput.assertId("resolveClientInteraction", "interactionId", interactionId);
+        const checkedResolution = ClientInput.assertClientInteractionResolution("resolveClientInteraction", resolution);
+        await this.#engine.resolveClientInteraction(checkedInteractionId, checkedResolution);
+    }
     // {§methods-loop-run} — drive/steer a loop. The module supplies only workspace/worker/prompt;
     // the provider and the law-file system prompt are core's and stay inside. Returns immediately — the
     // loop runs async and its outcome arrives on the event source (loop/terminated). `cancelDrain` (public)
@@ -615,9 +636,7 @@ export default class Daemon {
                 const isActive = active !== null && active.alias === a.alias;
                 return {
                     alias: a.alias, provider: a.provider, model: a.model, active: isActive,
-                    // The same effective model-facing budget loop usage reports, including
-                    // optional virtual pressure; known for the active alias, null elsewhere.
-                    promptBudget: isActive && this.#provider !== null ? this.#engine.promptBudgetFor(this.#provider) : null,
+                    inputCapacity: isActive && this.#provider !== null ? this.#provider.inputCapacity : null,
                 };
             }),
         };
@@ -694,6 +713,9 @@ export default class Daemon {
             }
             if (constraints.length > 0)
                 await GitMembership.resolveGitMembership(this.#db, envelope.workspaceId, undefined);
+            for (const provider of this.#workspaceCapabilityProviders.values()) {
+                await provider.hydrate(envelope.workspaceId);
+            }
             await LoopDocs.materialize(this.#engine, this.#db, envelope.workspaceId);
             void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
             this.#broadcast("all", "workspace/created", { id: envelope.workspaceId, name: envelope.workspaceName, projectRoot: envelope.projectRoot });
@@ -860,7 +882,7 @@ export default class Daemon {
                     contentOffset: c.contentOffset,
                     contentLength: c.contentLength,
                     mimetype: c.mimetype,
-                    tokens: c.tokens,
+                    weight: c.weight,
                     state: c.state,
                 };
             }
@@ -923,26 +945,18 @@ export default class Daemon {
         const branch = await this.#db.envelope_get_worker_by_id.get({ id: branchWorkerId });
         return { workerId: branchWorkerId, workerName: branch?.name ?? null, parentWorkerId: workerId };
     }
-    async registerRuntime({ namespaceOwner, decl, executor, availability, scheme }) {
-        if (typeof namespaceOwner !== "string" || namespaceOwner.trim().length === 0) {
-            throw new Error("registerRuntime: namespaceOwner must be a non-empty string");
-        }
-        const runtime = RuntimeDeclaration.assert(decl, namespaceOwner);
-        this.#engine.registerRuntime(runtime.name, {
-            executor,
-            namespaceOwner: { kind: "module", name: namespaceOwner },
-            glyph: runtime.glyph ?? "",
-            invocation: runtime.invocation,
-            documentation: runtime.documentation ?? "",
-            available: availability.available,
-            detail: availability.detail,
-        }, scheme);
+    async registerRuntimes(registrations) {
+        const normalized = registrations.map((registration) => this.#normalizeRuntime(registration));
+        this.#engine.registerRuntimes(normalized);
         if (this.#capabilitiesPublished) {
             for (const workspace of await Envelope.listWorkspaces(this.#db)) {
                 await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
             }
         }
     }
+    async registerRuntime(registration) {
+        await this.registerRuntimes([registration]);
+    }
     async registerScheme(name, handler) {
         this.#schemes.register(name, handler);
         if (this.#capabilitiesPublished) {
@@ -952,21 +966,172 @@ export default class Daemon {
             }
         }
     }
-    registerModuleAction(name, handler) {
+    #normalizeRuntime({ namespaceOwner, decl, executor, availability, scheme }) {
+        if (typeof namespaceOwner !== "string" || namespaceOwner.trim().length === 0) {
+            throw new Error("runtime registration namespaceOwner must be a non-empty string");
+        }
+        const runtime = RuntimeDeclaration.assert(decl, namespaceOwner);
+        return {
+            tag: runtime.name,
+            entry: {
+                executor,
+                namespaceOwner: { kind: "module", name: namespaceOwner },
+                glyph: runtime.glyph ?? "",
+                invocation: runtime.invocation,
+                documentation: runtime.documentation ?? "",
+                available: availability.available,
+                detail: availability.detail,
+            },
+            scheme,
+        };
+    }
+    registerModuleAction(registration) {
+        const { name, scope, handler } = registration;
         if (name.length === 0)
             throw new Error("registerModuleAction: action name must not be empty");
+        if (scope !== "worldless" && scope !== "workspace") {
+            throw new Error(`module action '${name}' has invalid scope '${String(scope)}'`);
+        }
+        if (typeof handler !== "function")
+            throw new Error(`module action '${name}' has no handler`);
         if (this.#moduleActions.has(name))
             throw new Error(`module action '${name}' is already registered`);
-        this.#moduleActions.set(name, handler);
+        this.#moduleActions.set(name, registration);
     }
     listModuleActions() {
-        return [...this.#moduleActions.keys()].toSorted();
+        return [...this.#moduleActions.values()]
+            .map(({ name, scope }) => ({ name, scope }))
+            .toSorted((left, right) => left.name.localeCompare(right.name));
     }
-    async invokeModuleAction(name, params) {
-        const handler = this.#moduleActions.get(name);
-        if (handler === undefined)
+    async invokeModuleAction(name, params, context) {
+        const registration = this.#moduleActions.get(name);
+        if (registration === undefined)
             throw new Error(`module action '${name}' is not registered`);
-        return handler(params);
+        if (registration.scope !== context.scope) {
+            throw new Error(`module action '${name}' requires ${registration.scope} context, not ${context.scope}`);
+        }
+        if (context.scope === "workspace") {
+            ClientInput.assertId(`module action '${name}'`, "workspaceId", context.workspaceId);
+        }
+        return registration.handler(params, context);
+    }
+    registerWorkspaceCapabilityProvider(namespaceOwner, provider) {
+        if (namespaceOwner.trim().length === 0) {
+            throw new Error("workspace capability provider requires a non-empty namespace owner");
+        }
+        if (this.#workspaceCapabilityProviders.has(namespaceOwner)) {
+            throw new Error(`workspace capability provider '${namespaceOwner}' is already registered`);
+        }
+        this.#workspaceCapabilityProviders.set(namespaceOwner, provider);
+    }
+    async readWorkspaceModuleState(workspaceId, namespaceOwner) {
+        const checkedWorkspaceId = ClientInput.assertId("workspace module state", "workspaceId", workspaceId);
+        if (namespaceOwner.trim().length === 0) {
+            throw new Error("workspace module state requires a non-empty namespace owner");
+        }
+        const row = await this.#db.workspace_module_state_get.get({
+            workspace_id: checkedWorkspaceId,
+            namespace_owner: namespaceOwner,
+        });
+        return row === undefined ? null : JSON.parse(row.state);
+    }
+    async replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes, }) {
+        const checkedWorkspaceId = ClientInput.assertId("workspace capability replacement", "workspaceId", workspaceId);
+        if (namespaceOwner.trim().length === 0) {
+            throw new Error("workspace capability replacement requires a non-empty namespace owner");
+        }
+        const workspace = await this.#db.envelope_get_workspace.get({ id: checkedWorkspaceId });
+        if (workspace === undefined) {
