@plurnk/plurnk-service 1.6.1 → 1.8.0

package/dist/server/Daemon.js

@@ -8,27 +8,34 @@ import ExecutorRegistry from "../core/ExecutorRegistry.js";
 import SchemeRegistry from "../core/SchemeRegistry.js";
 import { Mimetypes } from "@plurnk/plurnk-mimetypes";
 import { RuntimeDeclaration } from "@plurnk/plurnk-execs";
+import { projectModelRoute, routeForSpec, specForRoute } from "./model-route.js";
+import { discoverDaemonModules } from "./module-discovery.js";
+import WorkerSettingsReader from "../core/worker-settings.js";
+import EffectPolicy from "../schemes/EffectPolicy.js";
+import QuestionTool, { questionRuntimeDecl } from "../schemes/QuestionTool.js";
 import DrainSupervisor from "./DrainSupervisor.js";
 import { parsePath, Validator, } from "@plurnk/plurnk-contracts";
 import LogEntry from "./logEntry.js";
 import Envelope from "./envelope.js";
 import ClientInput from "./client-input.js";
-import JournalTurn from "../core/JournalTurn.js";
+import Turn from "../core/Turn.js";
 import LoopDocs from "./loopDocs.js";
+import SkillDocs from "./skillDocs.js";
 import GitMembership from "../core/git-membership.js";
 import Fork from "../core/fork.js";
 import WorkerName from "../core/WorkerName.js";
 import LoopLifecycle from "../core/LoopLifecycle.js";
 import { promptLoopPrefix } from "../core/plurnk-uri.js";
 import { contentWeight } from "../core/content-weight.js";
-import { parseAliasesFromEnv, resolveActiveAlias } from "@plurnk/plurnk-providers";
+import { parseAliasesFromEnv, resolveActiveRoute, UnsupportedReasoningPolicyError, } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "../core/ProviderInstantiate.js";
-import { resolveLoopAlias } from "./loop-model.js";
+import { resolveLoopRoute } from "./loop-model.js";
 import LoopFlagsReader from "../core/LoopFlagsReader.js";
 import Results, { OperationFailureError } from "../core/results.js";
 import WorkspaceGate from "../core/WorkspaceGate.js";
 import BranchBatches from "./BranchBatches.js";
 import { observed, observedSync } from "../observe/spans.js";
+import { listModelCatalog } from "./model-catalog.js";
 const clientActionFailure = (error) => {
     if (error instanceof OperationFailureError)
         return error.result;
@@ -40,6 +47,9 @@ const clientActionFailure = (error) => {
 };
 const daemonFailure = (owner, code, status, detail, extensions = {}) => new OperationFailureError(Results.failure(owner, code, status, detail, {}, extensions));
 const entryReadResult = (result) => Validator.assertEntryReadResult(result);
+const modelRouteLabel = (route) => route.alias === undefined
+    ? `model route '${route.provider}/${route.model}'`
+    : `provider alias '${route.alias}' (${route.provider}/${route.model})`;
 export default class Daemon {
     #db;
     #engine;
@@ -58,6 +68,7 @@ export default class Daemon {
     #modules = [];
     #moduleClosers = [];
     #moduleActions = new Map();
+    #workspaceCapabilityProviders = new Map();
     // {§methods-event-subscribe} — the broadcast's in-process event source. A transport
     // module (plurnk-agui) subscribes and fans out to its OWN clients; core emits, never owns
     // client transport or connection state.
@@ -82,7 +93,7 @@ export default class Daemon {
             defaultMimetype: "text/markdown",
             discoverOptions: { cwd: this.#discoveryCwd },
         });
-        const bootSpec = resolveActiveAlias();
+        const bootSpec = resolveActiveRoute();
         if (this.#provider !== null && bootSpec !== null) {
             ProviderInstantiate.registerInstance(this.#provider, bootSpec);
         }
@@ -109,10 +120,19 @@ export default class Daemon {
                     }))?.id;
                 if (workerId === undefined)
                     throw new Error("Branch worker insert returned no row");
+                // {§worker-model-selection} — lineage inheritance by value: the branch
+                // child begins with the spawning loop's effective spawn model.
+                await this.#db.worker_generation_policy_update.run({
+                    id: workerId,
+                    model_route_id: await routeForSpec(this.#db, providerSpec),
+                    spawn_model_route_id: null,
+                    reasoning_policy: parentPolicy.reasoningPolicy,
+                });
                 const loopId = await this.#drains.enqueueFreshLoop({
                     workerId,
                     prompt,
                     providerSpec,
+                    reasoningPolicy: parentPolicy.reasoningPolicy,
                     childProviderSpec: parentPolicy.childProviderSpec,
                     flags,
                 });
@@ -152,20 +172,44 @@ export default class Daemon {
             // independently (the sister is its own worker). {§machine-processes}
             injectWorker: async ({ workspaceId, workerId, prompt, flags, parentLoopId }) => {
                 const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-                const parentPolicy = parentLoopId === undefined
-                    ? null
-                    : await this.#providerPolicyForLoop(parentLoopId);
-                const providerSpec = parentPolicy === null
-                    ? resolveActiveAlias()
-                    : parentPolicy.childProviderSpec ?? parentPolicy.providerSpec;
-                if (providerSpec === null)
-                    throw new Error("injectWorker: active provider has no resolvable alias");
+                let providerSpec;
+                let childProviderSpec;
+                let reasoningPolicy;
+                if (parentLoopId === undefined) {
+                    // {§worker-model-selection} — the voice door addresses an
+                    // existing worker. Its own durable generation policy is the
+                    // receiver's identity; the daemon default and sender do not
+                    // overwrite it merely because a new loop must be minted.
+                    const targetPolicy = await this.#resolveWorkerModel(workerId, undefined);
+                    if (targetPolicy === null) {
+                        throw new Error(`injectWorker: worker ${workerId} has no resolvable model route`);
+                    }
+                    providerSpec = targetPolicy.providerSpec;
+                    reasoningPolicy = targetPolicy.reasoningPolicy;
+                    childProviderSpec = await this.#resolveWorkerSpawnModel(workerId, undefined);
+                }
+                else {
+                    const parentPolicy = await this.#providerPolicyForLoop(parentLoopId);
+                    providerSpec = parentPolicy.childProviderSpec ?? parentPolicy.providerSpec;
+                    reasoningPolicy = parentPolicy.reasoningPolicy;
+                    // {§worker-model-selection} — lineage inheritance by value:
+                    // the child begins with the spawning loop's effective spawn
+                    // model and no separate override of its own.
+                    childProviderSpec = null;
+                    await this.#db.worker_generation_policy_update.run({
+                        id: workerId,
+                        model_route_id: await routeForSpec(this.#db, providerSpec),
+                        spawn_model_route_id: null,
+                        reasoning_policy: reasoningPolicy,
+                    });
+                }
                 const { action, loopId } = await this.inject({
                     workspaceId,
                     workerId,
                     prompt,
                     providerSpec,
-                    ...(parentPolicy === null ? {} : { childProviderSpec: parentPolicy.childProviderSpec }),
+                    reasoningPolicy,
+                    childProviderSpec,
                     systemPrompt,
                     ...(flags === undefined ? {} : { flags }),
                 });
@@ -174,7 +218,15 @@ export default class Daemon {
             branchWorker: async (args) => this.#branchBatches.enqueue(args),
             branchCompletionGate: async (workerId) => this.#branchBatches.completionGate(workerId),
             acquireWorkspaceTurn: async (workspaceId, workerId) => this.#workspaceGate.acquireTurn(workspaceId, workerId),
-            workspaceTurnCompleted: async ({ turnId }) => this.#branchBatches.sealTurn(turnId),
+            // {§skills-materialization} — filesystem installers operate out of
+            // band. Refresh under the workspace turn gate before packet assembly
+            // so the first subsequent model turn sees their exact result.
