@plurnk/plurnk-service 1.7.0 → 1.9.0

package/dist/core/Dispatcher.js

@@ -1,8 +1,7 @@
 var _a;
-import Owner from "./Owner.js";
 import WorkerName, { WorkerNameError } from "./WorkerName.js";
 import WorkerControlAddress from "./WorkerControlAddress.js";
-import { entryPathnameOf, foldAuthorityIntoPath, renderAddress, renderTarget, schemeNameOf } from "./plurnk-uri.js";
+import { entryCoordinateOf, foldAuthorityIntoPath, renderAddress, renderTarget, schemeNameOf } from "./plurnk-uri.js";
 import Fork from "./fork.js";
 import WorkerCap from "./worker-cap.js";
 import { PathSyntax, TagSignal } from "@plurnk/plurnk-contracts";
@@ -11,17 +10,16 @@ import LoopFlagsReader from "./LoopFlagsReader.js";
 import ChannelWrite from "./ChannelWrite.js";
 import { ReadProjector } from "../content/index.js";
 import SchemeCtxImpl from "./caps/SchemeCtxImpl.js";
-import EntryCrud from "../schemes/_entry-crud.js";
 import EntryOps from "../schemes/_entry-ops.js";
 import EntryFind from "../schemes/_entry-find.js";
-import WorkspaceSettings from "./workspace-settings.js";
 import LoopLifecycle from "./LoopLifecycle.js";
 import TerminalResult from "./TerminalResult.js";
 import Results from "./results.js";
 import { OperationFailureError } from "./results.js";
 import EffectPolicy from "../schemes/EffectPolicy.js";
-import { CoreSchemeAdapterBase, } from "./CoreSchemeServices.js";
-import { InvalidOperationResultError, NetworkAddress, } from "@plurnk/plurnk-schemes";
+import WorkerSettingsReader from "./worker-settings.js";
+import { CoreSchemeAdapterBase } from "./CoreSchemeServices.js";
+import { InvalidOperationResultError, } from "@plurnk/plurnk-schemes";
 import DurableStatement from "./DurableStatement.js";
 import ResourceMutations from "./ResourceMutations.js";
 import LogBody from "./LogBody.js";
@@ -70,13 +68,13 @@ class Dispatcher {
     // {§send-premature-terminate}/SEND signal 202 with scope — the engine-owned park-deadline registry (loopId → seconds;
     // -1 = indefinite). The dispatcher WRITES at park; the daemon's drain park-exit consumes.
     #parkDeadlines;
-    #searchGate;
     // Per-turn running-worker READ obligations. {§join-blocking-collect}
     #joinTargets;
     #liveSubscriptions;
     #lifecycle;
     #resourceMutations;
-    constructor({ db, schemes, mimetypes, weigh, notices, proposals, interactions, executors, loopSignal, streamEventNotify, wakeWorkerNotify, injectWorker, branchWorker, branchCompletionGate, cancelWorker, cancelDescendants, searchGate, parkDeadlines, joinTargets, liveSubscriptions }) {
+    #entryAddresses;
+    constructor({ db, schemes, mimetypes, weigh, notices, proposals, interactions, executors, loopSignal, streamEventNotify, wakeWorkerNotify, injectWorker, branchWorker, branchCompletionGate, cancelWorker, cancelDescendants, parkDeadlines, joinTargets, liveSubscriptions, entryAddresses }) {
         this.#db = db;
         this.#schemes = schemes;
         this.#mimetypes = mimetypes;
@@ -94,48 +92,66 @@ class Dispatcher {
         this.#cancelWorker = cancelWorker;
         this.#cancelDescendants = cancelDescendants;
         this.#parkDeadlines = parkDeadlines ?? new Map();
-        this.#searchGate = searchGate;
         this.#joinTargets = joinTargets ?? new Set();
         this.#liveSubscriptions = liveSubscriptions;
+        this.#entryAddresses = entryAddresses;
         this.#lifecycle = new LoopLifecycle(db);
         this.#resourceMutations = new ResourceMutations({
             schemes,
             liveSubscriptions,
             run: (schemeName, statement, ctx) => this.#run(schemeName, statement, ctx),
-            checkWritable: (statement, origin, workspaceId) => this.#checkWritable(statement, origin, workspaceId),
-            checkFlagsGate: (statement, loopId, workspaceId) => this.#checkFlagsGate(statement, loopId, workspaceId),
-            editTargetIdentity: (statement, workspaceId) => this.#editTargetIdentity(statement, workspaceId),
+            checkWritable: (statement, origin, workerId) => this.#checkWritable(statement, origin, workerId),
+            checkFlagsGate: (statement, loopId, workerId) => this.#checkFlagsGate(statement, loopId, workerId),
+            editTargetIdentity: (statement, workspaceId, workerId) => this.#editTargetIdentity(statement, workspaceId, workerId),
             canonicalFilePath: (pathname, workspaceId) => this.#canonicalFilePath(pathname, workspaceId),
             prepareDataRepresentation: (args) => this.#prepareDataRepresentation({
                 ...args,
                 handler: args.handler,
             }),
-            readEntry: (scheme, pathname, ctx) => this.#readEntry(scheme, pathname, ctx),
-            writeEntry: (scheme, pathname, entry, ctx) => this.#writeEntry(scheme, pathname, entry, ctx),
-            deleteChannel: (scheme, pathname, channel, ctx) => this.#deleteChannel(scheme, pathname, channel, ctx),
+            resolveDataEntryAddress: (args) => this.#entryAddresses.resolve(args),
+            readEntry: (scheme, address, ctx) => this.#readEntry(scheme, address, ctx),
+            writeEntry: (scheme, address, entry, ctx) => this.#writeEntry(scheme, address, entry, ctx),
+            deleteChannel: (scheme, address, channel, ctx) => this.#deleteChannel(scheme, address, channel, ctx),
             applyProposal: (statement, result, resolution, ids) => this.#proposals.workerApply(statement, result, resolution, ids),
         });
     }
     // workspace → project_root, memoized: {§fs-namespace} fixes the root immutably at
     // workspace creation, so a process-lifetime cache can never go stale.