+            throw daemonFailure("daemon:workspace-capability", "workspace-not-found", 404, `Workspace ${checkedWorkspaceId} does not exist.`, { workspaceId: checkedWorkspaceId, retryable: false });
+        }
+        const encoded = state === null ? null : JSON.stringify(state);
+        if (state !== null && encoded === undefined) {
+            throw daemonFailure("daemon:workspace-capability", "state-not-json", 400, "Workspace module state is not JSON-serializable.", { namespaceOwner, retryable: false });
+        }
+        if (encoded !== null)
+            JSON.parse(encoded);
+        const normalized = runtimes.map((registration) => {
+            if (registration.namespaceOwner !== namespaceOwner) {
+                throw new Error(`workspace runtime owner '${registration.namespaceOwner}' does not match '${namespaceOwner}'`);
+            }
+            return this.#normalizeRuntime(registration);
+        });
+        const gate = this.#workspaceGate.tryExclusive(checkedWorkspaceId);
+        if (gate === null) {
+            throw daemonFailure("daemon:workspace-capability", "workspace-busy", 409, `Workspace ${checkedWorkspaceId} is running an operation or another capability change.`, {
+                workspaceId: checkedWorkspaceId,
+                namespaceOwner,
+                recovery: "Settle the current operation and retry the capability change.",
+                retryable: true,
+            });
+        }
+        await gate.acquired;
+        const prior = await this.#db.workspace_module_state_get.get({
+            workspace_id: checkedWorkspaceId,
+            namespace_owner: namespaceOwner,
+        });
+        let rollbackRuntimes;
+        let stateChanged = false;
+        try {
+            const commitRuntimes = await this.#engine.prepareWorkspaceRuntimes(checkedWorkspaceId, namespaceOwner, normalized);
+            if (encoded === null) {
+                await this.#db.workspace_module_state_delete.run({
+                    workspace_id: checkedWorkspaceId,
+                    namespace_owner: namespaceOwner,
+                });
+            }
+            else {
+                await this.#db.workspace_module_state_put.run({
+                    workspace_id: checkedWorkspaceId,
+                    namespace_owner: namespaceOwner,
+                    state: encoded,
+                });
+            }
+            stateChanged = true;
+            rollbackRuntimes = commitRuntimes();
+            if (this.#capabilitiesPublished) {
+                await LoopDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
+            }
+        }
+        catch (cause) {
+            rollbackRuntimes?.();
+            const rollbackErrors = [];
+            if (stateChanged) {
+                try {
+                    if (prior === undefined) {
+                        await this.#db.workspace_module_state_delete.run({
+                            workspace_id: checkedWorkspaceId,
+                            namespace_owner: namespaceOwner,
+                        });
+                    }
+                    else {
+                        await this.#db.workspace_module_state_put.run({
+                            workspace_id: checkedWorkspaceId,
+                            namespace_owner: namespaceOwner,
+                            state: prior.state,
+                        });
+                    }
+                }
+                catch (rollbackCause) {
+                    rollbackErrors.push(rollbackCause);
+                }
+                if (this.#capabilitiesPublished) {
+                    try {
+                        await LoopDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
+                    }
+                    catch (rollbackCause) {
+                        rollbackErrors.push(rollbackCause);
+                    }
+                }
+            }
+            if (rollbackErrors.length > 0) {
+                throw new AggregateError([cause, ...rollbackErrors], "Workspace capability replacement and rollback failed");
+            }
+            throw cause;
+        }
+        finally {
+            gate.release();
+        }
     }
     get engine() { return this.#engine; }
     get provider() { return this.#provider; }
@@ -981,6 +1146,7 @@ export default class Daemon {
         if (this.#started)
             throw new Error("daemon already started");
         this.#started = true;
+        this.#drains.start();
         // Mimetypes owns its own discovery scan over @plurnk/plurnk-mimetypes-*
         // packages; pre-warm it so first index render doesn't pay the cost.
         await this.#mimetypes.ready();
@@ -1005,6 +1171,11 @@ export default class Daemon {
                 this.#moduleClosers.push(module);
             await module.setup?.(setupSeam);
         }
+        for (const workspace of await Envelope.listWorkspaces(this.#db)) {
+            for (const provider of this.#workspaceCapabilityProviders.values()) {
+                await provider.hydrate(workspace.id);
+            }
+        }
         await this.#schemes.ready();
         // Reconcile the kernel-published documentation surface once per existing workspace.
         // Installed capabilities and operator configuration are now fully known; model loops
@@ -1028,18 +1199,19 @@ export default class Daemon {
         await this.#db.recovery_settle_open_provider_requests.run({});
         await this.#db.recovery_fail_open_model_calls.run({});
         await this.#db.recovery_fail_ownerless_proposals.run({});
+        await this.#db.recovery_remove_ownerless_client_interactions.run({});
         await this.#db.recovery_error_orphan_subscription_channels.run({});
         await this.#db.recovery_fail_orphan_subscriptions.run({});
         await this.#db.recovery_resume_unblocked_parks.run({});
         await this.#branchBatches.recover();
         const orphanSources = await this.#db.recovery_orphan_prompt_sources.all({});
         for (const source of orphanSources) {
-            await this.#reconcileOrphanedPrompts(source.worker_id, source.loop_id);
+            await this.#drains.reconcileOrphanedPrompts(source.worker_id, source.loop_id);
         }
         const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
         const queued = await this.#db.recovery_queued_workers.all({});
         for (const row of queued) {
-            const started = await this.#ensureDrain({
+            const started = await this.#drains.ensureDrain({
                 workspaceId: row.workspace_id,
                 workerId: row.worker_id,
                 systemPrompt,
@@ -1050,7 +1222,7 @@ export default class Daemon {
         }
         const parked = await this.#db.recovery_parked_workers.all({});
         for (const row of parked) {
-            await this.#schedulePollWake(row.workspace_id, row.worker_id, systemPrompt);
+            await this.#drains.schedulePollWake(row.workspace_id, row.worker_id, systemPrompt);
         }
     }
     async stop() {
@@ -1064,8 +1236,8 @@ export default class Daemon {
             .toReversed()
             .map((module) => Promise.resolve().then(() => module.close())));
         this.#moduleClosers = [];
-        // Drain order: (1) abort in-flight loops via #activeDrains so
-        // strike paths don't keep going, (2) await each drain's promise
+        // Drain order: (1) tell the supervisor to abort worker scopes so
+        // strike paths don't keep going, (2) await its active drains
         // to completion, (3) drain streaming schemes' background work
         // (exec spawn cleanup, channel writes). Only THEN close the DB
         // upstream — drain queries hit the DB right up until they exit.
@@ -1080,24 +1252,9 @@ export default class Daemon {
         this.#engine.cancelAllProposals("daemon_stopping");
         this.#engine.cancelDerivations(derivationAbort);
         this.#branchBatches.beginStop();
-        for (const scope of this.#workerAborts.values()) {
-            if (!scope.signal.aborted)
-                scope.abort("daemon_stopping");
-        }
-        for (const t of this.#pollTimers.values())
-            clearTimeout(t); // drop pending hibernation poll-wakes
-        this.#pollBackoff.clear();
-        this.#pollTimers.clear();
-        // Cancel park-deadline timers before DB close; otherwise a late #wakeParkedWorker would run after
-        // stop/db-close if left pending — an unhandled rejection (SqlRite closed) that abnormally
-        // exits the worker under load. Symmetric with the poll-wakes above; both must be reaped.
