@plurnk/plurnk-service 1.7.0 → 1.9.0

package/dist/server/Daemon.js

@@ -8,27 +8,36 @@ import ExecutorRegistry from "../core/ExecutorRegistry.js";
 import SchemeRegistry from "../core/SchemeRegistry.js";
 import { Mimetypes } from "@plurnk/plurnk-mimetypes";
 import { RuntimeDeclaration } from "@plurnk/plurnk-execs";
+import { projectModelRoute, routeForSpec, specForRoute } from "./model-route.js";
+import { discoverDaemonModules } from "./module-discovery.js";
+import WorkerSettingsReader from "../core/worker-settings.js";
+import EffectPolicy from "../schemes/EffectPolicy.js";
+import QuestionTool, { questionRuntimeDecl } from "../schemes/QuestionTool.js";
 import DrainSupervisor from "./DrainSupervisor.js";
 import { parsePath, Validator, } from "@plurnk/plurnk-contracts";
 import LogEntry from "./logEntry.js";
 import Envelope from "./envelope.js";
 import ClientInput from "./client-input.js";
-import JournalTurn from "../core/JournalTurn.js";
-import LoopDocs from "./loopDocs.js";
+import Turn from "../core/Turn.js";
+import SkillsFunctionality from "./SkillsFunctionality.js";
 import GitMembership from "../core/git-membership.js";
 import Fork from "../core/fork.js";
 import WorkerName from "../core/WorkerName.js";
+import WorkerControlAddress from "../core/WorkerControlAddress.js";
 import LoopLifecycle from "../core/LoopLifecycle.js";
 import { promptLoopPrefix } from "../core/plurnk-uri.js";
 import { contentWeight } from "../core/content-weight.js";
-import { parseAliasesFromEnv, resolveActiveAlias } from "@plurnk/plurnk-providers";
+import { parseAliasesFromEnv, resolveActiveRoute, UnsupportedReasoningPolicyError, } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "../core/ProviderInstantiate.js";
-import { resolveLoopAlias } from "./loop-model.js";
+import { resolveLoopRoute } from "./loop-model.js";
 import LoopFlagsReader from "../core/LoopFlagsReader.js";
 import Results, { OperationFailureError } from "../core/results.js";
 import WorkspaceGate from "../core/WorkspaceGate.js";
+import WorkerResidency from "./WorkerResidency.js";
 import BranchBatches from "./BranchBatches.js";
+import Functionality from "./Functionality.js";
 import { observed, observedSync } from "../observe/spans.js";
+import { listModelCatalog } from "./model-catalog.js";
 const clientActionFailure = (error) => {
     if (error instanceof OperationFailureError)
         return error.result;
@@ -40,6 +49,9 @@ const clientActionFailure = (error) => {
 };
 const daemonFailure = (owner, code, status, detail, extensions = {}) => new OperationFailureError(Results.failure(owner, code, status, detail, {}, extensions));
 const entryReadResult = (result) => Validator.assertEntryReadResult(result);
+const modelRouteLabel = (route) => route.alias === undefined
+    ? `model route '${route.provider}/${route.model}'`
+    : `provider alias '${route.alias}' (${route.provider}/${route.model})`;
 export default class Daemon {
     #db;
     #engine;
@@ -54,16 +66,17 @@ export default class Daemon {
     #nodeModulesPath;
     #discoveryCwd;
     #started = false; // {§module-lifecycle}: one discovery/module boot; no listener
-    #capabilitiesPublished = false;
     #modules = [];
     #moduleClosers = [];
     #moduleActions = new Map();
-    #workspaceCapabilityProviders = new Map();
+    #residency;
+    #functionality;
+    #skills;
     // {§methods-event-subscribe} — the broadcast's in-process event source. A transport
     // module (plurnk-agui) subscribes and fans out to its OWN clients; core emits, never owns
     // client transport or connection state.
     #eventSubscribers = new Set();
-    constructor({ db, schemes, mimetypes, provider, nodeModulesPath, }) {
+    constructor({ db, schemes, mimetypes, provider, nodeModulesPath, skills, }) {
         this.#db = db;
         this.#lifecycle = new LoopLifecycle(db);
         this.#schemes = schemes ?? new SchemeRegistry();
@@ -83,7 +96,7 @@ export default class Daemon {
             defaultMimetype: "text/markdown",
             discoverOptions: { cwd: this.#discoveryCwd },
         });
-        const bootSpec = resolveActiveAlias();
+        const bootSpec = resolveActiveRoute();
         if (this.#provider !== null && bootSpec !== null) {
             ProviderInstantiate.registerInstance(this.#provider, bootSpec);
         }
@@ -94,6 +107,26 @@ export default class Daemon {
             });
             return row !== undefined;
         });
+        // {§module-worker-residency} — residency, activation/cooling, and
+        // capability replacement live in their one owner; the Daemon delegates.
+        this.#residency = new WorkerResidency({
+            db,
+            engine: () => this.#engine,
+            workspaceGate: this.#workspaceGate,
+            normalizeRuntime: (registration) => this.#normalizeRuntime(registration),
+        });
+        // {§functionality-coordinator} — the one owner above every family
+        // adapter; Core hosts it, modules register adapters through the seam.
+        this.#functionality = new Functionality({
+            registerModuleAction: (registration) => this.registerModuleAction(registration),
+            registerWorkerCapabilityProvider: (owner, provider) => this.registerWorkerCapabilityProvider(owner, provider),
+            readWorkerModuleState: (workerId, owner) => this.readWorkerModuleState(workerId, owner),
+            replaceWorkerCapabilities: (replacement, options) => this.replaceWorkerCapabilities(replacement, options),
+            retainWorker: (workerId) => this.#residency.retain(workerId),
+        });
+        // {§skills-functionality} — Core's own family: standard Agent Skills.
+        this.#skills = new SkillsFunctionality({ db, ...skills });
+        this.#skills.attach(this.#functionality.register(this.#skills));
         this.#branchBatches = new BranchBatches(db, this.#workspaceGate, {
             settleWorkspace: async (workspaceId) => this.#engine.drainWorkspaceDerivations(workspaceId),
             createChild: async ({ workspaceId, parentWorkerId, parentLoopId, op, name, prompt, flags, origin }) => {
@@ -101,19 +134,31 @@ export default class Daemon {
                 const providerSpec = parentPolicy.childProviderSpec ?? parentPolicy.providerSpec;
                 const workerName = WorkerName.assert(name);
                 const workerId = op === "FORK"
-                    ? await Fork.fork(this.#db, parentWorkerId, workerName)
+                    ? await Fork.fork(this.#db, parentWorkerId, workerName, (scheme) => this.#schemes.entryInheritanceForStoredScheme(scheme, parentWorkerId))
                     : (await this.#db.fork_insert_worker.get({
                         workspace_id: workspaceId,
                         name: workerName,
                         parent_worker_id: parentWorkerId,
                         origin,
+                        fork_snapshot: 0,
                     }))?.id;
                 if (workerId === undefined)
                     throw new Error("Branch worker insert returned no row");
+                // {§worker-model-selection} — lineage inheritance by value: the branch
+                // child begins with the spawning loop's effective spawn model.
+                await this.#db.worker_generation_policy_update.run({
+                    id: workerId,
+                    model_route_id: await routeForSpec(this.#db, providerSpec),
+                    spawn_model_route_id: null,
+                    reasoning_policy: parentPolicy.reasoningPolicy,
+                });
+                const source = await this.#workerPromptSource(workspaceId, parentWorkerId, workerId);
                 const loopId = await this.#drains.enqueueFreshLoop({
                     workerId,
                     prompt,
+                    ...(source === undefined ? {} : { source }),
                     providerSpec,
+                    reasoningPolicy: parentPolicy.reasoningPolicy,
                     childProviderSpec: parentPolicy.childProviderSpec,
                     flags,
                 });
@@ -145,28 +190,56 @@ export default class Daemon {
             // model-independent. Request-shaped token facts stay provider-owned.
             weigh: contentWeight,
             streamEventNotify: (workspaceId, event) => this.notifyStreamEvent(workspaceId, event),
+            reasoningEventNotify: (workspaceId, event) => this.notifyReasoningEvent(workspaceId, event),
             wakeWorkerNotify: (payload) => this.#drains.notifyWakeWorker(payload),
             // worker:// loop-start primitive — spawn/fork/irc deliver through
             // Daemon.inject (active sister → fold; idle → enqueue + drain). The
             // daemon owns provider + the law-file system prompt; the worker scheme
             // handler carries neither. Fire-and-forget: the returned drain runs
             // independently (the sister is its own worker). {§machine-processes}
-            injectWorker: async ({ workspaceId, workerId, prompt, flags, parentLoopId }) => {
+            injectWorker: async ({ workspaceId, workerId, sourceWorkerId, prompt, flags, parentLoopId }) => {
+                await this.#assertModelWorker(workspaceId, workerId);
+                const source = await this.#workerPromptSource(workspaceId, sourceWorkerId, workerId);
                 const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-                const parentPolicy = parentLoopId === undefined
-                    ? null
-                    : await this.#providerPolicyForLoop(parentLoopId);
-                const providerSpec = parentPolicy === null
-                    ? resolveActiveAlias()
-                    : parentPolicy.childProviderSpec ?? parentPolicy.providerSpec;
-                if (providerSpec === null)
-                    throw new Error("injectWorker: active provider has no resolvable alias");
+                let providerSpec;
+                let childProviderSpec;
+                let reasoningPolicy;
+                if (parentLoopId === undefined) {
+                    // {§worker-model-selection} — the voice door addresses an
+                    // existing worker. Its own durable generation policy is the
+                    // receiver's identity; the daemon default and sender do not
+                    // overwrite it merely because a new loop must be minted.
+                    const targetPolicy = await this.#resolveWorkerModel(workerId, undefined);
+                    if (targetPolicy === null) {
+                        throw new Error(`injectWorker: worker ${workerId} has no resolvable model route`);
+                    }
+                    providerSpec = targetPolicy.providerSpec;
+                    reasoningPolicy = targetPolicy.reasoningPolicy;
+                    childProviderSpec = await this.#resolveWorkerSpawnModel(workerId, undefined);
+                }
+                else {
+                    const parentPolicy = await this.#providerPolicyForLoop(parentLoopId);
+                    providerSpec = parentPolicy.childProviderSpec ?? parentPolicy.providerSpec;
+                    reasoningPolicy = parentPolicy.reasoningPolicy;
+                    // {§worker-model-selection} — lineage inheritance by value:
+                    // the child begins with the spawning loop's effective spawn
+                    // model and no separate override of its own.