+            workspaceTurnStarting: async ({ workspaceId }) => {
+                await SkillDocs.refreshIfChanged(this.#engine, this.#db, workspaceId);
+            },
+            workspaceTurnCompleted: async ({ turnId }) => {
+                await this.#branchBatches.sealTurn(turnId);
+            },
             // worker:// KILL (terminate) — cancel the addressed worker subtree and
             // tear down its held streams before the operation completes.
             cancelWorker: async (workerId, reason) => this.#drains.cancelWorkerTree(workerId, reason),
@@ -185,9 +237,14 @@ export default class Daemon {
             db,
             lifecycle: this.#lifecycle,
             injectPrompt: (workerId, prompt, openPaths) => this.#engine.inject(workerId, prompt, openPaths),
-            assertInjectionCompatibility: async ({ workerId, loopId, providerSpec, childProviderSpec, turnCeiling, flags, }) => {
+            assertInjectionCompatibility: async ({ workerId, loopId, providerSpec, providerSpecExplicit, reasoningPolicy, childProviderSpec, turnCeiling, flags, }) => {
                 await this.#assertFoldPosture(workerId, flags, loopId);
-                await this.#assertLoopProvider(loopId, providerSpec);
+                // An omitted selector keeps the loop's durable provider; only an
+                // explicit selection is checked against it (a deliberate switch).
+                if (providerSpecExplicit !== false) {
+                    await this.#assertLoopProvider(loopId, providerSpec);
+                }
+                await this.#assertLoopReasoningPolicy(loopId, reasoningPolicy);
                 if (childProviderSpec !== undefined) {
                     await this.#assertLoopChildProvider(loopId, childProviderSpec);
                 }
@@ -207,7 +264,6 @@ export default class Daemon {
                         { role: "system", content: systemPrompt },
                         { role: "user", content: prompt },
                     ],
-                    origin: "model",
                     signal,
                     onDispatch,
                 });
@@ -219,7 +275,6 @@ export default class Daemon {
                 this.#engine.parkDeadlines.delete(loopId);
                 return deadline;
             },
-            settleSearch: (target, status) => this.#engine.searchGate.settle(target, status),
             cancelSubscription: (subscriptionId) => this.#engine.cancelSubscription(subscriptionId),
             hasActiveStreams: (workerId) => this.#workerHasActiveStreams(workerId),
             readSystemPrompt: () => readFile(Paths.instructionsSystem, "utf8"),
@@ -235,6 +290,10 @@ export default class Daemon {
             const { workspaceId, ...proposal } = event;
             this.#broadcast({ workspaceId }, "loop/proposal", proposal);
         });
+        this.#engine.onClientInteractionPending((event) => {
+            const { workspaceId, ...interaction } = event;
+            this.#broadcast({ workspaceId }, "loop/interaction", interaction);
+        });
     }
     // {§methods-event-subscribe}. A transport module subscribes to the daemon's in-process
     // event source: it receives every workspace-scoped engine event as `(workspaceId, method, params)`
@@ -258,6 +317,15 @@ export default class Daemon {
         const checkedResolution = ClientInput.assertProposalResolution("resolveProposal", resolution);
         this.#engine.resolveProposal(checkedLogEntryId, checkedResolution);
     }
+    async pendingClientInteractions(workspaceId) {
+        const checkedWorkspaceId = ClientInput.assertId("pendingClientInteractions", "workspaceId", workspaceId);
+        return this.#engine.pendingClientInteractions(checkedWorkspaceId);
+    }
+    async resolveClientInteraction(interactionId, resolution) {
+        const checkedInteractionId = ClientInput.assertId("resolveClientInteraction", "interactionId", interactionId);
+        const checkedResolution = ClientInput.assertClientInteractionResolution("resolveClientInteraction", resolution);
+        await this.#engine.resolveClientInteraction(checkedInteractionId, checkedResolution);
+    }
     // {§methods-loop-run} — drive/steer a loop. The module supplies only workspace/worker/prompt;
     // the provider and the law-file system prompt are core's and stay inside. Returns immediately — the
     // loop runs async and its outcome arrives on the event source (loop/terminated). `cancelDrain` (public)
@@ -268,34 +336,25 @@ export default class Daemon {
         const prompt = ClientInput.assertPrompt("runLoop", args.prompt);
         const requestedMaxTurns = ClientInput.assertMaxTurns("runLoop", args.maxTurns);
         const openPaths = ClientInput.assertOpenPaths("runLoop", args.openPaths);
-        const alias = ClientInput.assertOptionalSelector("runLoop", "alias", args.alias);
-        const model = ClientInput.assertOptionalSelector("runLoop", "model", args.model);
-        const childAlias = ClientInput.assertOptionalChildAlias("runLoop", args.childAlias);
-        const childModel = ClientInput.assertOptionalSelector("runLoop", "childModel", args.childModel);
-        if (childAlias === null && childModel !== undefined) {
-            throw daemonFailure("daemon:input", "child-provider-conflict", 400, "childModel cannot accompany an inherited child provider policy.", { field: "childModel", recovery: "Omit childModel or select a child alias.", retryable: false });
-        }
+        const selector = ClientInput.assertOptionalSelector("runLoop", "selector", args.selector);
+        const childSelector = ClientInput.assertOptionalChildSelector("runLoop", args.childSelector);
         const flags = ClientInput.normalizeLoopFlags("runLoop", args.flags);
-        // {§methods-loop-run-model} — a client sends alias/model on every loop, so a
-        // switch takes effect turn-to-turn. `model` (client-resolved <provider>/<model>) wins
-        // over `alias`; neither → the boot default. Instantiation is cached, so ping-ponging
-        // between two models is cheap, and an unresolvable alias/model fails loud here.
-        const selection = await this.#resolveLoopProvider(alias, model);
-        if (selection === null) {
-            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this loop.", {}, {
+        // {§worker-model-selection} — the worker owns the model. An explicit selector
+        // persists onto the worker; an omitted selector resolves the worker's durable model
+        // (seeded once from the daemon default). The loop then snapshots the resolved route.
+        // A continuation's omitted selector must still keep the loop's durable provider.
+        const selectorExplicit = selector !== undefined;
+        const generationPolicy = await this.#resolveWorkerModel(workerId, selector);
+        if (generationPolicy === null) {
+            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this worker.", {}, {
                 stage: "provider-selection",
                 recovery: "Select a configured model provider.",
                 retryable: false,
             }));
         }
-        // {§methods-loop-run-child-provider}
-        const configuredChildAlias = childAlias === undefined && childModel === undefined
-            ? process.env.PLURNK_MODEL_CHILD
-            : childAlias;
-        const childSelection = configuredChildAlias === null
-            || (configuredChildAlias === undefined && childModel === undefined)
-            ? null
-            : await this.#resolveLoopProvider(configuredChildAlias, childModel);
+        const { providerSpec: selection, reasoningPolicy } = generationPolicy;
+        // {§methods-loop-run-child-provider} — the worker's persistent spawn override.