-        for (const t of this.#parkTimers.values())
-            clearTimeout(t);
-        this.#parkTimers.clear();
+        this.#drains.beginStop("daemon_stopping");
         await this.#branchBatches.idle();
-        const drainPromises = [...this.#activeDrains.values()].map((d) => d.promise);
-        await Promise.allSettled(drainPromises);
-        await Promise.allSettled([...this.#drainExitTasks]);
+        const [drainResult] = await Promise.allSettled([this.#drains.idle()]);
         const closeResults = await moduleClose;
         const [streamingResult] = await Promise.allSettled([this.#drainStreamingSchemes()]);
         const [derivationResult] = await Promise.allSettled([
@@ -1107,7 +1264,19 @@ export default class Daemon {
             ? await Promise.allSettled([this.#mimetypes.dispose()])
             : [];
         const [schemeResult] = await Promise.allSettled([this.#schemes.close()]);
-        const closeErrors = [...closeResults, streamingResult, derivationResult, ...mimetypeResults, schemeResult]
+        // Streaming and scheme closure are the last producers of synchronous
+        // conclusion notifications. Join the supervisor-owned async tails only
+        // after those producers settle, before the caller may close SQLite.
+        const [wakeResult] = await Promise.allSettled([this.#drains.idle()]);
+        const closeErrors = [
+            ...closeResults,
+            drainResult,
+            streamingResult,
+            derivationResult,
+            ...mimetypeResults,
+            schemeResult,
+            wakeResult,
+        ]
             .filter((result) => result.status === "rejected")
             .flatMap((result) => result.reason instanceof AggregateError
             ? [...result.reason.errors]
@@ -1136,18 +1305,6 @@ export default class Daemon {
     notifyNotice(workspaceId, payload) {
         this.#broadcast({ workspaceId }, "notice/event", payload);
     }
-    /**
-     * Inject a prompt into a worker. Two paths:
-     *   - Active drain: writes the next prompt:///<loop>/<N> entry via
-     *     Engine.inject. The current loop publishes it at its next
-     *     turn. Returns immediately with {action: "injected_next_turn"}.
-     *   - No active drain: enqueues a fresh loop with the prompt at
-     *     status=100, starts a drain. Returns the drain promise so the
-     *     caller can await full completion.
-     *
-     * Both `runLoop` and wake-on-completion go through this method
-     * ({§actor-boundary-passive-wake}).
-     */
     // {§methods-loop-run-fold-consistency} — a folded prompt cannot reconfigure its loop.
     async #assertFoldPosture(workerId, flags, loopId) {
         if (flags === undefined || Object.keys(flags).length === 0)
@@ -1168,810 +1325,56 @@ export default class Daemon {
             });
         }
     }
-    async inject(args) {
-        const { workspaceId, workerId, prompt } = args;
-        // Active loop (status=102)? Fold the wake/prompt into its next turn.
-        // engine.inject returns null when no loop is currently executing, so
-        // we enqueue a fresh loop below and ensure a drain claims it.
-        if (this.#activeDrains.has(workerId)) {
-            const active = await this.#db.drain_current_loop_for_worker.get({ worker_id: workerId });
-            if (active !== undefined) {
-                await this.#assertFoldPosture(workerId, args.flags, active.id); // compare with the exact durable loop
-                await this.#assertLoopProvider(active.id, args.providerSpec);
-                if (args.childProviderSpec !== undefined)
-                    await this.#assertLoopChildProvider(active.id, args.childProviderSpec);
-                await this.#assertLoopMaxTurns(active.id, args.turnCeiling?.source === "explicit" ? args.turnCeiling.effective : undefined);
-            }
-            const result = await this.#engine.inject(workerId, prompt, args.openPaths ?? []);
-            if (result !== null) {
-                return { action: "injected_next_turn", loopId: result.loopId, turnSeq: result.turnSeq };
-            }
-        }
-        // {§worker-lifecycle-wake-requeue-not-terminal} — a worker parked at 202 resumes that loop in place:
-        // is a wake edge like a stream/child conclusion, not a fresh loop that orphans the parked one
-        // (which would leave the worker non-quiescent forever). engine.inject writes the message as the
-        // slept loop's next-turn prompt (the directed message — distinct from the env door, which
-        // resumes promptless); then re-queue + drain it. {§worker-lifecycle-wake-liveness}.
-        if (!this.#activeDrains.has(workerId)) {
-            const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-            if (slept !== undefined) {
-                await this.#assertFoldPosture(workerId, args.flags, slept.id); // resume drops nothing silently
-                await this.#assertLoopProvider(slept.id, args.providerSpec);
-                if (args.childProviderSpec !== undefined)
-                    await this.#assertLoopChildProvider(slept.id, args.childProviderSpec);
-                await this.#assertLoopMaxTurns(slept.id, args.turnCeiling?.source === "explicit" ? args.turnCeiling.effective : undefined);
-                const injected = await this.#engine.inject(workerId, prompt, args.openPaths ?? []);
-                await this.#lifecycle.wake(slept.id);
-                const started = await this.#ensureDrain({
-                    workspaceId, workerId, systemPrompt: args.systemPrompt,
-                });
-                return { action: "injected_next_turn", loopId: slept.id, ...(injected?.turnSeq !== undefined ? { turnSeq: injected.turnSeq } : {}), ...(started ?? {}) };
-            }
-        }
-        const loopId = await this.#enqueueFreshLoop({
-            workerId,
-            prompt,
-            providerSpec: args.providerSpec,
-            childProviderSpec: args.childProviderSpec ?? null,
-            maxTurns: args.turnCeiling?.effective,
-            flags: args.flags,
-            openPaths: args.openPaths,
-        });
-        // Guarantee a drain claims the loop we just enqueued. #ensureDrain runs its
-        // check-and-start UNDER the per-worker drain lock ({§worker-lifecycle-single-drain}),
-        // serialized against a draining sibling's teardown relinquish so the two can't
-        // both register a drain (R4). A live drain re-claims the loop in its own
-        // iteration or its lock-held exit re-claim, so it's never stranded.
-        // firstLoopPromise is present only when THIS call started the drain — runLoop
-        // keys its fast-path response on that.
-        const started = await this.#ensureDrain({
-            workspaceId, workerId, systemPrompt: args.systemPrompt,
-        });
-        return { action: "enqueued_new_loop", loopId, ...(started ?? {}) };
-    }
-    async #enqueueFreshLoop(args) {
-        // {§worker-lifecycle-single-drain}: sequence allocation and insertion
-        // are one queue mutation; another accepted prompt cannot claim the gap.
-        return this.#withDrainLock(args.workerId, async () => {
-            const seqRow = await this.#db.loop_run_next_sequence.get({
-                worker_id: args.workerId,
-            });
-            if (seqRow === undefined)
-                throw new Error("enqueueFreshLoop: next-sequence query returned no row");
-            const loopRow = await this.#db.drain_enqueue_loop.get({
-                worker_id: args.workerId,
-                sequence: seqRow.next,
-                prompt: args.prompt,
-                provider_spec: JSON.stringify(args.providerSpec),
-                child_provider_spec: JSON.stringify(args.childProviderSpec),
-                max_turns: args.maxTurns ?? Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "50"),
-            });
-            if (loopRow === undefined)
-                throw new Error("enqueueFreshLoop: loop enqueue returned no row");
-            if (args.flags !== undefined) {
-                await this.#db.engine_set_loop_flags.run({
-                    loop_id: loopRow.id,
-                    flags: JSON.stringify({ ...DEFAULT_LOOP_FLAGS, ...args.flags }),
-                });
-            }
-            if (args.openPaths !== undefined && args.openPaths.length > 0) {
-                await this.#db.engine_set_loop_open_paths.run({
-                    loop_id: loopRow.id,
-                    open_paths: JSON.stringify(args.openPaths),
-                });
-            }
-            return loopRow.id;
-        });
+    inject(args) {
+        return this.#drains.inject(args);
     }
-    /**
-     * Start a drain for the given worker. The drain claims queued loops via
-     * drain_claim_next_loop (atomic 100→102 flip), executes each via
-     * Engine.runLoop, and re-checks. Stream-aware: when the queue is empty
-     * but the worker has active subscriptions, the drain parks on a
-     * #drainPokes signal — wake-on-completion → inject() wakes it. Drain
-     * exits when queue is empty AND no active subscriptions remain.