+                    childProviderSpec = null;
+                    await this.#db.worker_generation_policy_update.run({
+                        id: workerId,
+                        model_route_id: await routeForSpec(this.#db, providerSpec),
+                        spawn_model_route_id: null,
+                        reasoning_policy: reasoningPolicy,
+                    });
+                }
                 const { action, loopId } = await this.inject({
                     workspaceId,
                     workerId,
                     prompt,
+                    ...(source === undefined ? {} : { source }),
                     providerSpec,
-                    ...(parentPolicy === null ? {} : { childProviderSpec: parentPolicy.childProviderSpec }),
+                    reasoningPolicy,
+                    childProviderSpec,
                     systemPrompt,
                     ...(flags === undefined ? {} : { flags }),
                 });
@@ -175,7 +248,15 @@ export default class Daemon {
             branchWorker: async (args) => this.#branchBatches.enqueue(args),
             branchCompletionGate: async (workerId) => this.#branchBatches.completionGate(workerId),
             acquireWorkspaceTurn: async (workspaceId, workerId) => this.#workspaceGate.acquireTurn(workspaceId, workerId),
-            workspaceTurnCompleted: async ({ turnId }) => this.#branchBatches.sealTurn(turnId),
+            // {§skills-hotload} — filesystem installers operate out of band.
+            // Republish under the workspace turn gate before packet assembly so
+            // the first subsequent model turn sees their exact result.
+            workspaceTurnStarting: async ({ workspaceId, workerId }) => {
+                await this.#skills.refreshIfChanged({ workspaceId, workerId });
+            },
+            workspaceTurnCompleted: async ({ turnId }) => {
+                await this.#branchBatches.sealTurn(turnId);
+            },
             // worker:// KILL (terminate) — cancel the addressed worker subtree and
             // tear down its held streams before the operation completes.
             cancelWorker: async (workerId, reason) => this.#drains.cancelWorkerTree(workerId, reason),
@@ -185,10 +266,15 @@ export default class Daemon {
         this.#drains = new DrainSupervisor({
             db,
             lifecycle: this.#lifecycle,
-            injectPrompt: (workerId, prompt, openPaths) => this.#engine.inject(workerId, prompt, openPaths),
-            assertInjectionCompatibility: async ({ workerId, loopId, providerSpec, childProviderSpec, turnCeiling, flags, }) => {
+            injectPrompt: (workerId, prompt, openPaths, source) => this.#engine.inject(workerId, prompt, openPaths, source),
+            assertInjectionCompatibility: async ({ workerId, loopId, providerSpec, providerSpecExplicit, reasoningPolicy, childProviderSpec, turnCeiling, flags, }) => {
                 await this.#assertFoldPosture(workerId, flags, loopId);
-                await this.#assertLoopProvider(loopId, providerSpec);
+                // An omitted selector keeps the loop's durable provider; only an
+                // explicit selection is checked against it (a deliberate switch).
+                if (providerSpecExplicit !== false) {
+                    await this.#assertLoopProvider(loopId, providerSpec);
+                }
+                await this.#assertLoopReasoningPolicy(loopId, reasoningPolicy);
                 if (childProviderSpec !== undefined) {
                     await this.#assertLoopChildProvider(loopId, childProviderSpec);
                 }
@@ -196,22 +282,34 @@ export default class Daemon {
             },
             reconcilePrompts: (workerId, endedLoopId) => this.#reconcileOrphanedPrompts(workerId, endedLoopId),
             runLoop: async ({ workspaceId, workerId, loopId, maxTurns, prompt, systemPrompt, signal, onDispatch, }) => {
-                const { provider, childProvider } = await this.#providersForLoop(loopId);
-                return this.#engine.runLoop({
-                    provider,
-                    childProvider,
-                    workspaceId,
-                    workerId,
-                    loopId,
-                    maxTurns,
-                    messages: [
-                        { role: "system", content: systemPrompt },
-                        { role: "user", content: prompt },
-                    ],
-                    origin: "model",
-                    signal,
-                    onDispatch,
-                });
+                // The drain callback is the final provider/model boundary. Every
+                // admission path, including boot recovery, terminates here.
+                await this.#assertModelWorker(workspaceId, workerId);
+                const releaseCapabilities = await this.#residency.acquire(workspaceId, workerId);
+                try {
+                    // Worker settings can change while Functionality remains
+                    // resident. Reconcile the worker-private discovery surface
+                    // at the same pre-inference boundary used for activation.
+                    await this.#residency.reconcile(workspaceId, workerId);
+                    const { provider, childProvider } = await this.#providersForLoop(loopId);
+                    return await this.#engine.runLoop({
+                        provider,
+                        childProvider,
+                        workspaceId,
+                        workerId,
+                        loopId,
+                        maxTurns,
+                        messages: [
+                            { role: "system", content: systemPrompt },
+                            { role: "user", content: prompt },
+                        ],
+                        signal,
+                        onDispatch,
+                    });
+                }
+                finally {
+                    releaseCapabilities();
+                }
             },
             loopUsage: (loopId) => this.#engine.loopUsage(loopId),
             loopAttributions: (loopId) => this.#engine.loopAttributions(loopId),
@@ -220,7 +318,6 @@ export default class Daemon {
                 this.#engine.parkDeadlines.delete(loopId);
                 return deadline;
             },
-            settleSearch: (target, status) => this.#engine.searchGate.settle(target, status),
             cancelSubscription: (subscriptionId) => this.#engine.cancelSubscription(subscriptionId),
             hasActiveStreams: (workerId) => this.#workerHasActiveStreams(workerId),
             readSystemPrompt: () => readFile(Paths.instructionsSystem, "utf8"),
@@ -279,60 +376,31 @@ export default class Daemon {
     async runLoop(args) {
         const workspaceId = ClientInput.assertId("runLoop", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("runLoop", "workerId", args.workerId);
+        await this.#assertModelWorker(workspaceId, workerId);
         const prompt = ClientInput.assertPrompt("runLoop", args.prompt);
+        const source = ClientInput.assertOptionalSource("runLoop", args.source);
         const requestedMaxTurns = ClientInput.assertMaxTurns("runLoop", args.maxTurns);
         const openPaths = ClientInput.assertOpenPaths("runLoop", args.openPaths);
-        const alias = ClientInput.assertOptionalSelector("runLoop", "alias", args.alias);
-        const model = ClientInput.assertOptionalSelector("runLoop", "model", args.model);
-        const childAlias = ClientInput.assertOptionalChildAlias("runLoop", args.childAlias);
-        const childModel = ClientInput.assertOptionalSelector("runLoop", "childModel", args.childModel);
-        if (childAlias === null && childModel !== undefined) {
-            throw daemonFailure("daemon:input", "child-provider-conflict", 400, "childModel cannot accompany an inherited child provider policy.", { field: "childModel", recovery: "Omit childModel or select a child alias.", retryable: false });
-        }
+        const selector = ClientInput.assertOptionalSelector("runLoop", "selector", args.selector);
+        const childSelector = ClientInput.assertOptionalChildSelector("runLoop", args.childSelector);
         const flags = ClientInput.normalizeLoopFlags("runLoop", args.flags);
-        // {§methods-loop-run-model} — a client sends alias/model on every loop, so a
-        // switch takes effect turn-to-turn. `model` (client-resolved <provider>/<model>) wins
-        // over `alias`; neither → the boot default. Instantiation is cached, so ping-ponging
-        // between two models is cheap, and an unresolvable alias/model fails loud here.
-        const selection = await this.#resolveLoopProvider(alias, model);
-        if (selection === null) {
-            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this loop.", {}, {
+        // {§worker-model-selection} — the worker owns the model. An explicit selector
+        // persists onto the worker; an omitted selector resolves the worker's durable model
+        // (seeded once from the daemon default). The loop then snapshots the resolved route.
+        // A continuation's omitted selector must still keep the loop's durable provider.
+        const selectorExplicit = selector !== undefined;
+        const generationPolicy = await this.#resolveWorkerModel(workerId, selector);
+        if (generationPolicy === null) {
+            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this worker.", {}, {
                 stage: "provider-selection",
                 recovery: "Select a configured model provider.",
                 retryable: false,
             }));
         }
-        // {§methods-loop-run-child-provider}
-        const configuredChildAlias = childAlias === undefined && childModel === undefined
-            ? process.env.PLURNK_MODEL_CHILD
-            : childAlias;
-        const childSelection = configuredChildAlias === null
-            || (configuredChildAlias === undefined && childModel === undefined)
-            ? null
-            : await this.#resolveLoopProvider(configuredChildAlias, childModel);
+        const { providerSpec: selection, reasoningPolicy } = generationPolicy;
+        // {§methods-loop-run-child-provider} — the worker's persistent spawn override.
+        const childSelection = await this.#resolveWorkerSpawnModel(workerId, childSelector);
         const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-        // {§machine-processes} — the model NEVER runs in a client-origin worker (its packets would carry
-        // client-action rows). The module resolves the model worker via ensureModelWorker and passes it (or a
-        // fork); a client worker here is a caller error, refused loudly rather than silently rehomed.
-        const target = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
-        if (target === undefined) {
-            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
-        }
-        if (target.workspace_id !== workspaceId) {
-            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, {
-                workerId,
-                workspaceId,
-                actualWorkspaceId: target.workspace_id,
-                retryable: false,
-            });
-        }
-        if (target.origin === "client") {
-            throw daemonFailure("daemon:worker", "model-worker-required", 409, `Worker ${workerId} is not a model worker.`, {
-                workerId,
-                recovery: "Select or create a model worker for this loop.",
-                retryable: false,
-            });
-        }
         // {§operator-config-max-turns-ceiling} — the operator ceiling clamps a per-call maxTurns; a
         // seam caller must not bypass operator policy (inject only DEFAULTS from env, never clamps).
         const ceiling = Number(process.env.PLURNK_SERVICE_MAX_TURNS ?? "-1");
@@ -346,76 +414,187 @@ export default class Daemon {
             workspaceId,
             workerId,
             prompt,
+            ...(source === undefined ? {} : { source }),
             ...(flags !== undefined ? { flags } : {}),
             ...(openPaths !== undefined ? { openPaths } : {}),
             turnCeiling,
             providerSpec: selection,
+            providerSpecExplicit: selectorExplicit,
+            reasoningPolicy,
             childProviderSpec: childSelection,
             systemPrompt,
         });
         return { status: 100, action, loopId, ...(turnSeq !== undefined ? { turnSeq } : {}) };
     }
-    // {§methods-loop-run-model} — resolve a per-loop model override to a cached Provider. `model`
-    // (<provider>/<model>, client-resolved) wins over a named `alias`; absent both, the
-    // boot default. A named alias missing from the env cascade, or a malformed model spec, throws
-    // legibly rather than silently running the wrong model.