+        const childSelection = await this.#resolveWorkerSpawnModel(workerId, childSelector);
         const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
         // {§machine-processes} — the model NEVER runs in a client-origin worker (its packets would carry
         // client-action rows). The module resolves the model worker via ensureModelWorker and passes it (or a
@@ -336,72 +395,182 @@ export default class Daemon {
             ...(openPaths !== undefined ? { openPaths } : {}),
             turnCeiling,
             providerSpec: selection,
+            providerSpecExplicit: selectorExplicit,
+            reasoningPolicy,
             childProviderSpec: childSelection,
             systemPrompt,
         });
         return { status: 100, action, loopId, ...(turnSeq !== undefined ? { turnSeq } : {}) };
     }
-    // {§methods-loop-run-model} — resolve a per-loop model override to a cached Provider. `model`
-    // (<provider>/<model>, client-resolved) wins over a named `alias`; absent both, the
-    // boot default. A named alias missing from the env cascade, or a malformed model spec, throws
-    // legibly rather than silently running the wrong model.
-    async #resolveLoopProvider(alias, model) {
-        const requested = resolveLoopAlias(alias, model, parseAliasesFromEnv());
+    // {§methods-loop-run-model} — resolve one alias-or-route selector to a cached
+    // Provider; absent uses the boot default. An unknown alias or malformed exact
+    // route throws legibly rather than silently running the wrong model.
+    async #resolveLoopProvider(selector, reasoningPolicy) {
+        const requested = resolveLoopRoute(selector, parseAliasesFromEnv());
         if (requested === null && this.#provider === null)
             return null;
-        const spec = requested ?? resolveActiveAlias();
+        const spec = requested ?? resolveActiveRoute();
         if (spec === null) {
-            throw daemonFailure("daemon:provider", "active-alias-unresolved", 500, "The active provider has no resolvable alias.", { stage: "provider-selection", retryable: false });
+            throw daemonFailure("daemon:provider", "active-model-unresolved", 500, "The active provider has no resolvable model route.", { stage: "provider-selection", retryable: false });
         }
-        // Resolve eagerly so runLoop fails before enqueue when the provider
-        // cannot be constructed. The drain later retrieves this cached handle
-        // from the loop's durable spec at the claim boundary.
+        await this.#providerForPolicy(spec, reasoningPolicy);
+        return spec;
+    }
+    // Resolve eagerly so runLoop fails before enqueue when the selected route
+    // and durable reasoning policy cannot compose. The drain later retrieves
+    // this cached handle from the loop's immutable snapshot.
+    async #providerForPolicy(spec, reasoningPolicy) {
         try {
-            await ProviderInstantiate.instantiateProvider(spec);
+            const provider = await ProviderInstantiate.instantiateProvider(spec, process.env, reasoningPolicy);
+            ProviderInstantiate.validateGrammarConfiguration(provider, process.env, reasoningPolicy);
+            return provider;
         }
         catch (cause) {
             if (cause instanceof OperationFailureError)
                 throw cause;
-            console.error(`Provider alias '${spec.alias}' could not be instantiated:`, cause);
-            throw daemonFailure("daemon:provider", "provider-unavailable", 503, `Provider alias '${spec.alias}' is unavailable.`, {
-                alias: spec.alias,
+            if (cause instanceof UnsupportedReasoningPolicyError) {
+                throw daemonFailure("daemon:provider", "reasoning-policy-unsupported", 409, `${modelRouteLabel(spec)} does not support reasoning policy '${cause.policy}'.`, {
+                    ...(spec.alias === undefined ? {} : { alias: spec.alias }),
+                    provider: spec.provider,
+                    model: spec.model,
+                    reasoningPolicy: cause.policy,
+                    supportedReasoningPolicies: cause.supported,
+                    stage: "provider-selection",
+                    recovery: "Select one of the provider's supported reasoning policies.",
+                    retryable: false,
+                });
+            }
+            console.error(`${modelRouteLabel(spec)} could not be instantiated:`, cause);
+            throw daemonFailure("daemon:provider", "provider-unavailable", 503, `${modelRouteLabel(spec)} is unavailable.`, {
+                ...(spec.alias === undefined ? {} : { alias: spec.alias }),
                 provider: spec.provider,
                 model: spec.model,
                 stage: "provider-selection",
                 retryable: false,
             });
         }
-        return spec;
     }
-    #parseProviderSpec(loopId, field, encoded) {
-        let parsed;
-        try {
-            parsed = JSON.parse(encoded);
+    // {§worker-model-selection} — a model worker owns one durable model. An explicit
+    // selector persists onto the worker; an omitted selector resolves the worker's
+    // durable model, seeded once from the daemon default. A deliberately modelless
+    // daemon leaves the worker unset until an explicit selection arrives.
+    async #resolveWorkerModel(workerId, selector) {
+        const worker = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (worker === undefined)
+            throw new Error(`worker ${workerId}: model route row missing`);
+        if (selector !== undefined) {
+            const spec = await this.#resolveLoopProvider(selector, worker.reasoning_policy ?? undefined);
+            if (spec === null)
+                return null;
+            const reasoningPolicy = worker.reasoning_policy
+                ?? ProviderInstantiate.configuredReasoningPolicy(spec);
+            if (worker.spawn_model_route_id !== null) {
+                const spawnSpec = await specForRoute(this.#db, worker.spawn_model_route_id);
+                if (spawnSpec === null)
+                    throw new Error(`worker ${workerId}: spawn model route is missing`);
+                await this.#providerForPolicy(spawnSpec, reasoningPolicy);
+            }
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: await routeForSpec(this.#db, spec),
+                spawn_model_route_id: worker.spawn_model_route_id,
+                reasoning_policy: reasoningPolicy,
+            });
+            return { providerSpec: spec, reasoningPolicy };
         }
-        catch {
-            throw new Error(`loop ${loopId}: persisted ${field} is malformed`);
+        if (worker.model_route_id !== null) {
+            if (worker.reasoning_policy === null) {
+                throw new Error(`worker ${workerId}: durable model has no reasoning policy`);
+            }
+            const spec = await specForRoute(this.#db, worker.model_route_id);
+            if (spec === null)
+                throw new Error(`worker ${workerId}: model route is missing`);
+            await this.#providerForPolicy(spec, worker.reasoning_policy);
+            return { providerSpec: spec, reasoningPolicy: worker.reasoning_policy };
         }
-        if (parsed === null)
+        if (this.#provider === null)
             return null;
-        if (typeof parsed.alias !== "string" || parsed.alias.length === 0
-            || typeof parsed.provider !== "string" || parsed.provider.length === 0
-            || typeof parsed.model !== "string" || parsed.model.length === 0
-            || (parsed.baseUrl !== undefined && typeof parsed.baseUrl !== "string")) {
-            throw new Error(`loop ${loopId}: persisted ${field} is invalid`);
+        const spec = resolveActiveRoute();
+        if (spec !== null) {
+            const reasoningPolicy = ProviderInstantiate.configuredReasoningPolicy(spec);
+            await this.#providerForPolicy(spec, reasoningPolicy);
+            if (worker.spawn_model_route_id !== null) {
+                const spawnSpec = await specForRoute(this.#db, worker.spawn_model_route_id);
+                if (spawnSpec === null)
+                    throw new Error(`worker ${workerId}: spawn model route is missing`);
+                await this.#providerForPolicy(spawnSpec, reasoningPolicy);
+            }
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: await routeForSpec(this.#db, spec),
+                spawn_model_route_id: worker.spawn_model_route_id,
+                reasoning_policy: reasoningPolicy,
+            });
+            return { providerSpec: spec, reasoningPolicy };
         }
-        return parsed;
+        return null;
     }
+    // {§worker-model-selection} — the persistent spawn override. An explicit child
+    // selector persists onto the worker (null clears it back to inherit); an omitted
+    // selector resolves the persisted override, seeded once from the operator's
+    // PLURNK_MODEL_CHILD default.