-     *
-     * Returns both `firstLoopPromise` (resolves once the first loop the
-     * drain processes completes — used by runLoop to give the caller a
-     * fast response containing their loop's result) and `drainPromise`
-     * (resolves only when the whole drain finishes, queue+subs settled).
-     */
-    #startDrain(opts) {
-        const { workspaceId, workerId, systemPrompt } = opts;
-        // The drain runs under the worker's cancellation scope (shared with the
-        // execs its loops spawn), so loop.cancel/shutdown abort it as a unit.
-        const controller = this.#workerSignal(workerId);
-        const handle = {
-            controller, promise: Promise.resolve(),
-        };
-        let resolveFirst = () => { };
-        let rejectFirst = () => { };
-        const firstLoopPromise = new Promise((res, rej) => {
-            resolveFirst = res;
-            rejectFirst = rej;
-        });
-        let firstSettled = false;
-        const claim = () => this.#db.drain_claim_next_loop.get({ worker_id: workerId });
-        const drainPromise = (async () => {
-            let loopsDrained = 0;
-            let lastResult = null;
-            let currentLoopId = null; // the loop being drained — for abort→499 settlement
-            try {
-                while (true) {
-                    controller.signal.throwIfAborted();
-                    let loopRow = await claim();
-                    if (loopRow === undefined) {
-                        // Queue empty → teardown UNDER the per-worker drain lock (R4 / I1),
-                        // serialized against #ensureDrain so a concurrent inject can't
-                        // start a 2nd drain in the gap. Re-claim while holding the lock;
-                        // relinquish the registry slot only if it's empty too. A loop
-                        // that raced in is returned and run — we stay registered, so
-                        // there's no transient delete for #ensureDrain to catch.
-                        loopRow = await this.#withDrainLock(workerId, async () => {
-                            const claimed = await claim();
-                            if (claimed === undefined && this.#activeDrains.get(workerId) === handle) {
-                                this.#activeDrains.delete(workerId);
-                            }
-                            return claimed;
-                        });
-                        if (loopRow === undefined)
-                            break;
-                    }
-                    currentLoopId = loopRow.id;
-                    // {§methods-loop-run-model} — provider identity belongs to the claimed loop, not the
-                    // drain that happened to claim it. A drain can consume multiple
-                    // queued loops; resolve each durable selection at this boundary.
-                    const { provider, childProvider } = await this.#providersForLoop(loopRow.id);
-                    const onDispatch = (logEntryId) => {
-                        // {§methods-event-subscribe} — a log-broadcast failure must never crash the drain.
-                        void (async () => {
-                            const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
-                            this.#broadcast({ workspaceId }, "log/entry", { entry });
-                        })().catch((e) => console.error("log/entry broadcast failed:", e instanceof Error ? e.message : String(e)));
-                    };
-                    const result = await observed(// {§observability-boundary}
-                    "loop.run", { workspaceId, workerId, "loop.id": loopRow.id }, async (span) => {
-                        const loopResult = await this.#engine.runLoop({
-                            provider, childProvider, workspaceId, workerId, loopId: loopRow.id, maxTurns: loopRow.max_turns,
-                            messages: [
-                                { role: "system", content: systemPrompt },
-                                { role: "user", content: loopRow.prompt },
-                            ],
-                            origin: "model",
-                            onDispatch,
-                            signal: controller.signal,
-                        });
-                        span.setAttribute("status", loopResult.result.status);
-                        recordCounter(LOOP_TERMINALS, { status: loopResult.result.status });
-                        return loopResult;
-                    });
-                    if (result.result.status === 202) {
-                        // The loop slept via SEND signal 202 — suspended, not terminated. Leave it at 202
-                        // (resumable); no loop/terminated, no orphan-reconcile. A stream conclusion
-                        // (#handleWakeWorker) re-queues it; and if it holds a polled stream, a poll timer
-                        // wakes it every P to inspect ({§exec-poll}). {§worker-lifecycle-wake-liveness}.
-                        void this.#schedulePollWake(workspaceId, workerId, systemPrompt).catch((err) => console.error("poll-wake scheduling failed:", err instanceof Error ? err.message : String(err)));
-                        // {§send-premature-terminate}/scoped SEND signal 202 — the park deadline:
-                        // dispatcher recorded the marker's seconds; a bounded park is woken at T
-                        // regardless of arrivals, so a park always has a next turn. -1 (indefinite:
-                        // the butler, a [300] ask) schedules nothing — irc/inject/conclusions wake it.
-                        // In-memory: a daemon restart drops pending deadlines.
-                        if (currentLoopId !== null) {
-                            const deadline = this.#engine.parkDeadlines.get(currentLoopId);
-                            this.#engine.parkDeadlines.delete(currentLoopId);
-                            const prior = this.#parkTimers.get(workerId);
-                            if (prior !== undefined) {
-                                clearTimeout(prior);
-                                this.#parkTimers.delete(workerId);
-                            }
-                            if (deadline !== undefined && deadline > 0) {
-                                const t = setTimeout(() => {
-                                    this.#parkTimers.delete(workerId);
-                                    void this.#wakeParkedWorker(workspaceId, workerId, systemPrompt).catch((err) => console.error("park-deadline wake failed:", err instanceof Error ? err.message : String(err)));
-                                }, deadline * 1000);
-                                t.unref();
-                                this.#parkTimers.set(workerId, t);
-                            }
-                        }
-                        // Honor an OWED wake ({§worker-lifecycle-child-wake}): a child/stream concluded while
-                        // this worker was mid-turn, before it slept — resume in place rather than park blind,
-                        // so a worker hibernation always returns. The loop is 202 here; reset to
-                        // claimable and the drain re-runs it on the next claim below.
-                        if (this.#owedWakes.delete(workerId)) {
-                            await this.#lifecycle.wake(loopRow.id);
-                            currentLoopId = null;
-                            continue;
-                        }
-                        // The loop is blocked at 202 on a live obligation ({§wait-obligation-matrix});
-                        // that obligation's conclusion is its wake edge (the owed-wake above covers the
-                        // conclude-before-block race). An idle wait never reaches here — it concluded at dispatch.