-    async #resolveLoopProvider(alias, model) {
-        const requested = resolveLoopAlias(alias, model, parseAliasesFromEnv());
+    // {§methods-loop-run-model} — resolve one alias-or-route selector to a cached
+    // Provider; absent uses the boot default. An unknown alias or malformed exact
+    // route throws legibly rather than silently running the wrong model.
+    async #resolveLoopProvider(selector, reasoningPolicy) {
+        const requested = resolveLoopRoute(selector, parseAliasesFromEnv());
         if (requested === null && this.#provider === null)
             return null;
-        const spec = requested ?? resolveActiveAlias();
+        const spec = requested ?? resolveActiveRoute();
         if (spec === null) {
-            throw daemonFailure("daemon:provider", "active-alias-unresolved", 500, "The active provider has no resolvable alias.", { stage: "provider-selection", retryable: false });
+            throw daemonFailure("daemon:provider", "active-model-unresolved", 500, "The active provider has no resolvable model route.", { stage: "provider-selection", retryable: false });
         }
-        // Resolve eagerly so runLoop fails before enqueue when the provider
-        // cannot be constructed. The drain later retrieves this cached handle
-        // from the loop's durable spec at the claim boundary.
+        await this.#providerForPolicy(spec, reasoningPolicy);
+        return spec;
+    }
+    // Resolve eagerly so runLoop fails before enqueue when the selected route
+    // and durable reasoning policy cannot compose. The drain later retrieves
+    // this cached handle from the loop's immutable snapshot.
+    async #providerForPolicy(spec, reasoningPolicy) {
         try {
-            await ProviderInstantiate.instantiateProvider(spec);
+            const provider = await ProviderInstantiate.instantiateProvider(spec, process.env, reasoningPolicy);
+            ProviderInstantiate.validateGrammarConfiguration(provider, process.env, reasoningPolicy);
+            return provider;
         }
         catch (cause) {
             if (cause instanceof OperationFailureError)
                 throw cause;
-            console.error(`Provider alias '${spec.alias}' could not be instantiated:`, cause);
-            throw daemonFailure("daemon:provider", "provider-unavailable", 503, `Provider alias '${spec.alias}' is unavailable.`, {
-                alias: spec.alias,
+            if (cause instanceof UnsupportedReasoningPolicyError) {
+                throw daemonFailure("daemon:provider", "reasoning-policy-unsupported", 409, `${modelRouteLabel(spec)} does not support reasoning policy '${cause.policy}'.`, {
+                    ...(spec.alias === undefined ? {} : { alias: spec.alias }),
+                    provider: spec.provider,
+                    model: spec.model,
+                    reasoningPolicy: cause.policy,
+                    supportedReasoningPolicies: cause.supported,
+                    stage: "provider-selection",
+                    recovery: "Select one of the provider's supported reasoning policies.",
+                    retryable: false,
+                });
+            }
+            console.error(`${modelRouteLabel(spec)} could not be instantiated:`, cause);
+            throw daemonFailure("daemon:provider", "provider-unavailable", 503, `${modelRouteLabel(spec)} is unavailable.`, {
+                ...(spec.alias === undefined ? {} : { alias: spec.alias }),
                 provider: spec.provider,
                 model: spec.model,
                 stage: "provider-selection",
                 retryable: false,
             });
         }
-        return spec;
     }
-    #parseProviderSpec(loopId, field, encoded) {
-        let parsed;
-        try {
-            parsed = JSON.parse(encoded);
+    // {§worker-model-selection} — a model worker owns one durable model. An explicit
+    // selector persists onto the worker; an omitted selector resolves the worker's
+    // durable model, seeded once from the daemon default. A deliberately modelless
+    // daemon leaves the worker unset until an explicit selection arrives.
+    async #resolveWorkerModel(workerId, selector) {
+        const worker = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (worker === undefined)
+            throw new Error(`worker ${workerId}: model route row missing`);
+        if (selector !== undefined) {
+            const spec = await this.#resolveLoopProvider(selector, worker.reasoning_policy ?? undefined);
+            if (spec === null)
+                return null;
+            const reasoningPolicy = worker.reasoning_policy
+                ?? ProviderInstantiate.configuredReasoningPolicy(spec);
+            if (worker.spawn_model_route_id !== null) {
+                const spawnSpec = await specForRoute(this.#db, worker.spawn_model_route_id);
+                if (spawnSpec === null)
+                    throw new Error(`worker ${workerId}: spawn model route is missing`);
+                await this.#providerForPolicy(spawnSpec, reasoningPolicy);
+            }
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: await routeForSpec(this.#db, spec),
+                spawn_model_route_id: worker.spawn_model_route_id,
+                reasoning_policy: reasoningPolicy,
+            });
+            return { providerSpec: spec, reasoningPolicy };
         }
-        catch {
-            throw new Error(`loop ${loopId}: persisted ${field} is malformed`);
+        if (worker.model_route_id !== null) {
+            if (worker.reasoning_policy === null) {
+                throw new Error(`worker ${workerId}: durable model has no reasoning policy`);
+            }
+            const spec = await specForRoute(this.#db, worker.model_route_id);
+            if (spec === null)
+                throw new Error(`worker ${workerId}: model route is missing`);
+            await this.#providerForPolicy(spec, worker.reasoning_policy);
+            return { providerSpec: spec, reasoningPolicy: worker.reasoning_policy };
         }
-        if (parsed === null)
+        if (this.#provider === null)
             return null;
-        if (typeof parsed.alias !== "string" || parsed.alias.length === 0
-            || typeof parsed.provider !== "string" || parsed.provider.length === 0
-            || typeof parsed.model !== "string" || parsed.model.length === 0
-            || (parsed.baseUrl !== undefined && typeof parsed.baseUrl !== "string")) {
-            throw new Error(`loop ${loopId}: persisted ${field} is invalid`);
+        const spec = resolveActiveRoute();
+        if (spec !== null) {
+            const reasoningPolicy = ProviderInstantiate.configuredReasoningPolicy(spec);
+            await this.#providerForPolicy(spec, reasoningPolicy);
+            if (worker.spawn_model_route_id !== null) {
+                const spawnSpec = await specForRoute(this.#db, worker.spawn_model_route_id);
+                if (spawnSpec === null)
+                    throw new Error(`worker ${workerId}: spawn model route is missing`);
+                await this.#providerForPolicy(spawnSpec, reasoningPolicy);
+            }
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: await routeForSpec(this.#db, spec),
+                spawn_model_route_id: worker.spawn_model_route_id,
+                reasoning_policy: reasoningPolicy,
+            });
+            return { providerSpec: spec, reasoningPolicy };
         }
-        return parsed;
+        return null;
     }
+    // {§worker-model-selection} — the persistent spawn override. An explicit child
+    // selector persists onto the worker (null clears it back to inherit); an omitted
+    // selector resolves the persisted override, seeded once from the operator's
+    // PLURNK_MODEL_CHILD default.
+    async #resolveWorkerSpawnModel(workerId, childSelector) {
+        const worker = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (worker === undefined)
+            throw new Error(`worker ${workerId}: model route row missing`);
+        if (childSelector !== undefined) {
+            const spec = childSelector === null
+                ? null
+                : await this.#resolveLoopProvider(childSelector, worker.reasoning_policy ?? undefined);
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: worker.model_route_id,
+                spawn_model_route_id: spec === null ? null : await routeForSpec(this.#db, spec),
+                reasoning_policy: worker.reasoning_policy,
+            });
+            return spec;
+        }
+        if (worker.spawn_model_route_id !== null) {
+            const spec = await specForRoute(this.#db, worker.spawn_model_route_id);
+            if (spec === null)
+                throw new Error(`worker ${workerId}: spawn model route is missing`);
+            if (worker.reasoning_policy !== null) {
+                await this.#providerForPolicy(spec, worker.reasoning_policy);
+            }
+            return spec;
+        }
+        const configured = process.env.PLURNK_MODEL_CHILD;
+        if (configured === undefined || configured.length === 0)
+            return null;
+        const spec = await this.#resolveLoopProvider(configured, worker.reasoning_policy ?? undefined);
+        if (spec !== null) {
+            await this.#db.worker_generation_policy_update.run({
+                id: workerId,
+                model_route_id: worker.model_route_id,
+                spawn_model_route_id: await routeForSpec(this.#db, spec),
+                reasoning_policy: worker.reasoning_policy,
+            });
+        }
+        return spec;
+    }
+    // {§worker-model-selection} — the loop's durable snapshot is the immutable route ids,
+    // resolved through model_routes at the claim boundary; never re-resolved through the
+    // alias cascade (a changed alias declaration must not rewrite history).