     #rootCache = new Map();
-    #handlerContext(scheme, ctx) {
-        const manifest = this.#schemes.manifestFor(scheme, ctx.workspaceId);
-        return manifest === undefined ? null : new SchemeCtxImpl(ctx, scheme, manifest, this.#liveSubscriptions);
+    evictWorkspaceCache(workspaceId) {
+        this.#rootCache.delete(workspaceId);
     }
-    #entryContext(scheme, ctx) {
-        const handlerCtx = this.#handlerContext(scheme, ctx);
-        return this.#schemes.manifestFor(scheme, ctx.workspaceId)?.category === "data" ? handlerCtx : null;
+    async #fixedEntryOwnerId(manifest, ctx) {
+        return this.#entryAddresses.fixedOwnerId(manifest, ctx);
     }
-    #coreCrud(scheme, workspaceId) {
-        const handler = this.#schemes.get(scheme, workspaceId);
+    async #handlerContext(scheme, ctx, authority = "") {
+        const manifest = this.#schemes.manifestFor(scheme, ctx.functionalityWorkerId);
+        return manifest === undefined
+            ? null
+            : new SchemeCtxImpl(ctx, scheme, manifest, this.#liveSubscriptions, {
+                authority,
+                ownerId: await this.#fixedEntryOwnerId(manifest, ctx),
+            });
+    }
+    #boundEntryContext(routedScheme, address, ctx) {
+        const manifest = this.#schemes.manifestFor(routedScheme, ctx.functionalityWorkerId);
+        return manifest?.category === "data"
+            ? new SchemeCtxImpl(ctx, address.scheme, manifest, this.#liveSubscriptions, {
+                authority: address.authority,
+                ownerId: address.ownerId,
+            })
+            : null;
+    }
+    #coreCrud(scheme, workerId) {
+        const handler = this.#schemes.get(scheme, workerId);
         return handler instanceof CoreSchemeAdapterBase
             ? handler
             : undefined;
     }
-    async #readEntry(scheme, pathname, ctx) {
-        const handler = this.#coreCrud(scheme, ctx.workspaceId);
-        const handlerCtx = this.#entryContext(scheme, ctx);
+    async #readEntry(scheme, address, ctx) {
+        const { pathname } = address;
+        const handler = this.#coreCrud(scheme, ctx.functionalityWorkerId);
+        const handlerCtx = this.#boundEntryContext(scheme, address, ctx);
         if (typeof handler?.readEntry === "function" && handlerCtx !== null) {
             return Results.assert(await handler.readEntry(pathname, handlerCtx));
         }
@@ -144,11 +160,11 @@ class Dispatcher {
             return _a.#failure("entry-read-not-implemented", 501, `The '${scheme}' scheme does not provide entry reads.`, { entry: null }, {
                 stage: "entry-read",
                 scheme,
-                target: renderAddress(scheme, pathname),
+                target: renderAddress(address),
                 retryable: false,
             });
         }
-        const result = Results.assert(await caps.read(pathname, scheme === "prompt" ? "worker" : "commons"));
+        const result = Results.assert(await caps.read(pathname));
         return Results.assert({
             ...result,
             status: result.status,
@@ -162,9 +178,10 @@ class Dispatcher {
                 },
         });
     }
-    async #writeEntry(scheme, pathname, entry, ctx) {
-        const handler = this.#coreCrud(scheme, ctx.workspaceId);
-        const handlerCtx = this.#entryContext(scheme, ctx);
+    async #writeEntry(scheme, address, entry, ctx) {
+        const { pathname } = address;
+        const handler = this.#coreCrud(scheme, ctx.functionalityWorkerId);
+        const handlerCtx = this.#boundEntryContext(scheme, address, ctx);
         if (typeof handler?.writeEntry === "function" && handlerCtx !== null) {
             return Results.assert(await handler.writeEntry(pathname, entry, handlerCtx));
         }
@@ -173,15 +190,16 @@ class Dispatcher {
             return _a.#failure("entry-write-not-implemented", 501, `The '${scheme}' scheme does not provide entry writes.`, { created: false, entryId: null }, {
                 stage: "entry-write",
                 scheme,
-                target: renderAddress(scheme, pathname),
+                target: renderAddress(address),
                 retryable: false,
             });
         }
-        return Results.assert(await caps.write(pathname, entry, scheme === "prompt" ? "worker" : "commons"));
+        return Results.assert(await caps.write(pathname, entry));
     }
-    async #deleteEntry(scheme, pathname, ctx) {
-        const handler = this.#coreCrud(scheme, ctx.workspaceId);
-        const handlerCtx = this.#entryContext(scheme, ctx);
+    async #deleteEntry(scheme, address, ctx) {
+        const { pathname } = address;
+        const handler = this.#coreCrud(scheme, ctx.functionalityWorkerId);
+        const handlerCtx = this.#boundEntryContext(scheme, address, ctx);
         if (typeof handler?.deleteEntry === "function" && handlerCtx !== null) {
             return Results.assert(await handler.deleteEntry(pathname, handlerCtx));
         }
@@ -190,15 +208,16 @@ class Dispatcher {
             return _a.#failure("entry-delete-not-implemented", 501, `The '${scheme}' scheme does not provide entry deletion.`, {}, {
                 stage: "entry-delete",