+    async #resolveWorkerSpawnModel(workerId, childSelector) {
+        const worker = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (worker === undefined)
+            throw new Error(`worker ${workerId}: model route row missing`);
+        if (childSelector !== undefined) {
+            const spec = childSelector === null
+                ? null
+                : await this.#resolveLoopProvider(childSelector, worker.reasoning_policy ?? undefined);
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: worker.model_route_id,
+                spawn_model_route_id: spec === null ? null : await routeForSpec(this.#db, spec),
+                reasoning_policy: worker.reasoning_policy,
+            });
+            return spec;
+        }
+        if (worker.spawn_model_route_id !== null) {
+            const spec = await specForRoute(this.#db, worker.spawn_model_route_id);
+            if (spec === null)
+                throw new Error(`worker ${workerId}: spawn model route is missing`);
+            if (worker.reasoning_policy !== null) {
+                await this.#providerForPolicy(spec, worker.reasoning_policy);
+            }
+            return spec;
+        }
+        const configured = process.env.PLURNK_MODEL_CHILD;
+        if (configured === undefined || configured.length === 0)
+            return null;
+        const spec = await this.#resolveLoopProvider(configured, worker.reasoning_policy ?? undefined);
+        if (spec !== null) {
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: worker.model_route_id,
+                spawn_model_route_id: await routeForSpec(this.#db, spec),
+                reasoning_policy: worker.reasoning_policy,
+            });
+        }
+        return spec;
+    }
+    // {§worker-model-selection} — the loop's durable snapshot is the immutable route ids,
+    // resolved through model_routes at the claim boundary; never re-resolved through the
+    // alias cascade (a changed alias declaration must not rewrite history).
     async #providerPolicyForLoop(loopId) {
-        const row = await this.#db.drain_loop_provider_spec.get({ loop_id: loopId });
+        const row = await this.#db.drain_loop_generation_policy.get({ loop_id: loopId });
         if (row === undefined)
             throw new Error(`loop ${loopId}: provider selection row is missing`);
-        const providerSpec = this.#parseProviderSpec(loopId, "provider_spec", row.provider_spec);
+        const providerSpec = await specForRoute(this.#db, row.model_route_id);
         if (providerSpec === null) {
-            throw new Error(`loop ${loopId}: persisted provider selection is missing or invalid — refusing boot-default substitution`);
+            throw new Error(`loop ${loopId}: persisted provider selection is missing — refusing boot-default substitution`);
+        }
+        if (row.reasoning_policy === null) {
+            throw new Error(`loop ${loopId}: persisted reasoning policy is missing`);
         }
         return {
             providerSpec,
-            childProviderSpec: this.#parseProviderSpec(loopId, "child_provider_spec", row.child_provider_spec),
+            childProviderSpec: await specForRoute(this.#db, row.spawn_model_route_id),
+            reasoningPolicy: row.reasoning_policy,
         };
     }
     async #providerSpecForLoop(loopId) {
@@ -409,20 +578,20 @@ export default class Daemon {
     }
     async #providersForLoop(loopId) {
         const policy = await this.#providerPolicyForLoop(loopId);
-        const provider = await ProviderInstantiate.instantiateProvider(policy.providerSpec);
+        const provider = await this.#providerForPolicy(policy.providerSpec, policy.reasoningPolicy);
         const childProvider = policy.childProviderSpec === null
             ? provider
-            : await ProviderInstantiate.instantiateProvider(policy.childProviderSpec);
+            : await this.#providerForPolicy(policy.childProviderSpec, policy.reasoningPolicy);
         return { provider, childProvider };
     }
     async #assertLoopProvider(loopId, requested) {
         const selected = await this.#providerSpecForLoop(loopId);
         if (JSON.stringify(selected) !== JSON.stringify(requested)) {
-            throw daemonFailure("daemon:provider", "loop-provider-conflict", 409, `Loop ${loopId} uses provider alias '${selected.alias}', not '${requested.alias}'.`, {
+            throw daemonFailure("daemon:provider", "loop-provider-conflict", 409, `Loop ${loopId} uses ${modelRouteLabel(selected)}, not ${modelRouteLabel(requested)}.`, {
                 loopId,
-                selectedAlias: selected.alias,
+                ...(selected.alias === undefined ? {} : { selectedAlias: selected.alias }),
                 selectedModel: `${selected.provider}/${selected.model}`,
-                requestedAlias: requested.alias,
+                ...(requested.alias === undefined ? {} : { requestedAlias: requested.alias }),
                 requestedModel: `${requested.provider}/${requested.model}`,
                 stage: "loop-injection",
                 recovery: "Cancel or conclude the loop before selecting another provider.",
@@ -430,13 +599,28 @@ export default class Daemon {
             });
         }
     }
+    async #assertLoopReasoningPolicy(loopId, requested) {
+        const selected = (await this.#providerPolicyForLoop(loopId)).reasoningPolicy;
+        if (selected !== requested) {
+            throw daemonFailure("daemon:provider", "loop-reasoning-policy-conflict", 409, `Loop ${loopId} uses reasoning policy '${selected}', not '${requested}'.`, {
+                loopId,
+                selectedReasoningPolicy: selected,
+                requestedReasoningPolicy: requested,
+                stage: "loop-injection",
+                recovery: "Cancel or conclude the loop before selecting another reasoning policy.",
+                retryable: false,
+            });
+        }
+    }
     async #assertLoopChildProvider(loopId, requested) {
         const selected = (await this.#providerPolicyForLoop(loopId)).childProviderSpec;
         if (JSON.stringify(selected) !== JSON.stringify(requested)) {
             throw daemonFailure("daemon:provider", "loop-child-provider-conflict", 409, `Loop ${loopId} already has a different child provider policy.`, {
                 loopId,
                 selectedChildAlias: selected?.alias ?? null,
+                selectedChildModel: selected === null ? null : `${selected.provider}/${selected.model}`,
                 requestedChildAlias: requested?.alias ?? null,
+                requestedChildModel: requested === null ? null : `${requested.provider}/${requested.model}`,
                 stage: "loop-injection",
                 recovery: "Cancel or conclude the loop before changing its child provider policy.",
                 retryable: false,
@@ -462,10 +646,180 @@ export default class Daemon {
     }
     // {§methods-model-worker} — the workspace's model worker (created on first use), distinct from the client
     // worker so the model's packets never carry client-action rows. The module binds its threads to this.
-    ensureModelWorker(workspaceId) {
-        return Envelope.ensureModelWorker(this.#db, ClientInput.assertId("worker.ensure-model", "workspaceId", workspaceId));
+    // Optional worker settings ({§worker-settings}) ride the client's per-run declaration: merged in on
+    // creation AND on every subsequent ensure, so a client can change its mind between loops.
+    async ensureModelWorker(workspaceId, settings) {
+        const checked = ClientInput.assertId("worker.ensure-model", "workspaceId", workspaceId);
+        const created = await Envelope.ensureModelWorker(this.#db, checked);
+        if (settings !== undefined)
+            await this.#mergeWorkerSettings(created, settings);
+        return created;
+    }
+    // {§worker-settings} — merge known keys into the worker's behavioral-rules bag.
+    // Validated at the boundary; unprovided keys keep their durable value.