     async #providerPolicyForLoop(loopId) {
-        const row = await this.#db.drain_loop_provider_spec.get({ loop_id: loopId });
+        const row = await this.#db.drain_loop_generation_policy.get({ loop_id: loopId });
         if (row === undefined)
             throw new Error(`loop ${loopId}: provider selection row is missing`);
-        const providerSpec = this.#parseProviderSpec(loopId, "provider_spec", row.provider_spec);
+        const providerSpec = await specForRoute(this.#db, row.model_route_id);
         if (providerSpec === null) {
-            throw new Error(`loop ${loopId}: persisted provider selection is missing or invalid — refusing boot-default substitution`);
+            throw new Error(`loop ${loopId}: persisted provider selection is missing — refusing boot-default substitution`);
+        }
+        if (row.reasoning_policy === null) {
+            throw new Error(`loop ${loopId}: persisted reasoning policy is missing`);
         }
         return {
             providerSpec,
-            childProviderSpec: this.#parseProviderSpec(loopId, "child_provider_spec", row.child_provider_spec),
+            childProviderSpec: await specForRoute(this.#db, row.spawn_model_route_id),
+            reasoningPolicy: row.reasoning_policy,
         };
     }
     async #providerSpecForLoop(loopId) {
@@ -423,20 +602,20 @@ export default class Daemon {
     }
     async #providersForLoop(loopId) {
         const policy = await this.#providerPolicyForLoop(loopId);
-        const provider = await ProviderInstantiate.instantiateProvider(policy.providerSpec);
+        const provider = await this.#providerForPolicy(policy.providerSpec, policy.reasoningPolicy);
         const childProvider = policy.childProviderSpec === null
             ? provider
-            : await ProviderInstantiate.instantiateProvider(policy.childProviderSpec);
+            : await this.#providerForPolicy(policy.childProviderSpec, policy.reasoningPolicy);
         return { provider, childProvider };
     }
     async #assertLoopProvider(loopId, requested) {
         const selected = await this.#providerSpecForLoop(loopId);
         if (JSON.stringify(selected) !== JSON.stringify(requested)) {
-            throw daemonFailure("daemon:provider", "loop-provider-conflict", 409, `Loop ${loopId} uses provider alias '${selected.alias}', not '${requested.alias}'.`, {
+            throw daemonFailure("daemon:provider", "loop-provider-conflict", 409, `Loop ${loopId} uses ${modelRouteLabel(selected)}, not ${modelRouteLabel(requested)}.`, {
                 loopId,
-                selectedAlias: selected.alias,
+                ...(selected.alias === undefined ? {} : { selectedAlias: selected.alias }),
                 selectedModel: `${selected.provider}/${selected.model}`,
-                requestedAlias: requested.alias,
+                ...(requested.alias === undefined ? {} : { requestedAlias: requested.alias }),
                 requestedModel: `${requested.provider}/${requested.model}`,
                 stage: "loop-injection",
                 recovery: "Cancel or conclude the loop before selecting another provider.",
@@ -444,13 +623,28 @@ export default class Daemon {
             });
         }
     }
+    async #assertLoopReasoningPolicy(loopId, requested) {
+        const selected = (await this.#providerPolicyForLoop(loopId)).reasoningPolicy;
+        if (selected !== requested) {
+            throw daemonFailure("daemon:provider", "loop-reasoning-policy-conflict", 409, `Loop ${loopId} uses reasoning policy '${selected}', not '${requested}'.`, {
+                loopId,
+                selectedReasoningPolicy: selected,
+                requestedReasoningPolicy: requested,
+                stage: "loop-injection",
+                recovery: "Cancel or conclude the loop before selecting another reasoning policy.",
+                retryable: false,
+            });
+        }
+    }
     async #assertLoopChildProvider(loopId, requested) {
         const selected = (await this.#providerPolicyForLoop(loopId)).childProviderSpec;
         if (JSON.stringify(selected) !== JSON.stringify(requested)) {
             throw daemonFailure("daemon:provider", "loop-child-provider-conflict", 409, `Loop ${loopId} already has a different child provider policy.`, {
                 loopId,
                 selectedChildAlias: selected?.alias ?? null,
+                selectedChildModel: selected === null ? null : `${selected.provider}/${selected.model}`,
                 requestedChildAlias: requested?.alias ?? null,
+                requestedChildModel: requested === null ? null : `${requested.provider}/${requested.model}`,
                 stage: "loop-injection",
                 recovery: "Cancel or conclude the loop before changing its child provider policy.",
                 retryable: false,
@@ -476,69 +670,316 @@ export default class Daemon {
     }
     // {§methods-model-worker} — the workspace's model worker (created on first use), distinct from the client
     // worker so the model's packets never carry client-action rows. The module binds its threads to this.
-    ensureModelWorker(workspaceId) {
-        return Envelope.ensureModelWorker(this.#db, ClientInput.assertId("worker.ensure-model", "workspaceId", workspaceId));
+    // Optional worker settings ({§worker-settings}) ride the client's per-run declaration: merged in on
+    // creation AND on every subsequent ensure, so a client can change its mind between loops.
+    async ensureModelWorker(workspaceId, settings) {
+        const checked = ClientInput.assertId("worker.ensure-model", "workspaceId", workspaceId);
+        const created = await Envelope.ensureModelWorker(this.#db, checked);
+        if (settings !== undefined)
+            await this.#mergeWorkerSettings(created, settings);
+        return created;
+    }
+    // {§worker-settings} — merge known keys into the worker's behavioral-rules bag.
+    // Validated at the boundary; unprovided keys keep their durable value.
+    async #mergeWorkerSettings(workerId, settings) {
+        const current = await WorkerSettingsReader.read(this.#db, workerId);
+        const merged = {
+            requestUserInput: settings.requestUserInput ?? current.requestUserInput,
+        };
+        await this.#db.worker_settings_update.run({ id: workerId, settings: JSON.stringify(merged) });
+    }
+    // {§worker-settings} — project the worker's behavioral rules for a client-interface surface.
+    async readWorkerSettings(args) {
+        const workspaceId = ClientInput.assertId("worker.settings.get", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.settings.get", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        const settings = await WorkerSettingsReader.read(this.#db, workerId);
+        return { requestUserInput: settings.requestUserInput };
+    }
+    // {§worker-settings} — persist known behavioral-rule keys; unknown keys are
+    // rejected at the input boundary, never persisted.
+    async setWorkerSettings(args) {
+        const workspaceId = ClientInput.assertId("worker.settings.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.settings.set", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        ClientInput.parseWorkerSettings(args.settings);
+        await this.#mergeWorkerSettings(workerId, args.settings);
+        const settings = await WorkerSettingsReader.read(this.#db, workerId);
+        return { requestUserInput: settings.requestUserInput };
+    }
+    // {§worker-model-selection} — project a worker's durable model and spawn override
+    // for a client-interface get/set surface. Ownership is checked at this boundary.
+    async readWorkerModel(args) {
+        const workspaceId = ClientInput.assertId("worker.model.get", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.model.get", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (row === undefined)
+            throw new Error(`worker ${workerId}: model route row missing`);
+        const modelSpec = await specForRoute(this.#db, row.model_route_id);
+        const spawnModelSpec = await specForRoute(this.#db, row.spawn_model_route_id);
+        return {
+            model: modelSpec === null ? null : projectModelRoute(modelSpec),
+            spawnModel: spawnModelSpec === null ? null : projectModelRoute(spawnModelSpec),
+        };
+    }
+    // {§worker-model-selection} — persist an explicit model selection onto the worker
+    // and return the resolved spec. An unresolvable selector fails loud here.
+    async setWorkerModel(args) {
+        const workspaceId = ClientInput.assertId("worker.model.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.model.set", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertWorkerSelectable(workerId);
+        const selector = ClientInput.assertSelector("worker.model.set", "selector", args.selector);
+        const policy = await this.#resolveWorkerModel(workerId, selector);
+        if (policy === null) {
+            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this worker.", {}, { stage: "provider-selection", recovery: "Select a configured model provider.", retryable: false }));
+        }
+        return projectModelRoute(policy.providerSpec);
+    }
+    async #reasoningSupportForWorker(workerId, row, providerSpec, policy) {
+        const provider = await this.#providerForPolicy(providerSpec, policy);
+        if (row.spawn_model_route_id === null)
+            return provider.supportedReasoningPolicies;
+        const spawnSpec = await specForRoute(this.#db, row.spawn_model_route_id);
+        if (spawnSpec === null)
+            throw new Error(`worker ${workerId}: spawn model route is missing`);
+        const spawnProvider = await this.#providerForPolicy(spawnSpec, policy);
+        return provider.supportedReasoningPolicies.filter((candidate) => spawnProvider.supportedReasoningPolicies.includes(candidate));
+    }
+    // {§worker-reasoning-policy} — the worker's reasoning policy is durable and
+    // provider-relative. A model-less worker remains explicitly uninitialized.
+    async readWorkerReasoning(args) {
+        const workspaceId = ClientInput.assertId("worker.reasoning.get", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.reasoning.get", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#resolveWorkerModel(workerId, undefined);
+        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (row === undefined)
+            throw new Error(`worker ${workerId}: generation policy row missing`);
+        if (row.model_route_id === null) {
+            if (row.reasoning_policy !== null) {
+                throw new Error(`worker ${workerId}: reasoning policy exists without a model route`);
+            }
+            return { policy: null, supportedPolicies: [] };
+        }
+        if (row.reasoning_policy === null) {
+            throw new Error(`worker ${workerId}: durable model has no reasoning policy`);
+        }
+        const spec = await specForRoute(this.#db, row.model_route_id);
+        if (spec === null)
+            throw new Error(`worker ${workerId}: model route is missing`);
+        return {
+            policy: row.reasoning_policy,
+            supportedPolicies: await this.#reasoningSupportForWorker(workerId, row, spec, row.reasoning_policy),
+        };
+    }
+    // {§worker-reasoning-policy} — mutate between loops, validate against both
+    // the worker model and its optional spawn model, then persist atomically.
+    async setWorkerReasoning(args) {
+        const workspaceId = ClientInput.assertId("worker.reasoning.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.reasoning.set", "workerId", args.workerId);
+        let policy;
+        try {
+            policy = Validator.assertReasoningPolicy(args.policy);
+        }
+        catch (cause) {
+            throw daemonFailure("daemon:input", "reasoning-policy-invalid", 400, cause instanceof Error ? cause.message : "The reasoning policy is invalid.", { field: "policy", retryable: false });
+        }
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertWorkerSelectable(workerId);
+        await this.#resolveWorkerModel(workerId, undefined);
+        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
+        if (row === undefined)
+            throw new Error(`worker ${workerId}: generation policy row missing`);
+        const spec = await specForRoute(this.#db, row.model_route_id);
+        if (spec === null) {
+            throw daemonFailure("daemon:provider", "worker-model-unset", 409, `Worker ${workerId} has no model against which to validate a reasoning policy.`, {
+                workerId,
+                stage: "provider-selection",
+                recovery: "Select a model before selecting its reasoning policy.",
+                retryable: false,
+            });
+        }
+        const supportedPolicies = await this.#reasoningSupportForWorker(workerId, row, spec, policy);
+        await this.#db.worker_generation_policy_update.run({
+            id: workerId,
+            model_route_id: row.model_route_id,
+            spawn_model_route_id: row.spawn_model_route_id,
+            reasoning_policy: policy,
+        });
+        return { policy, supportedPolicies };
+    }
+    // {§worker-model-selection} — persist the worker's spawn override; a null
+    // selector means inherit (clears the override).