                 scheme,
-                target: renderAddress(scheme, pathname),
+                target: renderAddress(address),
                 retryable: false,
             });
         }
-        return Results.assert(await caps.delete(pathname, scheme === "prompt" ? "worker" : "commons"));
+        return Results.assert(await caps.delete(pathname));
     }
-    async #deleteChannel(scheme, pathname, channel, ctx) {
-        const handler = this.#coreCrud(scheme, ctx.workspaceId);
-        const handlerCtx = this.#entryContext(scheme, ctx);
+    async #deleteChannel(scheme, address, channel, ctx) {
+        const { pathname } = address;
+        const handler = this.#coreCrud(scheme, ctx.functionalityWorkerId);
+        const handlerCtx = this.#boundEntryContext(scheme, address, ctx);
         if (typeof handler?.deleteChannel === "function" && handlerCtx !== null) {
             return Results.assert(await handler.deleteChannel(pathname, channel, handlerCtx));
         }
@@ -207,12 +226,12 @@ class Dispatcher {
             return _a.#failure("channel-delete-not-implemented", 501, `The '${scheme}' scheme does not provide channel deletion.`, {}, {
                 stage: "channel-delete",
                 scheme,
-                target: renderAddress(scheme, pathname),
+                target: renderAddress(address),
                 channel,
                 retryable: false,
             });
         }
-        return Results.assert(await caps.delete(pathname, scheme === "prompt" ? "worker" : "commons", channel));
+        return Results.assert(await caps.delete(pathname, channel));
     }
     async #workspaceRoot(workspaceId) {
         if (this.#rootCache.has(workspaceId))
@@ -235,8 +254,8 @@ class Dispatcher {
     async #canonicalFilePath(pathname, workspaceId) {
         return Namespace.canonicalizeSpelling(pathname, await this.#workspaceRoot(workspaceId));
     }
-    async #editTargetIdentity(statement, workspaceId) {
-        const target = this.#extractTarget(statement.target, workspaceId);
+    async #editTargetIdentity(statement, workspaceId, workerId) {
+        const target = this.#extractTarget(statement.target, workerId);
         await this.#canonColumns(target, workspaceId);
         return {
             key: JSON.stringify([
@@ -252,8 +271,8 @@ class Dispatcher {
     async prepareEditBatches(statements, context) {
         for (const statement of statements)
             assertClassifyingSignal(statement); // {§log-tag-signal}
-        const { workspaceId, workerId, loopId, turnId, origin } = context;
-        const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, loopId, turnId, origin });
+        const { workspaceId, workerId, functionalityWorkerId, loopId, turnId, origin } = context;
+        const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, functionalityWorkerId, loopId, turnId, origin });
         await this.#resourceMutations.prepareEditBatches(statements, context, schemeCtx);
     }
     async dispatch(context) {
@@ -266,12 +285,13 @@ class Dispatcher {
     }
     async #dispatchOne(context) {
         const { statement, workspaceId, workerId, loopId, turnId, sequence, origin, onDispatch, } = context;
-        const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, loopId, turnId, origin });
+        const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, functionalityWorkerId: context.functionalityWorkerId, loopId, turnId, origin });
+        const { functionalityWorkerId } = schemeCtx;
         let result;
         let curationPlan = null;
-        let denial = this.#checkWritable(statement, origin, workspaceId);
+        let denial = this.#checkWritable(statement, origin, functionalityWorkerId);
         if (denial === null)
-            denial = await this.#checkFlagsGate(statement, loopId, workspaceId);
+            denial = await this.#checkFlagsGate(statement, loopId, functionalityWorkerId);
         if (denial !== null) {
             result = denial;
         }
@@ -286,7 +306,14 @@ class Dispatcher {
                     result = await this.#resourceMutations.preparedEditResult(statement);
                 }
                 else if (statement.op === "SEND" && statement.target === null) {
-                    result = await this.#handleSendBroadcast(statement, { workspaceId, workerId, loopId, turnId, sequence });
+                    result = await this.#handleSendBroadcast(statement, {
+                        workspaceId,
+                        workerId,
+                        loopId,
+                        turnId,
+                        sequence,
+                        origin,
+                    });
                 }
                 else if (statement.op === "OPEN" || statement.op === "FOLD") {
                     const curation = await this.#runLogCuration(statement, schemeCtx);
@@ -309,9 +336,22 @@ class Dispatcher {
                     result = this.#handlePlan(statement);
                 }
                 else if (statement.op === "EXEC") {
-                    // EXEC routes unconditionally to its operation owner. The
-                    // resolved runtime declaration owns body/target semantics.