-                        currentLoopId = null;
-                        continue;
-                    }
-                    this.#owedWakes.delete(workerId); // the loop concluded (non-202) — no park to honor a held wake at
-                    const [usage, attributions, turnIds] = await Promise.all([
-                        this.#engine.loopUsage(loopRow.id),
-                        this.#engine.loopAttributions(loopRow.id),
-                        this.#lifecycle.turnIds(loopRow.id),
-                    ]);
-                    this.#broadcast({ workspaceId }, "loop/terminated", {
-                        workerId,
-                        loopId: loopRow.id,
-                        result: result.result,
-                        hitMaxTurns: result.hitMaxTurns,
-                        turnIds,
-                        usage,
-                        attributions,
-                    });
-                    loopsDrained++;
-                    const loopResult = {
-                        loopId: loopRow.id,
-                        turnIds,
-                        result: result.result,
-                        hitMaxTurns: result.hitMaxTurns,
-                        usage,
-                        attributions,
-                    };
-                    lastResult = loopResult;
-                    if (!firstSettled) {
-                        firstSettled = true;
-                        resolveFirst(loopResult);
-                    }
-                    // A next-turn prompt this loop ended before consuming (a
-                    // wake conclusion or a runLoop-while-active prompt) is promoted to
-                    // a fresh queued loop so it's never silently dropped.
-                    await this.#reconcileOrphanedPrompts(workerId, loopRow.id);
-                    currentLoopId = null;
-                }
-            }
-            catch (err) {
-                if (controller.signal.aborted) {
-                    // {§methods-loop-cancel} — loop.cancel / shutdown aborted the live drain. A cancellation
-                    // is the loop's TERMINAL state (499), delivered via loop/terminated (runLoop no
-                    // longer blocks to return it). A genuine error rejects firstLoopPromise.
-                    let usage = {
-                        accounting: aggregateProviderAccounting([]),
-                        contextTokens: null,
-                        promptBudget: null,
-                        meta: {},
-                    };
-                    let attributions = [];
-                    const message = ErrorDetail.preview(controller.signal.reason ?? "user_cancelled")
-                        || "no reason was supplied";
-                    if (currentLoopId !== null) {
-                        // {§methods-loop-cancel}/{§worker-lifecycle-terminal-result} —
-                        // persist the exact 499 cancellation result before broadcasting it.
-                        const cancelled = await this.#lifecycle.finish(currentLoopId, Results.failure("lifecycle:cancel", "loop-cancelled", 499, `The loop was cancelled: ${message}.`, {}, {
-                            reason: message,
-                            stage: "loop",
-                            retryable: false,
-                        }), { terminatedBy: "cancel" });
-                        [usage, attributions] = await Promise.all([
-                            this.#engine.loopUsage(currentLoopId),
-                            this.#engine.loopAttributions(currentLoopId),
-                        ]);
-                        if (cancelled !== null) {
-                            this.#broadcast({ workspaceId }, "loop/terminated", {
-                                workerId,
-                                loopId: currentLoopId,
-                                result: cancelled,
-                                hitMaxTurns: false,
-                                turnIds: await this.#lifecycle.turnIds(currentLoopId),
-                                usage,
-                                attributions,
-                            });
-                        }
-                    }
-                    if (!firstSettled) {
-                        firstSettled = true;
-                        resolveFirst({
-                            loopId: currentLoopId ?? 0,
-                            turnIds: [],
-                            result: currentLoopId === null
-                                ? Results.failure("lifecycle:cancel", "loop-cancelled", 499, `The loop was cancelled: ${message}.`, {}, {
-                                    reason: message,
-                                    stage: "loop",
-                                    retryable: false,
-                                })
-                                : await this.#lifecycle.result(currentLoopId)
-                                    ?? Results.failure("lifecycle:cancel", "loop-cancelled", 499, `The loop was cancelled: ${message}.`, {}, {
-                                        reason: message,
-                                        stage: "loop",
-                                        retryable: false,
-                                    }),
-                            hitMaxTurns: false,
-                            usage,
-                        });
-                    }
-                }
-                else {
-                    // {§worker-lifecycle-terminal-result} — a non-abort drain
-                    // failure becomes an exact durable 500 and terminal notification;
-                    // daemon diagnostics retain the complete caught error.
-                    console.error(`drain error (workspace ${workspaceId}, worker ${workerId}, loop ${currentLoopId ?? "?"}):`, err);
-                    if (currentLoopId !== null) {
-                        const failure = err instanceof OperationFailureError
-                            ? err.result
-                            : Results.failure("daemon:drain", "loop-threw", 500, "The loop failed outside its operation result contract.", {}, {
-                                stage: "loop",
-                                retryable: false,
-                            });
-                        const settled = await this.#lifecycle.finish(currentLoopId, failure)
-                            ?? await this.#lifecycle.result(currentLoopId);
-                        if (settled === null) {
-                            throw new Error(`drain could not settle loop ${currentLoopId}`, { cause: err });
-                        }
-                        const [usage, attributions] = await Promise.all([
-                            this.#engine.loopUsage(currentLoopId),
-                            this.#engine.loopAttributions(currentLoopId),
-                        ]);
-                        this.#broadcast({ workspaceId }, "loop/terminated", {
-                            workerId,
-                            loopId: currentLoopId,
-                            result: settled,
-                            hitMaxTurns: false,
-                            turnIds: await this.#lifecycle.turnIds(currentLoopId),
-                            usage,
-                            attributions,
-                        });
-                    }
-                    if (!firstSettled) {
-                        firstSettled = true;
-                        rejectFirst(err);
-                    }
-                }
-                throw err;
-            }
-            finally {
-                if (!firstSettled) {
-                    firstSettled = true;
-                    rejectFirst(new Error("drain exited without producing a result"));
-                }
-                if (this.#activeDrains.get(workerId) === handle)
-                    this.#activeDrains.delete(workerId);
-            }
-            return { loopsDrained, lastResult };
-        })();
-        handle.promise = drainPromise;
-        this.#activeDrains.set(workerId, handle);
-        // Topology join ({§worker-loop-lifecycle}): when this drain exits having CONCLUDED the worker, wake its parent
-        // if parked. Runs after the drain fully tears down (settled promise) so the quiescence check sees
-        // final state; speculative (#onDrainExit no-ops unless the worker concluded AND the parent is parked).
-        const drainExitTask = drainPromise.then(() => this.#onDrainExit(workspaceId, workerId, systemPrompt), () => this.#onDrainExit(workspaceId, workerId, systemPrompt));
-        this.#drainExitTasks.add(drainExitTask);
-        void drainExitTask.catch((err) => {
-            console.error(`parent wake after worker ${workerId} settlement failed:`, err);
-        }).finally(() => {
-            this.#drainExitTasks.delete(drainExitTask);
-        });
-        // Swallow unhandled rejections (drain aborts with no awaiter); the
-        // error already surfaced via firstLoopPromise or was logged inside.
-        drainPromise.catch(() => { });
-        firstLoopPromise.catch(() => { });
-        return { firstLoopPromise, drainPromise };
-    }
-    // Per-worker drain-transition lock (R4 / {§worker-lifecycle-single-drain}). #ensureDrain's
-    // start and a drain's teardown relinquish both run under it, serialized, so the two
-    // can't interleave and register two drains for one worker. The critical section is the
-    // registry decision only (never a loop's work) — a sub-ms hop at drain boundaries.
-    // A promise-chain mutex: each caller awaits the prior holder; the tail self-prunes
-    // when idle so the Map stays bounded to workers mid-transition.
-    #withDrainLock(workerId, fn) {
-        const prev = this.#drainLocks.get(workerId) ?? Promise.resolve();
-        const run = prev.then(fn, fn);
-        const tail = run.catch(() => { });
-        this.#drainLocks.set(workerId, tail);
-        void tail.then(() => { if (this.#drainLocks.get(workerId) === tail)
-            this.#drainLocks.delete(workerId); });
-        return run;
-    }
-    // The drain guarantee, serialized per worker via #withDrainLock so it can't race a
-    // sibling drain's teardown relinquish into a double-drain (R4). A live drain
-    // (registered, NOT aborting) will claim the just-enqueued loop in its own iteration
-    // or its lock-held exit re-claim → return null. A registered-but-ABORTING drain is
-    // in teardown and won't claim, so we don't defer to it — start fresh, or the loop
-    // strands on a cancel/resume race (I6 no-lost-loop). Otherwise start one.