+    async #mergeWorkerSettings(workerId, settings) {
+        const current = await WorkerSettingsReader.read(this.#db, workerId);
+        const merged = {
+            requestUserInput: settings.requestUserInput ?? current.requestUserInput,
+        };
+        await this.#db.worker_settings_update.run({ id: workerId, settings: JSON.stringify(merged) });
+    }
+    // {§worker-settings} — project the worker's behavioral rules for a client-interface surface.
+    async readWorkerSettings(args) {
+        const workspaceId = ClientInput.assertId("worker.settings.get", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.settings.get", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        const settings = await WorkerSettingsReader.read(this.#db, workerId);
+        return { requestUserInput: settings.requestUserInput };
+    }
+    // {§worker-settings} — persist known behavioral-rule keys; unknown keys are
+    // rejected at the input boundary, never persisted.
+    async setWorkerSettings(args) {
+        const workspaceId = ClientInput.assertId("worker.settings.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.settings.set", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        ClientInput.parseWorkerSettings(args.settings);
+        await this.#mergeWorkerSettings(workerId, args.settings);
+        const settings = await WorkerSettingsReader.read(this.#db, workerId);
+        return { requestUserInput: settings.requestUserInput };
+    }
+    // {§worker-model-selection} — project a worker's durable model and spawn override
+    // for a client-interface get/set surface. Ownership is checked at this boundary.
+    async readWorkerModel(args) {
+        const workspaceId = ClientInput.assertId("worker.model.get", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.model.get", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (row === undefined)
+            throw new Error(`worker ${workerId}: model route row missing`);
+        const modelSpec = await specForRoute(this.#db, row.model_route_id);
+        const spawnModelSpec = await specForRoute(this.#db, row.spawn_model_route_id);
+        return {
+            model: modelSpec === null ? null : projectModelRoute(modelSpec),
+            spawnModel: spawnModelSpec === null ? null : projectModelRoute(spawnModelSpec),
+        };
+    }
+    // {§worker-model-selection} — persist an explicit model selection onto the worker
+    // and return the resolved spec. An unresolvable selector fails loud here.
+    async setWorkerModel(args) {
+        const workspaceId = ClientInput.assertId("worker.model.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.model.set", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertWorkerSelectable(workerId);
+        const selector = ClientInput.assertSelector("worker.model.set", "selector", args.selector);
+        const policy = await this.#resolveWorkerModel(workerId, selector);
+        if (policy === null) {
+            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this worker.", {}, { stage: "provider-selection", recovery: "Select a configured model provider.", retryable: false }));
+        }
+        return projectModelRoute(policy.providerSpec);
+    }
+    async #reasoningSupportForWorker(workerId, row, providerSpec, policy) {
+        const provider = await this.#providerForPolicy(providerSpec, policy);
+        if (row.spawn_model_route_id === null)
+            return provider.supportedReasoningPolicies;
+        const spawnSpec = await specForRoute(this.#db, row.spawn_model_route_id);
+        if (spawnSpec === null)
+            throw new Error(`worker ${workerId}: spawn model route is missing`);
+        const spawnProvider = await this.#providerForPolicy(spawnSpec, policy);
+        return provider.supportedReasoningPolicies.filter((candidate) => spawnProvider.supportedReasoningPolicies.includes(candidate));
+    }
+    // {§worker-reasoning-policy} — the worker's reasoning policy is durable and
+    // provider-relative. A model-less worker remains explicitly uninitialized.
+    async readWorkerReasoning(args) {
+        const workspaceId = ClientInput.assertId("worker.reasoning.get", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.reasoning.get", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#resolveWorkerModel(workerId, undefined);
+        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (row === undefined)
+            throw new Error(`worker ${workerId}: generation policy row missing`);
+        if (row.model_route_id === null) {
+            if (row.reasoning_policy !== null) {
+                throw new Error(`worker ${workerId}: reasoning policy exists without a model route`);
+            }
+            return { policy: null, supportedPolicies: [] };
+        }
+        if (row.reasoning_policy === null) {
+            throw new Error(`worker ${workerId}: durable model has no reasoning policy`);
+        }
+        const spec = await specForRoute(this.#db, row.model_route_id);
+        if (spec === null)
+            throw new Error(`worker ${workerId}: model route is missing`);
+        return {
+            policy: row.reasoning_policy,
+            supportedPolicies: await this.#reasoningSupportForWorker(workerId, row, spec, row.reasoning_policy),
+        };
+    }
+    // {§worker-reasoning-policy} — mutate between loops, validate against both
+    // the worker model and its optional spawn model, then persist atomically.
+    async setWorkerReasoning(args) {
+        const workspaceId = ClientInput.assertId("worker.reasoning.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.reasoning.set", "workerId", args.workerId);
+        let policy;
+        try {
+            policy = Validator.assertReasoningPolicy(args.policy);
+        }
+        catch (cause) {
+            throw daemonFailure("daemon:input", "reasoning-policy-invalid", 400, cause instanceof Error ? cause.message : "The reasoning policy is invalid.", { field: "policy", retryable: false });
+        }
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertWorkerSelectable(workerId);
+        await this.#resolveWorkerModel(workerId, undefined);
+        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (row === undefined)
+            throw new Error(`worker ${workerId}: generation policy row missing`);
+        const spec = await specForRoute(this.#db, row.model_route_id);
+        if (spec === null) {
+            throw daemonFailure("daemon:provider", "worker-model-unset", 409, `Worker ${workerId} has no model against which to validate a reasoning policy.`, {
+                workerId,
+                stage: "provider-selection",
+                recovery: "Select a model before selecting its reasoning policy.",
+                retryable: false,
+            });
+        }
+        const supportedPolicies = await this.#reasoningSupportForWorker(workerId, row, spec, policy);
+        await this.#db.worker_generation_policy_update.run({
+            id: workerId,
+            model_route_id: row.model_route_id,
+            spawn_model_route_id: row.spawn_model_route_id,
+            reasoning_policy: policy,
+        });
+        return { policy, supportedPolicies };
+    }
+    // {§worker-model-selection} — persist the worker's spawn override; a null
+    // selector means inherit (clears the override).
+    async setWorkerSpawnModel(args) {
+        const workspaceId = ClientInput.assertId("worker.child.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.child.set", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertWorkerSelectable(workerId);
+        const selector = ClientInput.assertChildSelector("worker.child.set", args.selector);
+        const spec = await this.#resolveWorkerSpawnModel(workerId, selector);
+        return spec === null ? null : projectModelRoute(spec);
+    }
+    // {§worker-model-selection} — a selection must not mutate underneath active
+    // work: a live or parked loop is a precise 409, never a silent retroactive
+    // switch of the immutable loop snapshot.
+    async #assertWorkerSelectable(workerId) {
+        if (await this.#drains.hasLiveWork(workerId)) {
+            throw daemonFailure("daemon:worker", "worker-loop-active", 409, `Worker ${workerId} has a live or parked loop; select a model after concluding or cancelling it.`, {
+                workerId,
+                stage: "model-selection",
+                recovery: "Conclude or cancel the active loop before selecting a model.",
+                retryable: false,
+            });
+        }
+    }
+    async #assertWorkerOwned(workspaceId, workerId) {
+        const owner = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
+        if (owner === undefined) {
+            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
+        }
+        if (owner.workspace_id !== workspaceId) {
+            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, { workerId, workspaceId, actualWorkspaceId: owner.workspace_id });
+        }
     }
-    // {§methods-op-mirror} — execute parsed ops on behalf of a client, journaled as a
+    // {§methods-op-mirror} — execute parsed ops on behalf of a client as a
     // client-origin turn (the log is core's, a client op is a first-class citizen), dispatched through
     // the engine, then emitted as log/entry on the event source. One seam op backs the whole op_*
     // family (read/edit/copy/find/fold/look/move/open/send/exec); the module parses at its edge with the
@@ -485,10 +839,10 @@ export default class Daemon {
             throw error;
         }
     }
-    // The client-interface action contract: one AG-UI action owns one journal segment,
-    // regardless of how many statements op.parse produced. A proposed statement may
-    // keep this promise (and segment) open across interrupt/resume; settlement closes
-    // it. The journal is durable evidence for the action, not a second client lifecycle.