-                    result = await this.#gatedExec(statement, schemeCtx, loopId, turnId);
+                    // {§worker-tool-admission} — the question runtime is admitted
+                    // per worker: a worker whose own rules don't request user input
+                    // gets the explicit not-available outcome, never a parked loop.
+                    if (("signal" in statement && typeof statement.signal === "string")
+                        && !(await WorkerSettingsReader.toolAvailable(this.#db, schemeCtx.functionalityWorkerId, statement.signal))) {
+                        result = _a.#failure("question-tool-unavailable", 404, "The question tool is not available to this worker.", {}, {
+                            stage: "tool-admission",
+                            recovery: "This worker does not request user input; continue from the available evidence.",
+                            retryable: false,
+                        });
+                    }
+                    else {
+                        // EXEC routes unconditionally to its operation owner. The
+                        // resolved runtime declaration owns body/target semantics.
+                        result = await this.#run("exec", statement, schemeCtx);
+                    }
                 }
                 else {
                     result = await this.#run(schemeNameOf(statement.target), statement, schemeCtx); // {§op-methods-op-dispatch}
@@ -320,15 +360,18 @@ class Dispatcher {
             catch (err) { // a scheme exception becomes the op's 500 outcome — {§scheme-surface-exception-500}
                 if (err instanceof InvalidOperationResultError)
                     throw err;
-                const scheme = schemeNameOf(statement.target);
-                console.error(`Scheme '${scheme ?? "unknown"}' ${statement.op} threw outside its operation result contract:`, err);
-                result = err instanceof OperationFailureError
-                    ? err.result
-                    : _a.#failure("scheme-handler-threw", 500, `The '${scheme ?? "unknown"}' scheme did not produce a ${statement.op} result.`, {}, {
+                if (err instanceof OperationFailureError) {
+                    result = err.result;
+                }
+                else {
+                    const scheme = schemeNameOf(statement.target);
+                    console.error(`Scheme '${scheme ?? "unknown"}' ${statement.op} threw outside its operation result contract:`, err);
+                    result = _a.#failure("scheme-handler-threw", 500, `The '${scheme ?? "unknown"}' scheme did not produce a ${statement.op} result.`, {}, {
                         stage: "scheme-dispatch",
                         scheme,
                         operation: statement.op,
                     });
+                }
             }
         }
         // {§fold-open-meta-operations} — persist OPEN/FOLD for forensics;
@@ -340,6 +383,7 @@ class Dispatcher {
         const logEntryId = await this.#writeLog({
             statement,
             result,
+            functionalityWorkerId,
             workspaceId,
             workerId,
             loopId,
@@ -349,15 +393,6 @@ class Dispatcher {
             curationPlan,
             modelCallId: null,
         });
-        // {§search-gate} — register successful searches AFTER #writeLog stamps the runtime
-        // entry's coordinate onto result.attrs.pathname (the gate's dedup serves from it).
-        if (statement.op === "EXEC" && result.status < 400) {
-            const rt = ("signal" in statement && typeof statement.signal === "string" && statement.signal.length > 0) ? statement.signal : "sh";
-            const body = ("body" in statement && typeof statement.body === "string") ? statement.body : "";
-            const attrPath = result.attrs?.pathname;
-            if (typeof attrPath === "string")
-                this.#searchGate?.registerPending(loopId, turnId, rt, body, attrPath);
-        }
         onDispatch?.(logEntryId);
         // Proposal lifecycle (SPEC.md {§engine-rails} + {§methods-proposal-resolve}; {§proposal-202-pauses}). When a
         // side-effecting op returns status 202 (a broadcast SEND signal 202 park is model
@@ -379,13 +414,13 @@ class Dispatcher {
                 autoAccept = EffectPolicy.decide(effect) === "auto";
             }
             if (autoAccept) {
-                const initialSettlement = await this.#proposals.workerApply(statement, result, { decision: "accept" }, { workspaceId, workerId, loopId, turnId });
+                const initialSettlement = await this.#proposals.workerApply(statement, result, { decision: "accept" }, { workspaceId, workerId, functionalityWorkerId, loopId, turnId });
                 const effective = await this.#resourceMutations.settleProposal({
                     statement,
                     result,
                     settlement: initialSettlement,
                     ctx: schemeCtx,
-                    ids: { workspaceId, workerId, loopId, turnId },
+                    ids: { workspaceId, workerId, functionalityWorkerId, loopId, turnId },
                 });
                 return this.#proposals.applyResolution(logEntryId, effective);
             }
@@ -414,13 +449,13 @@ class Dispatcher {
             // file, spawns the process, etc.). Its operation result is
             // preserved: an apply failure keeps its original status and
             // Problem Details instead of masquerading as a client rejection.