+    async setWorkerSpawnModel(args) {
+        const workspaceId = ClientInput.assertId("worker.child.set", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.child.set", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#assertWorkerSelectable(workerId);
+        const selector = ClientInput.assertChildSelector("worker.child.set", args.selector);
+        const spec = await this.#resolveWorkerSpawnModel(workerId, selector);
+        return spec === null ? null : projectModelRoute(spec);
+    }
+    // {§worker-model-selection} — a selection must not mutate underneath active
+    // work: a live or parked loop is a precise 409, never a silent retroactive
+    // switch of the immutable loop snapshot.
+    async #assertWorkerSelectable(workerId) {
+        if (await this.#drains.hasLiveWork(workerId)) {
+            throw daemonFailure("daemon:worker", "worker-loop-active", 409, `Worker ${workerId} has a live or parked loop; select a model after concluding or cancelling it.`, {
+                workerId,
+                stage: "model-selection",
+                recovery: "Conclude or cancel the active loop before selecting a model.",
+                retryable: false,
+            });
+        }
+    }
+    async #assertWorkerOwned(workspaceId, workerId) {
+        const owner = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
+        if (owner === undefined) {
+            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
+        }
+        if (owner.workspace_id !== workspaceId) {
+            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, { workerId, workspaceId, actualWorkspaceId: owner.workspace_id });
+        }
+    }
+    // {§machine-processes} — provider inference is an exclusive capability of a
+    // model worker. The same assertion is used by early client admissions and
+    // the final drain callback, so recovery and internal callers cannot bypass it.
+    async #assertModelWorker(workspaceId, workerId) {
+        const worker = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
+        if (worker === undefined) {
+            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
+        }
+        if (worker.workspace_id !== workspaceId) {
+            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, {
+                workerId,
+                workspaceId,
+                actualWorkspaceId: worker.workspace_id,
+                retryable: false,
+            });
+        }
+        if (worker.origin !== "model") {
+            throw daemonFailure("daemon:worker", "model-worker-required", 409, `Worker ${workerId} is not a model worker.`, {
+                workerId,
+                actualOrigin: worker.origin,
+                recovery: "Select or create a model worker for this loop.",
+                retryable: false,
+            });
+        }
+    }
+    async #workerPromptSource(workspaceId, sourceWorkerId, targetWorkerId) {
+        if (sourceWorkerId === targetWorkerId)
+            return undefined;
+        const source = await this.#db.envelope_get_worker_by_id.get({ id: sourceWorkerId });
+        if (source === undefined || source.workspace_id !== workspaceId) {
+            throw new Error(`Worker prompt source ${sourceWorkerId} does not belong to workspace ${workspaceId}.`);
+        }
+        return WorkerControlAddress.render(source.name);
     }
-    // {§methods-op-mirror} — execute parsed ops on behalf of a client, journaled as a
+    // {§methods-op-mirror} — execute parsed ops on behalf of a client as a
     // client-origin turn (the log is core's, a client op is a first-class citizen), dispatched through
     // the engine, then emitted as log/entry on the event source. One seam op backs the whole op_*
     // family (read/edit/copy/find/fold/look/move/open/send/exec); the module parses at its edge with the
     // grammar package and hands over the statement, then fans the emitted entry out to its own clients.
+    // {§functionality-model-mutation} — await every queued Functionality
+    // publication (a Worker's accepted mutation publishes at its turn boundary).
+    async settleFunctionality(workerId) {
+        await this.#functionality.settle(workerId);
+    }
     async dispatchAsClient(args) {
         const workspaceId = ClientInput.assertId("operation.dispatch", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("operation.dispatch", "workerId", args.workerId);
+        const functionalityWorkerId = ClientInput.assertId("operation.dispatch", "functionalityWorkerId", args.functionalityWorkerId);
         const { statement } = args;
-        const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
+        await this.#assertWorkerOwned(workspaceId, functionalityWorkerId);
+        const releaseCapabilities = await this.#residency.acquire(workspaceId, functionalityWorkerId);
         try {
-            const result = await this.#dispatchClientStatement({ workspaceId, workerId, loopId: clientLoopId, statement });
-            await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
-            return result;
+            const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
+            try {
+                const result = await this.#dispatchClientStatement({ workspaceId, workerId, functionalityWorkerId, loopId: clientLoopId, statement });
+                await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
+                return result;
+            }
+            catch (error) {
+                await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
+                throw error;
+            }
         }
-        catch (error) {
-            await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
-            throw error;
+        finally {
+            releaseCapabilities();
         }
     }
-    // The client-interface action contract: one AG-UI action owns one journal segment,
-    // regardless of how many statements op.parse produced. A proposed statement may
-    // keep this promise (and segment) open across interrupt/resume; settlement closes
-    // it. The journal is durable evidence for the action, not a second client lifecycle.
+    // The client-interface action contract: one AG-UI action owns one administrative
+    // loop, regardless of how many statements op.parse produced. Each statement is one
+    // ordinary operation turn; a proposal may keep that turn and loop open across
+    // interrupt/resume until settlement.
     async dispatchClientAction(args) {
         const workspaceId = ClientInput.assertId("operation.dispatch-batch", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("operation.dispatch-batch", "workerId", args.workerId);
+        const functionalityWorkerId = ClientInput.assertId("operation.dispatch-batch", "functionalityWorkerId", args.functionalityWorkerId);
         const { statements } = args;
         if (statements.length === 0)
             return [];
-        const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
+        await this.#assertWorkerOwned(workspaceId, functionalityWorkerId);
+        // {§actor-boundary-attached-functionality} — the attached Worker's
+        // Functionality is what the client operation executes in.
+        const releaseCapabilities = await this.#residency.acquire(workspaceId, functionalityWorkerId);
         try {
-            const results = [];
-            for (const statement of statements) {
-                results.push(await this.#dispatchClientStatement({ workspaceId, workerId, loopId: clientLoopId, statement }));
+            const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
+            try {
+                const results = [];
+                for (const statement of statements) {
+                    results.push(await this.#dispatchClientStatement({ workspaceId, workerId, functionalityWorkerId, loopId: clientLoopId, statement }));
+                }
+                await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
+                return results;
+            }
+            catch (error) {
+                await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
+                throw error;
             }
-            await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
-            return results;
         }
-        catch (error) {
-            await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
-            throw error;
+        finally {
+            releaseCapabilities();
         }
     }
     async #dispatchClientStatement(args) {
-        const { workspaceId, workerId, loopId, statement } = args;
+        const { workspaceId, workerId, functionalityWorkerId, loopId, statement } = args;
         const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
         try {
-            const { id: turnId } = await JournalTurn.insert(this.#db, loopId);
-            const entryIds = [];
-            const result = await this.#engine.dispatch({
-                statement, workspaceId, workerId, loopId, turnId, sequence: 1,
-                origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); },
+            const { id: turnId } = await Turn.open(this.#db, {
+                loopId,
+                producer: "client",
+                kind: "operation",
             });
-            await this.#branchBatches.sealTurn(turnId);
-            for (const logEntryId of entryIds) {
-                const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
-                this.#broadcast({ workspaceId }, "log/entry", { entry });
+            let turnOpen = true;
+            try {
+                const entryIds = [];
+                const result = await this.#engine.dispatch({
+                    statement, workspaceId, workerId, functionalityWorkerId, loopId, turnId, sequence: 1,
+                    origin: "client", onDispatch: (logEntryId) => { entryIds.push(logEntryId); },
+                });
+                await Turn.complete(this.#db, turnId, result.status);
+                turnOpen = false;
+                await this.#branchBatches.sealTurn(turnId);
+                for (const logEntryId of entryIds) {
+                    const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
+                    this.#broadcast({ workspaceId }, "log/entry", { entry });
+                }
+                return result;
+            }
+            catch (cause) {
+                if (turnOpen) {
+                    try {
+                        await Turn.complete(this.#db, turnId, 500);
+                    }
+                    catch (completionCause) {
+                        throw new AggregateError([cause, completionCause], `client operation turn ${turnId} failed and could not be completed`);
+                    }
+                }
+                throw cause;
             }
-            return result;
         }
         finally {
             release();
@@ -553,20 +994,30 @@ export default class Daemon {
     async look(args) {
         const workspaceId = ClientInput.assertId("operation.look", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("operation.look", "workerId", args.workerId);
+        const functionalityWorkerId = ClientInput.assertId("operation.look", "functionalityWorkerId", args.functionalityWorkerId);
         const { statement } = args;
-        const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
-        const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
+        await this.#assertWorkerOwned(workspaceId, functionalityWorkerId);
+        const releaseCapabilities = await this.#residency.acquire(workspaceId, functionalityWorkerId);
         try {
-            const result = await this.#engine.look({ statement, workspaceId, workerId, loopId: clientLoopId });
-            await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
-            return result;
-        }
-        catch (error) {
-            await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
-            throw error;
+            const releaseWorkspace = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
+            try {
+                const clientLoopId = await Envelope.ensureClientLoop(this.#db, workerId);
+                try {
+                    const result = await this.#engine.look({ statement, workspaceId, workerId, functionalityWorkerId, loopId: clientLoopId });
+                    await Envelope.closeClientLoop(this.#db, clientLoopId, { status: 200 });
+                    return result;
+                }
+                catch (error) {
+                    await Envelope.closeClientLoop(this.#db, clientLoopId, clientActionFailure(error));
+                    throw error;
+                }
+            }
+            finally {
+                releaseWorkspace();
+            }
         }
         finally {
-            release();
+            releaseCapabilities();
         }
     }
     // {§methods-log-read} — a workspace's journal, the module's primary render input. The worker is
@@ -630,7 +1081,7 @@ export default class Daemon {
     // {§methods} — the module's render surface beyond the journal. Thin delegations
     // into core's envelope / membership / provider machinery; the module fans the results into its own views.
     listProviders() {
-        const active = resolveActiveAlias();
+        const active = resolveActiveRoute();
         return {
             aliases: parseAliasesFromEnv().map((a) => {
                 const isActive = active !== null && active.alias === a.alias;
@@ -641,6 +1092,11 @@ export default class Daemon {
             }),
         };
     }
+    // {§model-catalog} The catalog is a bounded, worldless local projection.
+    // It performs no provider I/O and never changes the worker's selection.