+    // The client-interface action contract: one AG-UI action owns one administrative
+    // loop, regardless of how many statements op.parse produced. Each statement is one
+    // ordinary operation turn; a proposal may keep that turn and loop open across
+    // interrupt/resume until settlement.
     async dispatchClientAction(args) {
         const workspaceId = ClientInput.assertId("operation.dispatch-batch", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("operation.dispatch-batch", "workerId", args.workerId);
@@ -513,18 +867,38 @@ export default class Daemon {
         const { workspaceId, workerId, loopId, statement } = args;
         const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
         try {
-            const { id: turnId } = await JournalTurn.insert(this.#db, loopId);
-            const entryIds = [];
-            const result = await this.#engine.dispatch({
-                statement, workspaceId, workerId, loopId, turnId, sequence: 1,
-                origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); },
+            const { id: turnId } = await Turn.open(this.#db, {
+                loopId,
+                producer: "client",
+                kind: "operation",
             });
-            await this.#branchBatches.sealTurn(turnId);
-            for (const logEntryId of entryIds) {
-                const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
-                this.#broadcast({ workspaceId }, "log/entry", { entry });
+            let turnOpen = true;
+            try {
+                const entryIds = [];
+                const result = await this.#engine.dispatch({
+                    statement, workspaceId, workerId, loopId, turnId, sequence: 1,
+                    origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); },
+                });
+                await Turn.complete(this.#db, turnId, result.status);
+                turnOpen = false;
+                await this.#branchBatches.sealTurn(turnId);
+                for (const logEntryId of entryIds) {
+                    const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
+                    this.#broadcast({ workspaceId }, "log/entry", { entry });
+                }
+                return result;
+            }
+            catch (cause) {
+                if (turnOpen) {
+                    try {
+                        await Turn.complete(this.#db, turnId, 500);
+                    }
+                    catch (completionCause) {
+                        throw new AggregateError([cause, completionCause], `client operation turn ${turnId} failed and could not be completed`);
+                    }
+                }
+                throw cause;
             }
-            return result;
         }
         finally {
             release();
@@ -616,7 +990,7 @@ export default class Daemon {
     // {§methods} — the module's render surface beyond the journal. Thin delegations
     // into core's envelope / membership / provider machinery; the module fans the results into its own views.
     listProviders() {
-        const active = resolveActiveAlias();
+        const active = resolveActiveRoute();
         return {
             aliases: parseAliasesFromEnv().map((a) => {
                 const isActive = active !== null && active.alias === a.alias;
@@ -627,6 +1001,11 @@ export default class Daemon {
             }),
         };
     }
+    // {§model-catalog} The catalog is a bounded, worldless local projection.
+    // It performs no provider I/O and never changes the worker's selection.
+    listModels(query) {
+        return listModelCatalog(query);
+    }
     // {§client-display-capabilities} Core composes the installed family
     // declarations; interface modules expose this contracts-owned wire without
     // inventing presentation policy. `exec` is operation machinery, not an
@@ -699,7 +1078,11 @@ export default class Daemon {
             }
             if (constraints.length > 0)
                 await GitMembership.resolveGitMembership(this.#db, envelope.workspaceId, undefined);
+            for (const provider of this.#workspaceCapabilityProviders.values()) {
+                await provider.hydrate(envelope.workspaceId);
+            }
             await LoopDocs.materialize(this.#engine, this.#db, envelope.workspaceId);
+            await SkillDocs.materialize(this.#engine, this.#db, envelope.workspaceId);
             void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
             this.#broadcast("all", "workspace/created", { id: envelope.workspaceId, name: envelope.workspaceName, projectRoot: envelope.projectRoot });
             return envelope;
@@ -898,6 +1281,9 @@ export default class Daemon {
             }
         }
         const worker = await Envelope.createModelWorker(this.#db, workspaceId, name);
+        if (args.settings !== undefined) {
+            await this.#mergeWorkerSettings(worker.id, args.settings);
+        }
         return { workerId: worker.id, workerName: worker.name };
     }
     // {§worker-scheme-fork} — branch a worker's log while sharing the workspace world.
@@ -928,50 +1314,200 @@ export default class Daemon {
         const branch = await this.#db.envelope_get_worker_by_id.get({ id: branchWorkerId });
         return { workerId: branchWorkerId, workerName: branch?.name ?? null, parentWorkerId: workerId };
     }
-    async registerRuntime({ namespaceOwner, decl, executor, availability, scheme }) {
-        if (typeof namespaceOwner !== "string" || namespaceOwner.trim().length === 0) {
-            throw new Error("registerRuntime: namespaceOwner must be a non-empty string");
-        }
-        const runtime = RuntimeDeclaration.assert(decl, namespaceOwner);
-        this.#engine.registerRuntime(runtime.name, {
-            executor,
-            namespaceOwner: { kind: "module", name: namespaceOwner },
-            glyph: runtime.glyph ?? "",
-            invocation: runtime.invocation,
-            documentation: runtime.documentation ?? "",
-            available: availability.available,
-            detail: availability.detail,
-        }, scheme);
+    async registerRuntimes(registrations) {
+        const normalized = registrations.map((registration) => this.#normalizeRuntime(registration));
+        this.#engine.registerRuntimes(normalized);
         if (this.#capabilitiesPublished) {
             for (const workspace of await Envelope.listWorkspaces(this.#db)) {
                 await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
+                await SkillDocs.materialize(this.#engine, this.#db, workspace.id);
             }
         }
     }
+    async registerRuntime(registration) {
+        await this.registerRuntimes([registration]);
+    }
     async registerScheme(name, handler) {
         this.#schemes.register(name, handler);
         if (this.#capabilitiesPublished) {
             await this.#schemes.ready();
             for (const workspace of await Envelope.listWorkspaces(this.#db)) {
                 await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
+                await SkillDocs.materialize(this.#engine, this.#db, workspace.id);
             }
         }
     }
-    registerModuleAction(name, handler) {
+    #normalizeRuntime({ namespaceOwner, decl, executor, availability, scheme }) {
+        if (typeof namespaceOwner !== "string" || namespaceOwner.trim().length === 0) {
+            throw new Error("runtime registration namespaceOwner must be a non-empty string");
+        }
+        const runtime = RuntimeDeclaration.assert(decl, namespaceOwner);
+        return {
+            tag: runtime.name,
+            entry: {
+                executor,
+                namespaceOwner: { kind: "module", name: namespaceOwner },
+                glyph: runtime.glyph ?? "",
+                summary: runtime.summary,
+                invocation: runtime.invocation,
+                details: runtime.details ?? "",
+                ...(runtime.resourcesPath === undefined ? {} : { resourcesPath: runtime.resourcesPath }),
+                ...(runtime.expandTools === undefined ? {} : { expandTools: runtime.expandTools }),
+                available: availability.available,
+                detail: availability.detail,
+            },
+            scheme,
+        };
+    }
+    registerModuleAction(registration) {
+        const { name, scope, handler } = registration;
         if (name.length === 0)
             throw new Error("registerModuleAction: action name must not be empty");
+        if (scope !== "worldless" && scope !== "workspace") {
+            throw new Error(`module action '${name}' has invalid scope '${String(scope)}'`);