-    #ensureDrain(opts) {
-        return this.#withDrainLock(opts.workerId, async () => {
-            const existing = this.#activeDrains.get(opts.workerId);
-            if (existing !== undefined && !existing.controller.signal.aborted)
-                return null;
-            return this.#startDrain(opts);
-        });
-    }
-    // After a loop terminates, promote every next-turn frame it never consumed
-    // into one source-keyed queued loop. The first frame occupies the loop seed;
-    // later frames retain separate prompt entries and publish in the same turn.
-    // Re-entry and boot recovery complete that same queued identity.
+    // Durable prompt promotion remains daemon policy; DrainSupervisor invokes
+    // it under the same worker lock as enqueue and drain teardown.
     async #reconcileOrphanedPrompts(workerId, endedLoopId) {
-        await this.#withDrainLock(workerId, async () => {
-            const endedSeq = (await this.#db.engine_loop_sequence.get({ loop_id: endedLoopId }))?.sequence ?? endedLoopId;
-            const prefix = promptLoopPrefix(endedSeq);
-            const frames = await this.#db.drain_orphaned_prompts_for_loop.all({ loop_id: endedLoopId, owner_id: workerId, pattern: `${prefix}%`, prefix_len: prefix.length });
-            const first = frames[0];
-            if (first === undefined)
-                return;
-            const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
-            if (seqRow === undefined)
-                throw new Error("reconcileOrphanedPrompts: next-sequence query returned no row");
-            const recovery = await this.#db.drain_enqueue_orphan_recovery_loop.get({
-                worker_id: workerId,
-                sequence: seqRow.next,
-                prompt: first.body,
-                flags: first.flags,
-                provider_spec: first.provider_spec,
-                child_provider_spec: first.child_provider_spec,
-                max_turns: first.max_turns,
-                open_paths: first.open_paths ?? "[]",
-                orphan_source_loop_id: endedLoopId,
-            });
-            if (recovery === undefined)
-                throw new Error("reconcileOrphanedPrompts: enqueue returned no row");
-            if (recovery.status !== 100)
-                return;
-            const moved = await this.#db.drain_rehome_orphaned_prompt_frames.all({
-                owner_id: workerId,
-                source_loop_id: endedLoopId,
-                source_pattern: `${prefix}%`,
-                source_prefix_len: prefix.length,
-                target_prefix: promptLoopPrefix(recovery.sequence),
-            });
-            if (moved.length !== frames.length) {
-                throw new Error(`reconcileOrphanedPrompts: expected to re-home ${frames.length} frames, moved ${moved.length}`);
-            }
+        const endedSeq = (await this.#db.engine_loop_sequence.get({ loop_id: endedLoopId }))?.sequence ?? endedLoopId;
+        const prefix = promptLoopPrefix(endedSeq);
+        const frames = await this.#db.drain_orphaned_prompts_for_loop.all({ loop_id: endedLoopId, owner_id: workerId, pattern: `${prefix}%`, prefix_len: prefix.length });
+        const first = frames[0];
+        if (first === undefined)
+            return;
+        const seqRow = await this.#db.loop_run_next_sequence.get({ worker_id: workerId });
+        if (seqRow === undefined)
+            throw new Error("reconcileOrphanedPrompts: next-sequence query returned no row");
+        const recovery = await this.#db.drain_enqueue_orphan_recovery_loop.get({
+            worker_id: workerId,
+            sequence: seqRow.next,
+            prompt: first.body,
+            flags: first.flags,
+            provider_spec: first.provider_spec,
+            child_provider_spec: first.child_provider_spec,
+            max_turns: first.max_turns,
+            open_paths: first.open_paths ?? "[]",
+            orphan_source_loop_id: endedLoopId,
         });
-    }
-    // The worker's cancellation scope — lazily created, and replaced once aborted
-    // so a later runLoop gets a live signal. The drain and the execs its loops
-    // spawn all run under it.
-    #workerSignal(workerId) {
-        const existing = this.#workerAborts.get(workerId);
-        if (existing !== undefined && !existing.signal.aborted)
-            return existing;
-        const fresh = new AbortController();
-        this.#workerAborts.set(workerId, fresh);
-        return fresh;
-    }
-    async #cancelTree(workerId, reason, includeRoot) {
-        const cancelled = await this.#lifecycle.cancelTree(workerId, reason, includeRoot);
-        for (const targetWorkerId of cancelled.workerIds) {
-            const pollTimer = this.#pollTimers.get(targetWorkerId);
-            if (pollTimer !== undefined) {
-                clearTimeout(pollTimer);
-                this.#pollTimers.delete(targetWorkerId);
-            }
-            const parkTimer = this.#parkTimers.get(targetWorkerId);
-            if (parkTimer !== undefined) {
-                clearTimeout(parkTimer);
-                this.#parkTimers.delete(targetWorkerId);
-            }
-            this.#pollBackoff.delete(targetWorkerId);
-            this.#owedWakes.delete(targetWorkerId);
-            const scope = this.#workerAborts.get(targetWorkerId);
-            if (scope !== undefined && !scope.signal.aborted)
-                scope.abort(reason);
-        }
-        await Promise.all(cancelled.workerIds.map(async (targetWorkerId) => this.#reapWorkerStreams(targetWorkerId)));
-        for (const { loopId, workerId: targetWorkerId, result } of cancelled.loops) {
-            const row = await this.#db.drain_get_worker_workspace.get({ worker_id: targetWorkerId });
-            if (row === undefined)
-                continue;
-            const [usage, attributions] = await Promise.all([
-                this.#engine.loopUsage(loopId),
-                this.#engine.loopAttributions(loopId),
-            ]);
-            this.#broadcast({ workspaceId: row.workspace_id }, "loop/terminated", {
-                workerId: targetWorkerId,
-                loopId,
-                result,
-                hitMaxTurns: false,
-                turnIds: await this.#lifecycle.turnIds(loopId),
-                usage,
-                attributions,
-            });
+        if (recovery === undefined)
+            throw new Error("reconcileOrphanedPrompts: enqueue returned no row");
+        if (recovery.status !== 100)
+            return;
+        const moved = await this.#db.drain_rehome_orphaned_prompt_frames.all({
+            owner_id: workerId,
+            source_loop_id: endedLoopId,
+            source_pattern: `${prefix}%`,
+            source_prefix_len: prefix.length,
+            target_prefix: promptLoopPrefix(recovery.sequence),
+        });
+        if (moved.length !== frames.length) {
+            throw new Error(`reconcileOrphanedPrompts: expected to re-home ${frames.length} frames, moved ${moved.length}`);
         }
     }
-    async #cancelWorkerTree(workerId, reason) {
-        await this.#cancelTree(workerId, reason, true);
-    }
-    /**
-     * Cancel the worker's in-flight work (loop.cancel). One abort, one scope: the
-     * worker signal stops the running loop's turn generation AND tears down every
-     * stream linked to it — a background exec that outlived its loop, or even a
-     * spawn that registers after this abort (it self-aborts against the aborted
-     * signal). Returns cancelled iff there was process-local work; durable
-     * unresolved loops in the worker tree are terminalized independently.