+    listModels(query) {
+        return listModelCatalog(query);
+    }
     // {§client-display-capabilities} Core composes the installed family
     // declarations; interface modules expose this contracts-owned wire without
     // inventing presentation policy. `exec` is operation machinery, not an
@@ -665,8 +1121,60 @@ export default class Daemon {
         return Validator.assertClientDisplayCapabilities([...schemes, ...mimetypes]);
     }
     listWorkspaces() { return Envelope.listWorkspaces(this.#db); }
-    listWorkers(workspaceId) {
-        return Envelope.listWorkersForWorkspace(this.#db, ClientInput.assertId("workspace.workers", "workspaceId", workspaceId));
+    listWorkers(workspaceId, query = {}) {
+        const origin = query.origin;
+        if (origin !== undefined && !["model", "client", "_plurnk"].includes(origin)) {
+            throw daemonFailure("daemon:worker", "origin-invalid", 400, `Worker origin '${String(origin)}' is invalid.`, { origin, retryable: false });
+        }
+        const parentWorkerId = query.parentWorkerId === undefined
+            ? undefined
+            : query.parentWorkerId === null
+                ? null
+                : ClientInput.assertId("workspace.workers", "parentWorkerId", query.parentWorkerId);
+        // {§methods-worker-list} — an omitted parent filter must stay absent:
+        // the envelope keys the filter on the property's presence, not its value.
+        return Envelope.listWorkersForWorkspace(this.#db, ClientInput.assertId("workspace.workers", "workspaceId", workspaceId), {
+            ...(origin === undefined ? {} : { origin }),
+            ...(parentWorkerId === undefined ? {} : { parentWorkerId }),
+        });
+    }
+    async readWorker(args) {
+        const workspaceId = ClientInput.assertId("worker.read", "workspaceId", args.workspaceId);
+        const hasId = Object.hasOwn(args.identity, "id");
+        const hasName = Object.hasOwn(args.identity, "name");
+        if (hasId === hasName) {
+            throw daemonFailure("daemon:worker", "identity-invalid", 400, "Worker observation requires exactly one id or name.", { retryable: false });
+        }
+        const row = hasId
+            ? await this.#db.envelope_get_worker_by_id.get({
+                id: ClientInput.assertId("worker.read", "id", args.identity.id),
+            })
+            : await this.#db.envelope_get_worker_by_name.get({
+                workspace_id: workspaceId,
+                name: ClientInput.assertOptionalWorkerName("worker.read", "name", args.identity.name),
+            });
+        if (row === undefined || row.workspace_id !== workspaceId)
+            return null;
+        const { workspace_id: _workspaceId, ...projection } = row;
+        return projection;
+    }
+    async listWorkerLoops(args) {
+        const workspaceId = ClientInput.assertId("worker.loops", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.loops", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        const rows = await this.#db.application_list_worker_loops.all({ worker_id: workerId });
+        return rows.map((row) => ({
+            id: row.id,
+            workerId: row.workerId,
+            sequence: row.sequence,
+            status: row.status,
+            prompt: row.prompt,
+            promptSource: row.promptSource,
+            terminatedAt: row.terminatedAt,
+            terminalResult: row.terminalResult === null
+                ? null
+                : Validator.assertOperationResult(JSON.parse(row.terminalResult)),
+        }));
     }
     // {§methods-workspace-prompts}: root-conversation loop seeds, newest-first.
     listPrompts(workspaceId, limit) {
@@ -693,7 +1201,7 @@ export default class Daemon {
     }
     // {§methods-workspace-create}: the module owns protocol decoding; core validates the typed seam
     // inputs and owns the envelope, its reserved-name + name-uniqueness invariants,
-    // membership resolution, warmWorkspaceDerivations, and the workspace/created emit. No connection state
+    // membership resolution and the workspace/created emit. No connection state
     // (which client is on which workspace) lives here — that's the module's.
     async createWorkspace(args) {
         // The seam fails hard on malformed semantic input so every module inherits one wall:
@@ -713,25 +1221,18 @@ export default class Daemon {
             }
             if (constraints.length > 0)
                 await GitMembership.resolveGitMembership(this.#db, envelope.workspaceId, undefined);
-            for (const provider of this.#workspaceCapabilityProviders.values()) {
-                await provider.hydrate(envelope.workspaceId);
-            }
-            await LoopDocs.materialize(this.#engine, this.#db, envelope.workspaceId);
-            void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
             this.#broadcast("all", "workspace/created", { id: envelope.workspaceId, name: envelope.workspaceName, projectRoot: envelope.projectRoot });
             return envelope;
         });
     }
     async attachWorkspace(args) {
-        // attachToWorkspace owns the reserved-name + worker-ownership invariants; the seam just delegates + warms.
+        // attachToWorkspace owns the reserved-name + worker-ownership invariants; the seam just delegates.
         const workspaceId = ClientInput.assertId("workspace.attach", "workspaceId", args.workspaceId);
         const workerId = args.workerId === undefined
             ? undefined
             : ClientInput.assertId("workspace.attach", "workerId", args.workerId);
         const workerName = ClientInput.assertOptionalWorkerName("workspace.attach", "workerName", args.workerName);
-        const envelope = await Envelope.attachToWorkspace(this.#db, workspaceId, { workerId, workerName });
-        void this.#engine.warmWorkspaceDerivations(envelope.workspaceId).catch(() => { });
-        return envelope;
+        return Envelope.attachToWorkspace(this.#db, workspaceId, { workerId, workerName });
     }
     async renameWorkspace(workspaceId, name) {
         const checkedWorkspaceId = ClientInput.assertId("workspace.rename", "workspaceId", workspaceId);
@@ -750,7 +1251,7 @@ export default class Daemon {
             // Members may have just landed — begin warming now, but return the constraint response
             // immediately so prompts do not wait for the complete derivation corpus.
             void this.#engine.warmWorkspaceDerivations(checkedWorkspaceId).catch(() => { });
-            return { effect, glob };
+            return { effect, glob, source: "explicit" };
         }
         finally {
             release();
@@ -797,8 +1298,10 @@ export default class Daemon {
                 retryable: false,
             });
         }
-        const release = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
+        const releaseCapabilities = await this.#residency.acquire(workspaceId, workerId);
+        let releaseWorkspace;
         try {
+            releaseWorkspace = await this.#workspaceGate.acquireTurn(workspaceId, workerId);
             let parsed;
             try {
                 parsed = parsePath(args.target);
@@ -849,6 +1352,7 @@ export default class Daemon {
                 workspace_id: workspaceId,
                 owner_id: location.ownerId,
                 scheme: location.scheme,
+                authority: location.authority,
                 pathname: location.pathname,
             });
             if (row === undefined) {
@@ -896,7 +1400,8 @@ export default class Daemon {
             });
         }
         finally {
-            release();
+            releaseWorkspace?.();
+            releaseCapabilities();
         }
     }
     // {§methods-conversation-worker}: a fresh conversation is a model-origin root worker with an empty private log.
@@ -915,14 +1420,17 @@ export default class Daemon {
             }
         }
         const worker = await Envelope.createModelWorker(this.#db, workspaceId, name);
+        if (args.settings !== undefined) {
+            await this.#mergeWorkerSettings(worker.id, args.settings);
+        }
         return { workerId: worker.id, workerName: worker.name };
     }
     // {§worker-scheme-fork} — branch a worker's log while sharing the workspace world.
     // Core owns the workspace check and immutable worker-name admission.
     async forkWorker(args) {
-        const workspaceId = ClientInput.assertId("worker.fork", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.fork", "workerId", args.workerId);
-        const name = ClientInput.assertOptionalWorkerName("worker.fork", "name", args.name);
+        const workspaceId = ClientInput.assertId("run.fork", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("run.fork", "workerId", args.workerId);
+        const name = ClientInput.assertOptionalWorkerName("run.fork", "name", args.name);
         const owner = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
         if (owner === undefined) {
             throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
@@ -941,30 +1449,23 @@ export default class Daemon {
                 throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId}.`, { workspaceId, name, recovery: "Choose another worker name.", retryable: false });
             }
         }
-        const branchWorkerId = await Fork.fork(this.#db, workerId, name);
+        const branchWorkerId = await Fork.fork(this.#db, workerId, name, (scheme) => this.#schemes.entryInheritanceForStoredScheme(scheme, workerId));
         const branch = await this.#db.envelope_get_worker_by_id.get({ id: branchWorkerId });
         return { workerId: branchWorkerId, workerName: branch?.name ?? null, parentWorkerId: workerId };
     }
     async registerRuntimes(registrations) {
         const normalized = registrations.map((registration) => this.#normalizeRuntime(registration));
         this.#engine.registerRuntimes(normalized);
-        if (this.#capabilitiesPublished) {
-            for (const workspace of await Envelope.listWorkspaces(this.#db)) {
-                await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
-            }
-        }
+        await this.#residency.rematerializeActive();
     }
     async registerRuntime(registration) {
         await this.registerRuntimes([registration]);
     }
     async registerScheme(name, handler) {
         this.#schemes.register(name, handler);
-        if (this.#capabilitiesPublished) {
+        if (this.#residency.published)
             await this.#schemes.ready();
-            for (const workspace of await Envelope.listWorkspaces(this.#db)) {
-                await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
-            }
-        }
+        await this.#residency.rematerializeActive();
     }
     #normalizeRuntime({ namespaceOwner, decl, executor, availability, scheme }) {
         if (typeof namespaceOwner !== "string" || namespaceOwner.trim().length === 0) {
@@ -977,8 +1478,11 @@ export default class Daemon {
                 executor,
                 namespaceOwner: { kind: "module", name: namespaceOwner },
                 glyph: runtime.glyph ?? "",
+                summary: runtime.summary,
                 invocation: runtime.invocation,
-                documentation: runtime.documentation ?? "",
+                details: runtime.details ?? "",
+                ...(runtime.resourcesPath === undefined ? {} : { resourcesPath: runtime.resourcesPath }),
+                ...(runtime.expandTools === undefined ? {} : { expandTools: runtime.expandTools }),
                 available: availability.available,
                 detail: availability.detail,
             },
@@ -986,12 +1490,26 @@ export default class Daemon {
         };
     }
     registerModuleAction(registration) {
-        const { name, scope, handler } = registration;
+        const { name, scope, inputSchema, outputSchema, handler } = registration;
         if (name.length === 0)
             throw new Error("registerModuleAction: action name must not be empty");
-        if (scope !== "worldless" && scope !== "workspace") {
+        if (scope !== "worldless" && scope !== "workspace" && scope !== "worker") {
             throw new Error(`module action '${name}' has invalid scope '${String(scope)}'`);