-            const initialSettlement = await this.#proposals.workerApply(statement, result, resolution, { workspaceId, workerId, loopId, turnId });
+            const initialSettlement = await this.#proposals.workerApply(statement, result, resolution, { workspaceId, workerId, functionalityWorkerId, loopId, turnId });
             const effective = await this.#resourceMutations.settleProposal({
                 statement,
                 result,
                 settlement: initialSettlement,
                 ctx: schemeCtx,
-                ids: { workspaceId, workerId, loopId, turnId },
+                ids: { workspaceId, workerId, functionalityWorkerId, loopId, turnId },
             });
             const post = await this.#proposals.applyResolution(logEntryId, effective);
             return post;
@@ -437,8 +472,8 @@ class Dispatcher {
         if (statement.op !== "READ")
             throw new Error(`look resolves READ only; got ${statement.op}`);
         // turnId is a write-time FK only — a look writes no row, so 0 (no turn) is inert.
-        const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, loopId, turnId: 0, origin });
-        const denial = await this.#checkFlagsGate(statement, loopId, workspaceId);
+        const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, functionalityWorkerId: context.functionalityWorkerId, loopId, turnId: 0, origin });
+        const denial = await this.#checkFlagsGate(statement, loopId, schemeCtx.functionalityWorkerId);
         if (denial !== null)
             return denial;
         return this.#run(schemeNameOf(statement.target), statement, schemeCtx);
@@ -448,30 +483,17 @@ class Dispatcher {
     // schemes may return the already-authorized principal key.
     async resolveEntryAddress(context) {
         const { target, workspaceId, workerId } = context;
-        const routedScheme = schemeNameOf(target);
-        if (routedScheme === null)
-            return null;
-        const handler = this.#schemes.get(routedScheme, workspaceId);
-        const manifest = this.#schemes.manifestFor(routedScheme, workspaceId);
-        if (handler === undefined || manifest?.category !== "data")
-            return null;
-        const addressedScheme = target.kind === "url" ? target.scheme : routedScheme;
         const coreCtx = this.#buildSchemeCtx({
             workspaceId,
             workerId,
+            functionalityWorkerId: context.functionalityWorkerId,
             loopId: 0,
             turnId: 0,
             origin: "client",
         });
-        const schemeCtx = new SchemeCtxImpl(coreCtx, addressedScheme, manifest, this.#liveSubscriptions);
-        const resolved = await this.#resolveDataEntryAddress({
-            target,
-            routedScheme,
-            handler,
-            manifest,
-            ctx: coreCtx,
-            schemeCtx,
-        });
+        const resolved = await this.bindEntryAddress(target, coreCtx);
+        if (resolved === null)
+            return null;
         if (resolved.address === null)
             return null;
         const rendered = target.kind === "url"
@@ -482,70 +504,30 @@ class Dispatcher {
         return {
             ownerId: resolved.address.ownerId,
             scheme: resolved.address.scheme,
+            authority: resolved.address.authority,
             pathname: resolved.address.pathname,
             target: rendered,
         };
     }
-    async #resolveDataEntryAddress({ target, routedScheme, handler, manifest, ctx, schemeCtx, }) {
-        const addressedScheme = target.kind === "url" ? target.scheme : routedScheme;
-        const identityTarget = target.kind === "url"
-            ? {
-                ...target,
-                pathname: PathSyntax.decodeParens(target.pathname),
-                fragment: null,
-            }
-            : { ...target, raw: PathSyntax.decodeParens(target.raw) };
-        const resolved = handler.resolveEntryAddress === undefined
-            ? { pathname: entryPathnameOf(identityTarget), owner: "commons" }
-            : await handler.resolveEntryAddress(identityTarget, schemeCtx);
-        if (resolved === null)
-            return { address: null, result: null };
-        if ("status" in resolved) {
-            const result = Results.assert(resolved);
-            if (result.status < 300) {
-                throw new InvalidOperationResultError(`Scheme '${routedScheme}' returned a successful operation result instead of an entry address.`);
-            }
-            return { address: null, result };
-        }
-        if (typeof resolved.pathname !== "string") {
-            throw new TypeError(`Scheme '${routedScheme}' returned an invalid entry pathname.`);
-        }
-        let ownerId;
-        if ("ownerId" in resolved) {
-            if (!(handler instanceof CoreSchemeAdapterBase)) {
-                throw new TypeError(`Scheme '${routedScheme}' returned a core-only entry owner id.`);
-            }
-            ownerId = resolved.ownerId;
-        }
-        else if (resolved.owner === "worker") {
-            ownerId = ctx.workerId;
-        }
-        else if (resolved.owner === "commons") {
-            ownerId = await Owner.commonsId(this.#db, ctx.workspaceId);
-        }
-        else {
-            throw new TypeError(`Scheme '${routedScheme}' returned an invalid entry owner.`);
-        }
-        if (!Number.isSafeInteger(ownerId) || ownerId < 1) {
-            throw new TypeError(`Scheme '${routedScheme}' returned an invalid entry owner id.`);
+    async bindEntryAddress(target, ctx) {
+        const routedScheme = schemeNameOf(target);
+        if (routedScheme === null)
+            return null;
+        const handler = this.#schemes.get(routedScheme, ctx.functionalityWorkerId);
+        const manifest = this.#schemes.manifestFor(routedScheme, ctx.functionalityWorkerId);
+        if (handler === undefined || manifest?.category !== "data")
+            return null;
+        return this.#resolveDataEntryAddress({ target, routedScheme, handler, manifest, ctx });
+    }