-     */
     cancelDrain(workerId, reason = "user_cancelled") {
-        const hadDrain = this.#activeDrains.has(workerId);
-        const hadWork = hadDrain || this.#workerHasActiveStreams(workerId);
-        // A cancel is deliberate — kill any pending hibernation poll-wake so it can't resurrect the worker.
-        const pollTimer = this.#pollTimers.get(workerId);
-        if (pollTimer !== undefined) {
-            clearTimeout(pollTimer);
-            this.#pollTimers.delete(workerId);
-        }
-        // Stop the active drain's turn-generation (its loop closes 499). The worker
-        // signal is the optimization path — the fast, listener-driven reap.
-        // Durable structured cancellation: one recursive transition claims the
-        // worker and every unresolved descendant, then reaps each process-local scope.
-        void this.#cancelWorkerTree(workerId, reason).catch((err) => {
-            console.error(`cancelTree(${workerId}) failed:`, err);
-        });
-        return hadWork;
+        return this.#drains.cancel(workerId, reason);
     }
-    // Does the worker have an in-flight stream (a background exec)? Used only for
-    // loop.cancel's cancelled=true/false answer; the teardown itself rides the
-    // worker signal. Duck-typed like #drainStreamingSchemes.
+    // Process-local stream activity is supplied to the drain owner through the
+    // scheme registry rather than exposing that registry across the boundary.
     #workerHasActiveStreams(workerId) {
         const exec = this.#schemes.get("exec");
         return exec?.hasActiveSpawns?.(workerId) ?? false;
     }
-    // The contract-routed reap ({§worker-lifecycle-total-reap}): durable rows enumerate
-    // every open subscription; the live registry invokes its exact callable owner.
-    // The worker signal is only the fast path. An exec mid-spawn or a background exec
-    // from a past loop is caught regardless of listener timing. Idempotent — a stream
-    // the signal already reaped shares the same registry cancellation.
-    async #reapWorkerStreams(workerId) {
-        const open = await ChannelWrite.findOpenSubscriptionsForWorker(this.#db, workerId);
-        await Promise.all(open.map(({ id }) => this.#engine.cancelSubscription(id)));
-    }
-    /**
-     * Wake-on-completion handler. Streaming schemes call this when a
-     * subscription closes. A parked loop resumes in place; an active loop
-     * observes the channel transition at its next turn boundary. No synthetic
-     * prompt or replacement loop is created.
-     *
-     * Skipped on result.status=499 (aborted): the model already knows about
-     * its own SEND signal 499, and a forcefully-cancelled loop's spawn-abort must
-     * not resurrect the worker.
-     */
-    async #handleWakeWorker(payload) {
-        const { entryOwnerId, ...wake } = payload;
-        const conclusion = { ...wake, workerId: entryOwnerId };
-        // {§search-gate} — settle the dedup registration: promote on a 200 conclusion, drop on
-        // failure (a dead search must never serve as a duplicate). No-op for non-search streams.
-        this.#engine.searchGate.settle(payload.target.replace(/^[a-z+.-]+:\/\//, "/").replace(/^\/+/, "/"), payload.result.status);
-        // Aborted streams don't wake — the abort was deliberate.
-        if (payload.result.status === 499) {
-            this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
-                ...conclusion, wakeAction: "skipped-aborted",
-            });
-            return;
-        }
-        // No resurrection ({§worker-lifecycle-no-resurrection}): a non-499 completion whose
-        // worker was cancelled (idle + its scope aborted) must not start a fresh drain —
-        // the cancel was deliberate. The deliverable is already in the channel/log and
-        // surfaces as a `collect` environment delta ({§env-delta}) if the worker is read or
-        // resumed; we just don't inject a turn. (An active worker folds the wake into its
-        // next turn via inject below; a resumed worker is active, never aborted, so it is
-        // unaffected.)
-        const scope = this.#workerAborts.get(payload.workerId);
-        if (scope?.signal.aborted === true && !this.#activeDrains.has(payload.workerId)) {
-            this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
-                ...conclusion, wakeAction: "skipped-cancelled",
-            });
-            return;
-        }
-        try {
-            const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-            // A slept (202) loop means the worker parked via SEND signal 202 → resume it in place: re-queue
-            // it (202→100) so the drain re-claims and CONTINUES it (seq>1 → no re-foist). Checked
-            // FIRST: the slept status is the worker's true disposition regardless of a draining
-            // sibling mid-teardown (the #ensureDrain lock serializes the re-claim). No fresh loop,
-            // no summary-as-prompt — the resumed loop reads the concluded stream's own state from
-            // the manifest. {§worker-lifecycle-wake-liveness}.
-            const slept = await this.#db.drain_find_slept_loop.get({ worker_id: payload.workerId });
-            if (slept !== undefined) {
-                // {§worker-optimistic-settlement} — publish this conclusion now,
-                // then let the worker-local gate coalesce only the provider
-                // dispatch. Concurrent stream/child callbacks join that one gate.
-                void this.#settleCompletionWake(payload.workspaceId, payload.workerId, systemPrompt, false).catch((err) => {
-                    console.error("completion wake settlement failed:", err instanceof Error ? err.message : String(err));
-                });
-                this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
-                    ...conclusion, wakeAction: "resumed-loop", wakeLoopId: slept.id,
-                });
-                return;
-            }
-            // No slept loop. A live loop surfaces the concluded stream ambiently via the
-            // environment-observation injector ({§exec-stream}) on its next turn — there is no prompt
-            // to inject and NO task to overwrite. The obsolete "automated environment update"
-            // synthesis (which clobbered the model's actual goal) is retired; just tell the client.
-            if (this.#activeDrains.has(payload.workerId)) {
-                this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
-                    ...conclusion, wakeAction: "no-op-active-loop",
-                });
-                return;
-            }
-            // No slept loop, no active drain — nothing to resume (e.g. a SEND-200-done worker whose
-            // streams were swept). Surface the conclusion without opening a loop.
-            this.#broadcast({ workspaceId: payload.workspaceId }, "stream/concluded", {
-                ...conclusion, wakeAction: "no-loop",
-            });
-        }
-        catch (err) {
-            console.error("wake-on-completion setup failed:", err instanceof Error ? err.message : String(err));
-        }
-    }
-    /**
-     * grammar 0.74.20 EXEC `<T,P>` — schedule a hibernation poll-wake. Called when a loop parks at
-     * a park; if the worker holds an open polled stream, arm a timer for its tightest cadence P that
-     * resumes the slept loop so the model inspects progress. While the loop is ACTIVE there is no
-     * poll work — ambient folded stream deltas already surface progress ({§exec-stream}); the wake
-     * matters only across hibernation. A wake-edge-less 202 (no polled stream) gets no timer. {§exec-poll}
-     */
-    async #schedulePollWake(workspaceId, workerId, systemPrompt) {
-        const existing = this.#pollTimers.get(workerId);
-        if (existing !== undefined) {
-            clearTimeout(existing);
-            this.#pollTimers.delete(workerId);
-        }
-        const row = await this.#db.drain_worker_min_poll.get({ worker_id: workerId });
-        if ((row?.open_count ?? 0) === 0) {
-            this.#pollBackoff.delete(workerId);
-            return;
-        }
-        const pollSec = row?.poll_seconds ?? null;
-        // {§exec-poll} — a positive explicit cadence wins, zero opts out,
-        // and an absent cadence uses the worker's exponential-backoff step.