+        }
+        if (typeof handler !== "function")
+            throw new Error(`module action '${name}' has no handler`);
         if (this.#moduleActions.has(name))
             throw new Error(`module action '${name}' is already registered`);
-        this.#moduleActions.set(name, handler);
+        this.#moduleActions.set(name, registration);
     }
     listModuleActions() {
-        return [...this.#moduleActions.keys()].toSorted();
+        return [...this.#moduleActions.values()]
+            .map(({ name, scope }) => ({ name, scope }))
+            .toSorted((left, right) => left.name.localeCompare(right.name));
     }
-    async invokeModuleAction(name, params) {
-        const handler = this.#moduleActions.get(name);
-        if (handler === undefined)
+    async invokeModuleAction(name, params, context) {
+        const registration = this.#moduleActions.get(name);
+        if (registration === undefined)
             throw new Error(`module action '${name}' is not registered`);
-        return handler(params);
+        if (registration.scope !== context.scope) {
+            throw new Error(`module action '${name}' requires ${registration.scope} context, not ${context.scope}`);
+        }
+        if (context.scope === "workspace") {
+            ClientInput.assertId(`module action '${name}'`, "workspaceId", context.workspaceId);
+        }
+        return registration.handler(params, context);
+    }
+    registerWorkspaceCapabilityProvider(namespaceOwner, provider) {
+        if (namespaceOwner.trim().length === 0) {
+            throw new Error("workspace capability provider requires a non-empty namespace owner");
+        }
+        if (this.#workspaceCapabilityProviders.has(namespaceOwner)) {
+            throw new Error(`workspace capability provider '${namespaceOwner}' is already registered`);
+        }
+        this.#workspaceCapabilityProviders.set(namespaceOwner, provider);
+    }
+    async readWorkspaceModuleState(workspaceId, namespaceOwner) {
+        const checkedWorkspaceId = ClientInput.assertId("workspace module state", "workspaceId", workspaceId);
+        if (namespaceOwner.trim().length === 0) {
+            throw new Error("workspace module state requires a non-empty namespace owner");
+        }
+        const row = await this.#db.workspace_module_state_get.get({
+            workspace_id: checkedWorkspaceId,
+            namespace_owner: namespaceOwner,
+        });
+        return row === undefined ? null : JSON.parse(row.state);
+    }
+    async replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes, }) {
+        const checkedWorkspaceId = ClientInput.assertId("workspace capability replacement", "workspaceId", workspaceId);
+        if (namespaceOwner.trim().length === 0) {
+            throw new Error("workspace capability replacement requires a non-empty namespace owner");
+        }
+        const workspace = await this.#db.envelope_get_workspace.get({ id: checkedWorkspaceId });
+        if (workspace === undefined) {
+            throw daemonFailure("daemon:workspace-capability", "workspace-not-found", 404, `Workspace ${checkedWorkspaceId} does not exist.`, { workspaceId: checkedWorkspaceId, retryable: false });
+        }
+        const encoded = state === null ? null : JSON.stringify(state);
+        if (state !== null && encoded === undefined) {
+            throw daemonFailure("daemon:workspace-capability", "state-not-json", 400, "Workspace module state is not JSON-serializable.", { namespaceOwner, retryable: false });
+        }
+        if (encoded !== null)
+            JSON.parse(encoded);
+        const normalized = runtimes.map((registration) => {
+            if (registration.namespaceOwner !== namespaceOwner) {
+                throw new Error(`workspace runtime owner '${registration.namespaceOwner}' does not match '${namespaceOwner}'`);
+            }
+            return this.#normalizeRuntime(registration);
+        });
+        const gate = this.#workspaceGate.tryExclusive(checkedWorkspaceId);
+        if (gate === null) {
+            throw daemonFailure("daemon:workspace-capability", "workspace-busy", 409, `Workspace ${checkedWorkspaceId} is running an operation or another capability change.`, {
+                workspaceId: checkedWorkspaceId,
+                namespaceOwner,
+                recovery: "Settle the current operation and retry the capability change.",
+                retryable: true,
+            });
+        }
+        await gate.acquired;
+        const prior = await this.#db.workspace_module_state_get.get({
+            workspace_id: checkedWorkspaceId,
+            namespace_owner: namespaceOwner,
+        });
+        let rollbackRuntimes;
+        let stateChanged = false;
+        try {
+            const commitRuntimes = await this.#engine.prepareWorkspaceRuntimes(checkedWorkspaceId, namespaceOwner, normalized);
+            if (encoded === null) {
+                await this.#db.workspace_module_state_delete.run({
+                    workspace_id: checkedWorkspaceId,
+                    namespace_owner: namespaceOwner,
+                });
+            }
+            else {
+                await this.#db.workspace_module_state_put.run({
+                    workspace_id: checkedWorkspaceId,
+                    namespace_owner: namespaceOwner,
+                    state: encoded,
+                });
+            }
+            stateChanged = true;
+            rollbackRuntimes = commitRuntimes();
+            if (this.#capabilitiesPublished) {
+                await LoopDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
+                await SkillDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
+            }
+        }
+        catch (cause) {
+            rollbackRuntimes?.();
+            const rollbackErrors = [];
+            if (stateChanged) {
+                try {
+                    if (prior === undefined) {
+                        await this.#db.workspace_module_state_delete.run({
+                            workspace_id: checkedWorkspaceId,
+                            namespace_owner: namespaceOwner,
+                        });
+                    }
+                    else {
+                        await this.#db.workspace_module_state_put.run({
+                            workspace_id: checkedWorkspaceId,
+                            namespace_owner: namespaceOwner,
+                            state: prior.state,
+                        });
+                    }
+                }
+                catch (rollbackCause) {
+                    rollbackErrors.push(rollbackCause);
+                }
+                if (this.#capabilitiesPublished) {
+                    try {
+                        await LoopDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
+                        await SkillDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
+                    }
+                    catch (rollbackCause) {
+                        rollbackErrors.push(rollbackCause);
+                    }
+                }
+            }
+            if (rollbackErrors.length > 0) {
+                throw new AggregateError([cause, ...rollbackErrors], "Workspace capability replacement and rollback failed");
+            }
+            throw cause;
+        }
+        finally {
+            gate.release();
+        }
     }
     get engine() { return this.#engine; }
     get provider() { return this.#provider; }
@@ -998,6 +1534,23 @@ export default class Daemon {
         // shell is the default runtime, so its executor must boot usable.
         const executors = await ExecutorRegistry.build({ defaultRuntime: "sh", cwd: this.#discoveryCwd });
         this.#engine.setExecutors(executors);
+        // {§question-tool} — the native request-user-input runtime, process-wide;
+        // per-worker admission gates its doc visibility and dispatch ({§worker-settings}).
+        await this.#engine.registerRuntimes([{
+                tag: "question",
+                entry: {
+                    executor: new QuestionTool({ runtime: "question", glyph: "❓" }),
+                    namespaceOwner: { kind: "module", name: "core" },
+                    glyph: "❓",
+                    summary: questionRuntimeDecl.summary,
+                    invocation: questionRuntimeDecl.invocation,
+                    details: questionRuntimeDecl.details ?? "",
+                    available: true,
+                    detail: "in-process",
+                },
+            }]);
+        // {§effect-policy-tunable} — invalid operator policy fails boot, not the first EXEC.