+    async #resolveDataEntryAddress({ target, routedScheme, handler, manifest, ctx, }) {
+        if (manifest.category !== "data") {
+            throw new TypeError(`Scheme '${routedScheme}' is not entry-bearing.`);
         }
-        return {
-            address: {
-                ownerId,
-                scheme: manifest.storedScheme ?? addressedScheme,
-                pathname: resolved.pathname,
-            },
-            result: null,
-        };
+        return this.#entryAddresses.resolve({ target, routedScheme, handler, manifest, ctx });
     }
-    async #prepareDataRepresentation({ target, routedScheme, handler, manifest, ctx, schemeCtx, publishedChannel, }) {
-        const resolved = await this.#resolveDataEntryAddress({
-            target,
-            routedScheme,
-            handler,
-            manifest,
-            ctx,
-            schemeCtx,
+    async #prepareDataRepresentation({ target, routedScheme, handler, manifest, ctx, publishedChannel, resolved: priorResolution, }) {
+        const resolved = priorResolution ?? await this.#resolveDataEntryAddress({
+            target, routedScheme, handler, manifest, ctx,
         });
         if (resolved.address === null
             || resolved.result !== null
@@ -561,11 +543,13 @@ class Dispatcher {
             }
             : target;
         const preparationCtx = new SchemeCtxImpl(ctx, target.kind === "url" ? target.scheme : routedScheme, manifest, this.#liveSubscriptions, {
+            authority: address.authority,
             ownerId: address.ownerId,
             publishedChannel,
         });
         const prepared = Results.assertRepresentationPreparation(await handler.prepareRepresentation({
             target: selectionNeutralTarget,
+            authority: address.authority,
             pathname: address.pathname,
         }, preparationCtx));
         return {
@@ -577,7 +561,7 @@ class Dispatcher {
     // handler and addressed context as an authored READ. {§exec-target-routing}
     async readExecSource(statement, ctx) {
         const schemeName = schemeNameOf(statement.target);
-        const manifest = schemeName === null ? undefined : this.#schemes.manifestFor(schemeName, ctx.workspaceId);
+        const manifest = schemeName === null ? undefined : this.#schemes.manifestFor(schemeName, ctx.functionalityWorkerId);
         if (manifest !== undefined && manifest.category !== "data") {
             return _a.#failure("exec-source-not-data", 501, `Scheme '${schemeName}' is not a data source for EXEC.`, {}, {
                 scheme: schemeName,
@@ -587,11 +571,16 @@ class Dispatcher {
         }
         return Results.assertReadResult(await this.#run(schemeName, statement, ctx));
     }
+    // The one place per-dispatch coordinates are built; a caller that carries no
+    // explicit Functionality coordinate acts in its own Worker's
+    // ({§actor-boundary-attached-functionality}). Consumers read the built
+    // PlurnkSchemeContext and never re-derive.
     #buildSchemeCtx(ids) {
         const { workspaceId, workerId, loopId, turnId, origin } = ids;
+        const functionalityWorkerId = ids.functionalityWorkerId ?? workerId;
         return {
             db: this.#db,
-            workspaceId, workerId, loopId, turnId,
+            workspaceId, workerId, functionalityWorkerId, loopId, turnId,
             writer: origin,
             signal: this.#loopSignal(loopId),
             streamEventNotify: this.#streamEventNotify,
@@ -610,7 +599,8 @@ class Dispatcher {
     // - SEND broadcast (path=null) has no target scheme; not gated.
     // - COPY: dst scheme writableBy applies.
     // - MOVE: both src (delete) and dst (write) schemes' writableBy apply.
-    #checkWritable(statement, origin, workspaceId) {
+    #checkWritable(statement, origin, functionalityWorkerId) {
+        const workerId = functionalityWorkerId;
         if (!MUTATING_OPS.has(statement.op))
             return null;
         if (statement.op === "SEND" && statement.target === null)
@@ -618,23 +608,23 @@ class Dispatcher {
         // EXEC's operation authority always belongs to the exec scheme;
         // runtime-specific resource authority is gated separately below.
         if (statement.op === "EXEC") {
-            return this.#denyIfDisallowed("exec", origin, workspaceId);
+            return this.#denyIfDisallowed("exec", origin, workerId);
         }
         // Worker control (FORK/WORK → worker://<name>, spawn or fork) is gated by worker://'s writableBy — its
         // body is a seed prompt, not a dst path, so the entry-COPY dst-parse below doesn't apply.
         // {§machine-processes}
         if (this.#isWorkerControl(statement))
-            return this.#denyIfDisallowed("worker", origin, workspaceId);
+            return this.#denyIfDisallowed("worker", origin, workerId);
         if (statement.op === "COPY" || statement.op === "MOVE") {
             const dst = statement.body?.target ?? null;
             const dstScheme = schemeNameOf(dst);
-            const dstDenial = this.#denyIfDisallowed(dstScheme, origin, workspaceId);
+            const dstDenial = this.#denyIfDisallowed(dstScheme, origin, workerId);
             if (dstDenial !== null)
                 return dstDenial;
             if (statement.op === "MOVE") {
                 const srcScheme = schemeNameOf(statement.target);
                 if (srcScheme !== dstScheme) {
-                    const srcDenial = this.#denyIfDisallowed(srcScheme, origin, workspaceId);
+                    const srcDenial = this.#denyIfDisallowed(srcScheme, origin, workerId);
                     if (srcDenial !== null)
                         return srcDenial;
                 }
@@ -642,45 +632,15 @@ class Dispatcher {
             return null;
         }
         const target = schemeNameOf(statement.target);
-        return this.#denyIfDisallowed(target, origin, workspaceId);
-    }
-    // {§search-gate} — gate only configured search runtimes; duplicates serve
-    // the prior durable digest and the per-turn cap refuses without execution.