-        let delayMs;
-        if (pollSec !== null && pollSec > 0) {
-            this.#pollBackoff.delete(workerId);
-            delayMs = pollSec * 1000;
-        }
-        else if (pollSec === 0) {
-            this.#pollBackoff.delete(workerId);
-            return; // explicit opt-out
-        }
-        else {
-            // An open stream without an explicit cadence uses the stream polling floor.
-            // Child joins never enter this branch: durable child settlement is their only wake edge.
-            const base = Number(process.env.PLURNK_SERVICE_EXEC_POLL_SEC ?? "60");
-            const turns = Number(process.env.PLURNK_SERVICE_EXEC_POLL_TURNS ?? "8");
-            const step = this.#pollBackoff.get(workerId) ?? 0;
-            delayMs = execPollBackoffMs(step, base, turns);
-            this.#pollBackoff.set(workerId, step + 1);
-        }
-        // Floored by the optimistic settlement cap so a `<…,1>` cannot wake a
-        // parked loop faster than the preceding turn's settlement scale.
-        const optimisticWaitMs = readOptimisticSettlementMs();
-        const timer = setTimeout(() => {
-            this.#pollTimers.delete(workerId);
-            void this.#wakeParkedWorker(workspaceId, workerId, systemPrompt);
-        }, Math.max(delayMs, optimisticWaitMs));
-        timer.unref();
-        this.#pollTimers.set(workerId, timer);
-    }
-    /** Resume `workerId`'s slept (202) loop in place — the same 202→100 resume #handleWakeWorker uses, minus a
-     *  wake payload. The shared wake primitive: a poll cadence ({§exec-poll}), a watched stream concluding,
-     *  or a child worker finishing ({§worker-loop-lifecycle} topology join) all call this. A no-op if the worker was
-     *  cancelled or isn't actually parked (no slept loop) — so calling it speculatively is safe. */
-    async #wakeParkedWorker(workspaceId, workerId, systemPrompt, oweIfActive = true) {
-        if (!this.#started)
-            return;
-        const scope = this.#workerAborts.get(workerId);
-        if (scope?.signal.aborted === true && !this.#activeDrains.has(workerId))
-            return; // cancelled — no resurrection
-        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-        if (slept === undefined) {
-            // Not parked. If a drain is still ACTIVE, the worker is mid-turn and about to park — the
-            // conclusion that fired this wake arrived before the 202 committed (the conclude-before-park
-            // race). Owe the wake: the drain honors it at park so a worker hibernation never deadlocks.
-            // (No active drain → already concluded/running; nothing to wake.)
-            if (this.#activeDrains.has(workerId)) {
-                if (oweIfActive)
-                    this.#owedWakes.add(workerId);
-            }
-            return;
-        }
-        const woke = await this.#lifecycle.wake(slept.id);
-        if (!woke)
-            return;
-        const started = await this.#ensureDrain({
-            workspaceId, workerId, systemPrompt,
-        });
-        started?.drainPromise?.catch((err) => {
-            if (this.#started) {
-                console.error("wake-parked resume drain failed:", err instanceof Error ? err.message : String(err));
-            }
-        });
-    }
-    async #workerHasLiveObligation(workerId) {
-        const [openSubscriptions, liveChild] = await Promise.all([
-            this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId }),
-            this.#db.engine_worker_has_live_child.get({ worker_id: workerId }),
-        ]);
-        return openSubscriptions.length > 0 || liveChild !== undefined;
-    }
-    #settleCompletionWake(workspaceId, workerId, systemPrompt, oweIfActive = true) {
-        const existing = this.#completionWakeGates.get(workerId);
-        if (existing !== undefined) {
-            existing.conclusions++;
-            existing.poke.resolve();
-            return existing.promise;
-        }
-        const completed = Promise.withResolvers();
-        const gate = {
-            conclusions: 1,
-            poke: Promise.withResolvers(),
-            promise: completed.promise,
-        };
-        this.#completionWakeGates.set(workerId, gate);
-        void this.#runCompletionWake(workspaceId, workerId, systemPrompt, oweIfActive, gate).then(completed.resolve, completed.reject).finally(() => {
-            if (this.#completionWakeGates.get(workerId) === gate) {
-                this.#completionWakeGates.delete(workerId);
-            }
-        });
-        return gate.promise;
-    }
-    async #runCompletionWake(workspaceId, workerId, systemPrompt, oweIfActive, gate) {
-        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-        if (slept === undefined) {
-            this.#releaseCompletionWake(workerId, gate);
-            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt, oweIfActive);
-        }
-        const timeoutMs = readOptimisticSettlementMs();
-        if (timeoutMs === 0 || !(await this.#workerHasLiveObligation(workerId))) {
-            this.#releaseCompletionWake(workerId, gate);
-            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt, false);
-        }
-        return observed("worker.wake.settlement", { "window.ms": timeoutMs }, async (span) => {
-            const startedAt = performance.now();
-            const signal = this.#workerAborts.get(workerId)?.signal;
-            const deadline = delay(timeoutMs, "deadline", { signal, ref: false })
-                .catch((cause) => {
-                if (signal?.aborted === true)
-                    return "cancelled";
-                throw cause;
-            });
-            let release = "quiescent";
-            while (await this.#workerHasLiveObligation(workerId)) {
-                const poke = gate.poke;
-                const outcome = await Promise.race([
-                    poke.promise.then(() => "arrival"),
-                    deadline,
-                ]);
-                if (outcome === "arrival") {
-                    if (gate.poke === poke)
-                        gate.poke = Promise.withResolvers();
-                    continue;
-                }
-                release = outcome;
-                break;
-            }
-            span.setAttribute("release", release);
-            span.setAttribute("conclusions", gate.conclusions);
-            span.setAttribute("elapsed.ms", Math.round(performance.now() - startedAt));
-            this.#releaseCompletionWake(workerId, gate);
-            if (release === "cancelled")
-                return;
-            return this.#wakeParkedWorker(workspaceId, workerId, systemPrompt, false);
-        });
-    }
-    #releaseCompletionWake(workerId, gate) {
-        if (this.#completionWakeGates.get(workerId) === gate) {
-            this.#completionWakeGates.delete(workerId);
-        }
-    }
-    /** A worker's drain exited. If the worker truly CONCLUDED — no 202-blocked loop, no open stream — then
-     *  wake its PARENT in place if the parent is blocked on the join (the structured-concurrency join — a
-     *  child finishing is the wake edge for a parent that waited on it, {§worker-lifecycle-child-wake}). A worker
-     *  blocked at 202, or still holding a stream, is NOT concluded — its own wake edges drive it, not this.
-     *  The parent reads the child's deliverable from its own log (the {§worker-scheme-collect} delta) on
-     *  resume — control edge here, never an injected prompt. Recurses up via the parent's own drain-exit. */
-    async #onDrainExit(workspaceId, workerId, systemPrompt) {
-        const slept = await this.#db.drain_find_slept_loop.get({ worker_id: workerId });
-        if (slept !== undefined)
-            return; // parked at 202 — not concluded, the worker is still alive
-        const openSubs = await this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId });
-        if (openSubs.length > 0)
-            return; // a stream still runs — its conclusion re-evaluates, not this exit
-        const parent = await this.#db.worker_parent_id.get({ worker_id: workerId });
-        if (parent?.parent_worker_id == null)
-            return; // a root worker — nobody to wake
-        await this.#settleCompletionWake(workspaceId, parent.parent_worker_id, systemPrompt);
-    }
     // {§methods-event-subscribe} — subscriber failures are transport-local:
     // log them at this boundary and never re-enter engine control flow.
     #emitTo(workspaceId, method, params) {