         }
+        if (inputSchema === null || typeof inputSchema !== "object" || Array.isArray(inputSchema)) {
+            throw new Error(`module action '${name}' has no input schema`);
+        }
+        if (outputSchema === null || typeof outputSchema !== "object" || Array.isArray(outputSchema)) {
+            throw new Error(`module action '${name}' has no output schema`);
+        }
+        for (const [role, schema] of [["input", inputSchema], ["output", outputSchema]]) {
+            try {
+                Validator.validateJsonSchemaInstance(schema, {});
+            }
+            catch (cause) {
+                throw new Error(`module action '${name}' has an invalid ${role} schema`, { cause });
+            }
+        }
         if (typeof handler !== "function")
             throw new Error(`module action '${name}' has no handler`);
         if (this.#moduleActions.has(name))
@@ -1000,7 +1518,12 @@ export default class Daemon {
     }
     listModuleActions() {
         return [...this.#moduleActions.values()]
-            .map(({ name, scope }) => ({ name, scope }))
+            .map(({ name, scope, inputSchema, outputSchema }) => ({
+            name,
+            scope,
+            inputSchema,
+            outputSchema,
+        }))
             .toSorted((left, right) => left.name.localeCompare(right.name));
     }
     async invokeModuleAction(name, params, context) {
@@ -1010,129 +1533,38 @@ export default class Daemon {
         if (registration.scope !== context.scope) {
             throw new Error(`module action '${name}' requires ${registration.scope} context, not ${context.scope}`);
         }
+        let releaseCapabilities;
         if (context.scope === "workspace") {
             ClientInput.assertId(`module action '${name}'`, "workspaceId", context.workspaceId);
         }
-        return registration.handler(params, context);
-    }
-    registerWorkspaceCapabilityProvider(namespaceOwner, provider) {
-        if (namespaceOwner.trim().length === 0) {
-            throw new Error("workspace capability provider requires a non-empty namespace owner");
-        }
-        if (this.#workspaceCapabilityProviders.has(namespaceOwner)) {
-            throw new Error(`workspace capability provider '${namespaceOwner}' is already registered`);
-        }
-        this.#workspaceCapabilityProviders.set(namespaceOwner, provider);
-    }
-    async readWorkspaceModuleState(workspaceId, namespaceOwner) {
-        const checkedWorkspaceId = ClientInput.assertId("workspace module state", "workspaceId", workspaceId);
-        if (namespaceOwner.trim().length === 0) {
-            throw new Error("workspace module state requires a non-empty namespace owner");
-        }
-        const row = await this.#db.workspace_module_state_get.get({
-            workspace_id: checkedWorkspaceId,
-            namespace_owner: namespaceOwner,
-        });
-        return row === undefined ? null : JSON.parse(row.state);
-    }
-    async replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes, }) {
-        const checkedWorkspaceId = ClientInput.assertId("workspace capability replacement", "workspaceId", workspaceId);
-        if (namespaceOwner.trim().length === 0) {
-            throw new Error("workspace capability replacement requires a non-empty namespace owner");
-        }
-        const workspace = await this.#db.envelope_get_workspace.get({ id: checkedWorkspaceId });
-        if (workspace === undefined) {
-            throw daemonFailure("daemon:workspace-capability", "workspace-not-found", 404, `Workspace ${checkedWorkspaceId} does not exist.`, { workspaceId: checkedWorkspaceId, retryable: false });
-        }
-        const encoded = state === null ? null : JSON.stringify(state);
-        if (state !== null && encoded === undefined) {
-            throw daemonFailure("daemon:workspace-capability", "state-not-json", 400, "Workspace module state is not JSON-serializable.", { namespaceOwner, retryable: false });
-        }
-        if (encoded !== null)
-            JSON.parse(encoded);
-        const normalized = runtimes.map((registration) => {
-            if (registration.namespaceOwner !== namespaceOwner) {
-                throw new Error(`workspace runtime owner '${registration.namespaceOwner}' does not match '${namespaceOwner}'`);
+        else if (context.scope === "worker") {
+            const workspaceId = ClientInput.assertId(`module action '${name}'`, "workspaceId", context.workspaceId);
+            const workerId = ClientInput.assertId(`module action '${name}'`, "workerId", context.workerId);
+            const worker = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
+            if (worker === undefined || worker.workspace_id !== workspaceId) {
+                throw daemonFailure("daemon:module-action", "worker-not-found", 404, `Worker ${workerId} does not exist in workspace ${workspaceId}.`, { workspaceId, workerId, retryable: false });
             }
-            return this.#normalizeRuntime(registration);
-        });
-        const gate = this.#workspaceGate.tryExclusive(checkedWorkspaceId);
-        if (gate === null) {
-            throw daemonFailure("daemon:workspace-capability", "workspace-busy", 409, `Workspace ${checkedWorkspaceId} is running an operation or another capability change.`, {
-                workspaceId: checkedWorkspaceId,
-                namespaceOwner,
-                recovery: "Settle the current operation and retry the capability change.",
-                retryable: true,
-            });
+            releaseCapabilities = await this.#residency.acquire(workspaceId, workerId);
         }
-        await gate.acquired;
-        const prior = await this.#db.workspace_module_state_get.get({
-            workspace_id: checkedWorkspaceId,
-            namespace_owner: namespaceOwner,
-        });
-        let rollbackRuntimes;
-        let stateChanged = false;
         try {
-            const commitRuntimes = await this.#engine.prepareWorkspaceRuntimes(checkedWorkspaceId, namespaceOwner, normalized);
-            if (encoded === null) {
-                await this.#db.workspace_module_state_delete.run({
-                    workspace_id: checkedWorkspaceId,
-                    namespace_owner: namespaceOwner,
-                });
-            }
-            else {
-                await this.#db.workspace_module_state_put.run({
-                    workspace_id: checkedWorkspaceId,
-                    namespace_owner: namespaceOwner,
-                    state: encoded,
-                });
-            }
-            stateChanged = true;
-            rollbackRuntimes = commitRuntimes();
-            if (this.#capabilitiesPublished) {
-                await LoopDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
-            }
-        }
-        catch (cause) {
-            rollbackRuntimes?.();
-            const rollbackErrors = [];
-            if (stateChanged) {
-                try {
-                    if (prior === undefined) {
-                        await this.#db.workspace_module_state_delete.run({
-                            workspace_id: checkedWorkspaceId,
-                            namespace_owner: namespaceOwner,
-                        });
-                    }
-                    else {
-                        await this.#db.workspace_module_state_put.run({
-                            workspace_id: checkedWorkspaceId,
-                            namespace_owner: namespaceOwner,
-                            state: prior.state,
-                        });
-                    }
-                }
-                catch (rollbackCause) {
-                    rollbackErrors.push(rollbackCause);
-                }
-                if (this.#capabilitiesPublished) {
-                    try {
-                        await LoopDocs.materialize(this.#engine, this.#db, checkedWorkspaceId);
-                    }
-                    catch (rollbackCause) {
-                        rollbackErrors.push(rollbackCause);
-                    }
-                }
-            }
-            if (rollbackErrors.length > 0) {
-                throw new AggregateError([cause, ...rollbackErrors], "Workspace capability replacement and rollback failed");
-            }
-            throw cause;
+            return await registration.handler(params, context);
         }
         finally {
-            gate.release();
+            releaseCapabilities?.();
         }
     }
+    registerWorkerCapabilityProvider(namespaceOwner, provider) {
+        this.#residency.registerProvider(namespaceOwner, provider);
+    }
+    registerFunctionalityAdapter(adapter) {
+        return this.#functionality.register(adapter);
+    }
+    async readWorkerModuleState(workerId, namespaceOwner) {
+        return this.#residency.readModuleState(workerId, namespaceOwner);
+    }
+    async replaceWorkerCapabilities(replacement, options = {}) {
+        await this.#residency.replace(replacement, options);
+    }
     get engine() { return this.#engine; }
     get provider() { return this.#provider; }
     get schemes() { return this.#schemes; }
@@ -1158,6 +1590,24 @@ export default class Daemon {
         // shell is the default runtime, so its executor must boot usable.
         const executors = await ExecutorRegistry.build({ defaultRuntime: "sh", cwd: this.#discoveryCwd });
         this.#engine.setExecutors(executors);
+        this.#engine.setFunctionalityDocuments((workerId) => this.#functionality.documents(workerId));
+        // {§question-tool} — the native request-user-input runtime, process-wide;
+        // per-worker admission gates its doc visibility and dispatch ({§worker-settings}).
+        await this.#engine.registerRuntimes([{
+                tag: "question",
+                entry: {
+                    executor: new QuestionTool({ runtime: "question", glyph: "❓" }),
+                    namespaceOwner: { kind: "module", name: "core" },
+                    glyph: "❓",
+                    summary: questionRuntimeDecl.summary,
+                    invocation: questionRuntimeDecl.invocation,
+                    details: questionRuntimeDecl.details ?? "",
+                    available: true,
+                    detail: "in-process",
+                },
+            }]);
+        // {§effect-policy-tunable} — invalid operator policy fails boot, not the first EXEC.
+        EffectPolicy.validateConfiguration();
         // {§exec} — mint a scheme per runtime tag so exec output entries address by tag
         // authority (sh:///l/t/s). The "exec" scheme stays for the EXEC op dispatch.
         this.#schemes.registerRuntimeSchemes(executors);
@@ -1165,25 +1615,24 @@ export default class Daemon {
         // (agnostic, by plurnk.kind:"scheme"). They light up http://, etc. with
         // no further engine change — #run wraps their context in SchemeCtxImpl ({§plugin-discovery}).
         await this.#schemes.discoverExternal(this.#discoveryCwd);
+        // {§module-discovery} — third-party daemon-module composition: trusted
+        // packages declaring `plurnk.kind: "module"` register beside the
+        // service's explicit composition before any module setup runs.
+        const discoveredModules = await discoverDaemonModules({ cwd: this.#discoveryCwd });
+        for (const packageName of discoveredModules.skipped) {
+            console.warn(`module discovery: '${packageName}' is discovered but untrusted (PLURNK_PLUGINS_TRUSTED_ONLY); not registered`);
+        }
+        for (const module of discoveredModules.modules) {
+            this.#modules.push(module);
+        }
         const setupSeam = this;
         for (const module of this.#modules) {
             if (module.close !== undefined)
                 this.#moduleClosers.push(module);
             await module.setup?.(setupSeam);
         }
-        for (const workspace of await Envelope.listWorkspaces(this.#db)) {
-            for (const provider of this.#workspaceCapabilityProviders.values()) {
-                await provider.hydrate(workspace.id);
-            }
-        }
         await this.#schemes.ready();
-        // Reconcile the kernel-published documentation surface once per existing workspace.