-    async #gatedExec(statement, ctx, loopId, turnId) {
-        const runtime = ("signal" in statement && typeof statement.signal === "string" && statement.signal.length > 0) ? statement.signal : "sh";
-        const body = ("body" in statement && typeof statement.body === "string") ? statement.body : "";
-        const verdict = this.#searchGate?.check(loopId, turnId, runtime, body) ?? { verdict: "pass" };
-        if (verdict.verdict === "capped") {
-            return _a.#failure("search-limit-reached", 429, `This turn already used its ${verdict.cap} permitted searches.`, {}, {
-                searchLimit: verdict.cap,
-                stage: "search-admission",
-                recovery: "Continue without another search in this turn.",
-                retryable: false,
-            });
-        }
-        if (verdict.verdict === "duplicate") {
-            // {§stream-owner-scoped} — the prior ranked digest is the CALLER's own stream entry.
-            const prior = await EntryCrud.readEntry(verdict.priorPathname, ctx, runtime, ctx.workerId);
-            const raw = prior.entry?.channels["#results"]?.content ?? "";
-            let results = raw;
-            try {
-                results = JSON.parse(raw);
-            }
-            catch { /* non-JSON results serve verbatim */ }
-            return _a.#failure("duplicate-search", 409, "This search already ran in the current loop; the prior results are attached.", { results }, {
-                recovery: "Use the attached prior results.",
-                retryable: false,
-            });
-        }
-        return this.#run("exec", statement, ctx);
+        return this.#denyIfDisallowed(target, origin, workerId);
     }
-    #denyIfDisallowed(schemeName, origin, workspaceId) {
+    #denyIfDisallowed(schemeName, origin, workerId) {
         if (schemeName === null)
             return null;
-        const handler = this.#schemes.get(schemeName, workspaceId);
+        const handler = this.#schemes.get(schemeName, workerId);
         if (handler === undefined)
             return null;
-        const manifest = this.#schemes.manifestFor(schemeName, workspaceId);
+        const manifest = this.#schemes.manifestFor(schemeName, workerId);
         if (manifest === undefined)
             throw new Error(`registered scheme '${schemeName}' has no manifest`);
         if (manifest.writableBy.includes(origin))
@@ -698,7 +658,8 @@ class Dispatcher {
     // active set under the loop's persisted flags. A registered scheme outside
     // that set returns 403; unknown names continue to their operation owner for
     // the ordinary registration failure. Action-entry-as-outcome carries either.
-    async #checkFlagsGate(statement, loopId, workspaceId) {
+    async #checkFlagsGate(statement, loopId, functionalityWorkerId) {
+        const workerId = functionalityWorkerId;
         // Broadcast SEND has no scheme to gate.
         if (statement.op === "SEND" && statement.target === null)
             return null;
@@ -732,15 +693,15 @@ class Dispatcher {
                 });
             }
         }
-        const active = this.#schemes.resolveForLoop(flags, workspaceId);
-        // {§tools-loop-affinity}: name the non-retryable restriction so the model changes course.
+        const active = this.#schemes.resolveForLoop(flags, workerId);
+        // {§mode-ask-read-only}: name the non-retryable restriction so the model changes course.
         const restriction = flags.mode === "ask"
             ? "this is an ask-mode (read-only) loop — you cannot run commands or take host actions here"
             : flags.noWeb && flags.noInteraction ? "web and interaction are disabled for this loop"
                 : flags.noWeb ? "web access is disabled for this loop"
                     : "interaction is disabled for this loop";
         const checkScheme = (scheme) => {
-            if (scheme === null || !this.#schemes.has(scheme, workspaceId))
+            if (scheme === null || !this.#schemes.has(scheme, workerId))
                 return null;
             if (active.has(scheme))
                 return null;
@@ -764,7 +725,7 @@ class Dispatcher {
                 return operationDenial;
             const requested = typeof statement.signal === "string" ? statement.signal : "";
             const runtime = requested === "" ? "sh" : requested;
-            const targetKind = this.#executors()?.entry(runtime, workspaceId)?.invocation.target?.kind;
+            const targetKind = this.#executors()?.entry(runtime, workerId)?.invocation.target?.kind;
             if (targetKind !== "resource")
                 return null;
             const sourceScheme = schemeNameOf(statement.target);
@@ -837,17 +798,32 @@ class Dispatcher {
         }
         if (statement.op === "FORK") {
             // Branch the current worker's log into a named sister.