+        EffectPolicy.validateConfiguration();
         // {§exec} — mint a scheme per runtime tag so exec output entries address by tag
         // authority (sh:///l/t/s). The "exec" scheme stays for the EXEC op dispatch.
         this.#schemes.registerRuntimeSchemes(executors);
@@ -1005,18 +1558,34 @@ export default class Daemon {
         // (agnostic, by plurnk.kind:"scheme"). They light up http://, etc. with
         // no further engine change — #run wraps their context in SchemeCtxImpl ({§plugin-discovery}).
         await this.#schemes.discoverExternal(this.#discoveryCwd);
+        // {§module-discovery} — third-party daemon-module composition: trusted
+        // packages declaring `plurnk.kind: "module"` register beside the
+        // service's explicit composition before any module setup runs.
+        const discoveredModules = await discoverDaemonModules({ cwd: this.#discoveryCwd });
+        for (const packageName of discoveredModules.skipped) {
+            console.warn(`module discovery: '${packageName}' is discovered but untrusted (PLURNK_PLUGINS_TRUSTED_ONLY); not registered`);
+        }
+        for (const module of discoveredModules.modules) {
+            this.#modules.push(module);
+        }
         const setupSeam = this;
         for (const module of this.#modules) {
             if (module.close !== undefined)
                 this.#moduleClosers.push(module);
             await module.setup?.(setupSeam);
         }
+        for (const workspace of await Envelope.listWorkspaces(this.#db)) {
+            for (const provider of this.#workspaceCapabilityProviders.values()) {
+                await provider.hydrate(workspace.id);
+            }
+        }
         await this.#schemes.ready();
         // Reconcile the kernel-published documentation surface once per existing workspace.
         // Installed capabilities and operator configuration are now fully known; model loops
         // consume this workspace state but never republish it.
         for (const workspace of await Envelope.listWorkspaces(this.#db)) {
             await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
+            await SkillDocs.materialize(this.#engine, this.#db, workspace.id);
         }
         this.#capabilitiesPublished = true;
         await this.#recoverLifecycle();
@@ -1033,7 +1602,9 @@ export default class Daemon {
         await this.#db.recovery_fail_active_loops.run({});
         await this.#db.recovery_settle_open_provider_requests.run({});
         await this.#db.recovery_fail_open_model_calls.run({});
+        await this.#db.recovery_fail_open_turns.run({});
         await this.#db.recovery_fail_ownerless_proposals.run({});
+        await this.#db.recovery_remove_ownerless_client_interactions.run({});
         await this.#db.recovery_error_orphan_subscription_channels.run({});
         await this.#db.recovery_fail_orphan_subscriptions.run({});
         await this.#db.recovery_resume_unblocked_parks.run({});
@@ -1059,10 +1630,34 @@ export default class Daemon {
             await this.#drains.schedulePollWake(row.workspace_id, row.worker_id, systemPrompt);
         }
     }
+    // {§crash-only-stop} — the settle deadline. Default 30s; an operator can
+    // raise it for slow hosts or lower it for tests. 0 is refused (an unbounded
+    // stop is exactly the wedge this exists to prevent).
+    static #stopDeadlineMs() {
+        const raw = Number(process.env.PLURNK_SERVICE_STOP_TIMEOUT_MS ?? 30_000);
+        if (!Number.isSafeInteger(raw) || raw <= 0) {
+            throw new Error(`PLURNK_SERVICE_STOP_TIMEOUT_MS must be a positive integer; got ${JSON.stringify(process.env.PLURNK_SERVICE_STOP_TIMEOUT_MS)}.`);
+        }
+        return raw;
+    }
     async stop() {
         if (!this.#started)
             return;
         this.#started = false;
+        const stopDeadlineMs = Daemon.#stopDeadlineMs();
+        const deadline = Date.now() + stopDeadlineMs;
+        const settle = (label, wait) => new Promise((resolve) => {
+            let settled = false;
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve(result);
+            };
+            const timer = setTimeout(() => finish({ status: "rejected", reason: new Error(`stop deadline exceeded waiting for ${label}`) }), Math.max(0, deadline - Date.now()));
+            Promise.resolve().then(wait).then((value) => finish({ status: "fulfilled", value }), (reason) => finish({ status: "rejected", reason }));
+        });
         // Stop accepting external work immediately, but do not await listener
         // closure before cancelling active workers: an SSE connection may itself be
         // waiting for the worker cancellation that follows.
@@ -1087,27 +1682,35 @@ export default class Daemon {
         this.#engine.cancelDerivations(derivationAbort);
         this.#branchBatches.beginStop();
         this.#drains.beginStop("daemon_stopping");
-        await this.#branchBatches.idle();
-        const [drainResult] = await Promise.allSettled([this.#drains.idle()]);
-        const closeResults = await moduleClose;
-        const [streamingResult] = await Promise.allSettled([this.#drainStreamingSchemes()]);
-        const [derivationResult] = await Promise.allSettled([
-            this.#engine.drainDerivations(derivationAbort), // active workspace warms settle before the db closes upstream
-        ]);
-        const mimetypeResults = this.#ownsMimetypes
-            ? await Promise.allSettled([this.#mimetypes.dispose()])
-            : [];
-        const [schemeResult] = await Promise.allSettled([this.#schemes.close()]);
+        // {§crash-only-stop} — the settle sequence is DEADLINE-BOUNDED: a child
+        // that never closes (a wedged MCP server, a stuck stream) must not hang
+        // the daemon forever. Past the deadline the waits are abandoned; the
+        // process may exit with the WAL in place (SQLite recovers) rather than
+        // leak as a live-but-wedged tree.
+        const branchResult = await settle("branch batches idle", () => this.#branchBatches.idle());
+        const drainResult = await settle("drains idle", () => this.#drains.idle());
+        const moduleResult = await settle("modules close", async () => {
+            const results = await moduleClose;
+            if (results.some((r) => r.status === "rejected"))
+                throw new AggregateError(results.filter((r) => r.status === "rejected").map((r) => r.reason), "module close failed");
+        });
+        const streamingResult = await settle("streaming schemes idle", () => this.#drainStreamingSchemes());
+        const derivationResult = await settle("derivation drain", () => this.#engine.drainDerivations(derivationAbort));
+        const mimetypeResult = this.#ownsMimetypes
+            ? await settle("mimetypes dispose", () => this.#mimetypes.dispose())
+            : null;
+        const schemeResult = await settle("schemes close", () => this.#schemes.close());
         // Streaming and scheme closure are the last producers of synchronous
         // conclusion notifications. Join the supervisor-owned async tails only
         // after those producers settle, before the caller may close SQLite.
-        const [wakeResult] = await Promise.allSettled([this.#drains.idle()]);
+        const wakeResult = await settle("drains idle (wake)", () => this.#drains.idle());
         const closeErrors = [
-            ...closeResults,
+            moduleResult,
+            branchResult,
             drainResult,
             streamingResult,
             derivationResult,
-            ...mimetypeResults,
+            ...(mimetypeResult === null ? [] : [mimetypeResult]),
             schemeResult,
             wakeResult,
         ]
@@ -1179,8 +1782,9 @@ export default class Daemon {
             sequence: seqRow.next,
             prompt: first.body,
             flags: first.flags,
-            provider_spec: first.provider_spec,
-            child_provider_spec: first.child_provider_spec,
+            model_route_id: first.model_route_id,
+            spawn_model_route_id: first.spawn_model_route_id,
+            reasoning_policy: first.reasoning_policy,
             max_turns: first.max_turns,
             open_paths: first.open_paths ?? "[]",
             orphan_source_loop_id: endedLoopId,