-        // Installed capabilities and operator configuration are now fully known; model loops
-        // consume this workspace state but never republish it.
-        for (const workspace of await Envelope.listWorkspaces(this.#db)) {
-            await LoopDocs.materialize(this.#engine, this.#db, workspace.id);
-        }
-        this.#capabilitiesPublished = true;
+        this.#residency.publish();
         await this.#recoverLifecycle();
         // {§module-lifecycle} — the daemon opens no transport. Modules start their listeners only
         // after capability publication and durable lifecycle recovery are complete.
@@ -1198,6 +1647,7 @@ export default class Daemon {
         await this.#db.recovery_fail_active_loops.run({});
         await this.#db.recovery_settle_open_provider_requests.run({});
         await this.#db.recovery_fail_open_model_calls.run({});
+        await this.#db.recovery_fail_open_turns.run({});
         await this.#db.recovery_fail_ownerless_proposals.run({});
         await this.#db.recovery_remove_ownerless_client_interactions.run({});
         await this.#db.recovery_error_orphan_subscription_channels.run({});
@@ -1205,11 +1655,24 @@ export default class Daemon {
         await this.#db.recovery_resume_unblocked_parks.run({});
         await this.#branchBatches.recover();
         const orphanSources = await this.#db.recovery_orphan_prompt_sources.all({});
+        const invalidOrphan = orphanSources.find(({ origin }) => origin !== "model");
+        if (invalidOrphan !== undefined) {
+            throw new Error(`Orphaned provider work belongs to ${invalidOrphan.origin} worker ${invalidOrphan.worker_id}; only model workers may enter inference.`);
+        }
         for (const source of orphanSources) {
             await this.#drains.reconcileOrphanedPrompts(source.worker_id, source.loop_id);
         }
         const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
         const queued = await this.#db.recovery_queued_workers.all({});
+        const invalidQueued = queued.find(({ origin }) => origin !== "model");
+        if (invalidQueued !== undefined) {
+            throw new Error(`Queued provider work belongs to ${invalidQueued.origin} worker ${invalidQueued.worker_id}; only model workers may enter inference.`);
+        }
+        const parked = await this.#db.recovery_parked_workers.all({});
+        const invalidParked = parked.find(({ origin }) => origin !== "model");
+        if (invalidParked !== undefined) {
+            throw new Error(`Parked provider work belongs to ${invalidParked.origin} worker ${invalidParked.worker_id}; only model workers may enter inference.`);
+        }
         for (const row of queued) {
             const started = await this.#drains.ensureDrain({
                 workspaceId: row.workspace_id,
@@ -1217,18 +1680,52 @@ export default class Daemon {
                 systemPrompt,
             });
             started?.drainPromise.catch((err) => {
-                console.error(`recovered drain failed for worker ${row.worker_id}:`, err);
+                if (this.#started) {
+                    console.error(`recovered drain failed for worker ${row.worker_id}:`, err);
+                }
             });
         }
-        const parked = await this.#db.recovery_parked_workers.all({});
         for (const row of parked) {
             await this.#drains.schedulePollWake(row.workspace_id, row.worker_id, systemPrompt);
         }
     }
+    // {§crash-only-stop} — the settle deadline. Default 30s; an operator can
+    // raise it for slow hosts or lower it for tests. 0 is refused (an unbounded
+    // stop is exactly the wedge this exists to prevent).
+    static #stopDeadlineMs() {
+        const raw = Number(process.env.PLURNK_SERVICE_STOP_TIMEOUT_MS ?? 30_000);
+        if (!Number.isSafeInteger(raw) || raw <= 0) {
+            throw new Error(`PLURNK_SERVICE_STOP_TIMEOUT_MS must be a positive integer; got ${JSON.stringify(process.env.PLURNK_SERVICE_STOP_TIMEOUT_MS)}.`);
+        }
+        return raw;
+    }
     async stop() {
         if (!this.#started)
             return;
         this.#started = false;
+        // Stop every producer before refusing capability acquisition. A drain
+        // already between queue claim and activation must observe its own abort,
+        // not misclassify orderly shutdown as a capability failure.
+        const derivationAbort = new DOMException("daemon stopping", "AbortError");
+        this.#engine.cancelAllProposals("daemon_stopping");
+        this.#engine.cancelDerivations(derivationAbort);
+        this.#branchBatches.beginStop();
+        this.#drains.beginStop("daemon_stopping");
+        this.#residency.beginStop();
+        const stopDeadlineMs = Daemon.#stopDeadlineMs();
+        const deadline = Date.now() + stopDeadlineMs;
+        const settle = (label, wait) => new Promise((resolve) => {
+            let settled = false;
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve(result);
+            };
+            const timer = setTimeout(() => finish({ status: "rejected", reason: new Error(`stop deadline exceeded waiting for ${label}`) }), Math.max(0, deadline - Date.now()));
+            Promise.resolve().then(wait).then((value) => finish({ status: "fulfilled", value }), (reason) => finish({ status: "rejected", reason }));
+        });
         // Stop accepting external work immediately, but do not await listener
         // closure before cancelling active workers: an SSE connection may itself be
         // waiting for the worker cancellation that follows.
@@ -1248,32 +1745,39 @@ export default class Daemon {
         // Settle the stopped world FIRST: a drain paused at a pending proposal awaits a resolution
         // that will never arrive once clients are gone — allSettled(drains) below would deadlock
         // the stop forever (a daemon with a pending HITL proposal could not shut down).
-        const derivationAbort = new DOMException("daemon stopping", "AbortError");
-        this.#engine.cancelAllProposals("daemon_stopping");
-        this.#engine.cancelDerivations(derivationAbort);
-        this.#branchBatches.beginStop();
-        this.#drains.beginStop("daemon_stopping");
-        await this.#branchBatches.idle();
-        const [drainResult] = await Promise.allSettled([this.#drains.idle()]);
-        const closeResults = await moduleClose;
-        const [streamingResult] = await Promise.allSettled([this.#drainStreamingSchemes()]);
-        const [derivationResult] = await Promise.allSettled([
-            this.#engine.drainDerivations(derivationAbort), // active workspace warms settle before the db closes upstream
-        ]);
-        const mimetypeResults = this.#ownsMimetypes
-            ? await Promise.allSettled([this.#mimetypes.dispose()])
-            : [];
-        const [schemeResult] = await Promise.allSettled([this.#schemes.close()]);
+        // {§crash-only-stop} — the settle sequence is DEADLINE-BOUNDED: a child
+        // that never closes (a wedged MCP server, a stuck stream) must not hang
+        // the daemon forever. Past the deadline the waits are abandoned; the
+        // process may exit with the WAL in place (SQLite recovers) rather than
+        // leak as a live-but-wedged tree.
+        const branchResult = await settle("branch batches idle", () => this.#branchBatches.idle());
+        const drainResult = await settle("drains idle", () => this.#drains.idle());
+        // A boundary publication queued behind the last turn settles before
+        // modules close and before the DB goes away ({§functionality-publication}).
+        const functionalityResult = await settle("functionality publications", () => this.#functionality.settle());
+        const moduleResult = await settle("modules close", async () => {
+            const results = await moduleClose;
+            if (results.some((r) => r.status === "rejected"))
+                throw new AggregateError(results.filter((r) => r.status === "rejected").map((r) => r.reason), "module close failed");
+        });
+        const streamingResult = await settle("streaming schemes idle", () => this.#drainStreamingSchemes());
+        const derivationResult = await settle("derivation drain", () => this.#engine.drainDerivations(derivationAbort));
+        const mimetypeResult = this.#ownsMimetypes
+            ? await settle("mimetypes dispose", () => this.#mimetypes.dispose())
+            : null;
+        const schemeResult = await settle("schemes close", () => this.#schemes.close());
         // Streaming and scheme closure are the last producers of synchronous
         // conclusion notifications. Join the supervisor-owned async tails only
         // after those producers settle, before the caller may close SQLite.
-        const [wakeResult] = await Promise.allSettled([this.#drains.idle()]);
+        const wakeResult = await settle("drains idle (wake)", () => this.#drains.idle());
         const closeErrors = [
-            ...closeResults,
+            moduleResult,
+            functionalityResult,
+            branchResult,
             drainResult,
             streamingResult,
             derivationResult,
-            ...mimetypeResults,
+            ...(mimetypeResult === null ? [] : [mimetypeResult]),
             schemeResult,
             wakeResult,
         ]
@@ -1299,6 +1803,10 @@ export default class Daemon {
     notifyStreamEvent(workspaceId, event) {
         this.#broadcast({ workspaceId }, "stream/event", event);
     }
+    /** Emit transient readable reasoning for an in-flight model call. */
+    notifyReasoningEvent(workspaceId, event) {
+        this.#broadcast({ workspaceId }, "reasoning/event", event);
+    }
     /**
      * Emit a transient notice scoped to the workspace containing the loop.
      */
@@ -1344,9 +1852,11 @@ export default class Daemon {
             worker_id: workerId,
             sequence: seqRow.next,
             prompt: first.body,
+            prompt_source: first.prompt_source,
             flags: first.flags,
-            provider_spec: first.provider_spec,
-            child_provider_spec: first.child_provider_spec,
+            model_route_id: first.model_route_id,
+            spawn_model_route_id: first.spawn_model_route_id,
+            reasoning_policy: first.reasoning_policy,
             max_turns: first.max_turns,
             open_paths: first.open_paths ?? "[]",
             orphan_source_loop_id: endedLoopId,
@@ -1369,6 +1879,12 @@ export default class Daemon {
     cancelDrain(workerId, reason = "user_cancelled") {
         return this.#drains.cancel(workerId, reason);
     }
+    async cancelWorker(args) {
+        const workspaceId = ClientInput.assertId("worker.cancel", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.cancel", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        await this.#drains.cancelWorkerTree(workerId, args.reason ?? "user_cancelled");
+    }
     // Process-local stream activity is supplied to the drain owner through the
     // scheme registry rather than exposing that registry across the boundary.
     #workerHasActiveStreams(workerId) {