-            const branchWorkerId = await Fork.fork(this.#db, ctx.workerId, name);
-            await ctx.injectWorker({ workspaceId: ctx.workspaceId, workerId: branchWorkerId, prompt, flags, parentLoopId: ctx.loopId });
+            const branchWorkerId = await Fork.fork(this.#db, ctx.workerId, name, (scheme) => this.#schemes.entryInheritanceForStoredScheme(scheme, ctx.workerId));
+            await ctx.injectWorker({
+                workspaceId: ctx.workspaceId,
+                workerId: branchWorkerId,
+                sourceWorkerId: ctx.workerId,
+                prompt,
+                flags,
+                parentLoopId: ctx.loopId,
+            });
             return { status: 200, body: name };
         }
         // WORK — a fresh worker sister named <name>.
         const row = await this.#db.fork_insert_worker.get({
             workspace_id: ctx.workspaceId, name, parent_worker_id: ctx.workerId, origin: ctx.writer,
+            fork_snapshot: 0,
         });
         if (row === undefined)
             throw new Error("worker spawn: worker insert returned no row");
-        await ctx.injectWorker({ workspaceId: ctx.workspaceId, workerId: row.id, prompt, flags, parentLoopId: ctx.loopId });
+        await ctx.injectWorker({
+            workspaceId: ctx.workspaceId,
+            workerId: row.id,
+            sourceWorkerId: ctx.workerId,
+            prompt,
+            flags,
+            parentLoopId: ctx.loopId,
+        });
         return { status: 200, body: name };
     }
     // KILL is target-polymorphic. Scheme handlers own the optional numeric code's
@@ -863,20 +839,40 @@ class Dispatcher {
         if (schemeName === null) {
             return _a.#failure("kill-target-scheme-required", 400, "KILL target requires a scheme.", {}, { retryable: false });
         }
+        const manifest = this.#schemes.manifestFor(schemeName, ctx.functionalityWorkerId);
+        const coordinate = entryCoordinateOf(path, manifest?.authority ?? "namespace");
         // Log targets use the same killable dispatch as streams; erasure is their
-        // permanent curation operation. {§model-entry-log-curation}
+        // permanent curation operation. {§turn-ops-log-curation}
         // Process-KILL: any scheme whose handler exposes kill() aborts a live stream — the
         // exec handler, registered as "exec" + under every runtime tag (sh/node), so a tag-
         // addressed stream (sh:///l/t/s) routes here, not to deleteEntry. {§exec}
-        const killable = this.#schemes.get(schemeName, ctx.workspaceId);
+        const killable = this.#schemes.get(schemeName, ctx.functionalityWorkerId);
         if (killable !== undefined && typeof killable.kill === "function") {
             // Pass the model's OWN scheme so a stream-KILL error answers in the runtime tag the
             // model addressed (sh:///…), not the internal `exec` ({§fs-answer-in-canon}).
-            const handlerCtx = this.#handlerContext(schemeName, ctx);
+            let handlerCtx;
+            if (manifest?.category === "data") {
+                const resolved = await this.#resolveDataEntryAddress({
+                    target: path,
+                    routedScheme: schemeName,
+                    handler: killable,
+                    manifest,
+                    ctx,
+                });
+                if (resolved.result !== null)
+                    return resolved.result;
+                if (resolved.address === null) {
+                    return _a.#failure("entry-not-found", 404, `No entry exists at ${renderAddress({ scheme: schemeName, ...coordinate })}.`);
+                }
+                handlerCtx = this.#boundEntryContext(schemeName, resolved.address, ctx);
+            }
+            else {
+                handlerCtx = await this.#handlerContext(schemeName, ctx, coordinate.authority);
+            }
             if (handlerCtx === null) {
                 throw new InvalidOperationResultError(`Registered scheme '${schemeName}' has no dispatch context.`);
             }
-            return await killable.kill(entryPathnameOf(path), statement.signal, handlerCtx, schemeName);
+            return await killable.kill(coordinate.pathname, statement.signal, handlerCtx, schemeName);
         }
         if (schemeName === "worker") {
             // Entry-path present → KILL a private owner-held entry (delete it), self-only —
@@ -885,7 +881,22 @@ class Dispatcher {
             const entryPath = path.kind === "url" ? (path.pathname ?? "") : "";
             if (entryPath !== "" && entryPath !== "/") {
                 const workerHandler = this.#schemes.get("worker");
-                const handlerCtx = this.#handlerContext("worker", ctx);
+                if (manifest?.category !== "data") {
+                    throw new InvalidOperationResultError("Registered scheme 'worker' is not entry-bearing.");
+                }
+                const resolved = await this.#resolveDataEntryAddress({
+                    target: path,
+                    routedScheme: "worker",
+                    handler: workerHandler,
+                    manifest,
+                    ctx,
+                });
+                if (resolved.result !== null)
+                    return resolved.result;
+                if (resolved.address === null) {
+                    return _a.#failure("entry-not-found", 404, "The worker entry does not exist.");
+                }
+                const handlerCtx = this.#boundEntryContext("worker", resolved.address, ctx);
                 if (handlerCtx === null) {
                     throw new InvalidOperationResultError("Registered scheme 'worker' has no dispatch context.");
                 }
@@ -912,12 +923,28 @@ class Dispatcher {
             await this.#cancelWorker(workerId, "killed via worker:// KILL");
             return { status: 200 };
         }
-        if (!this.#schemes.has(schemeName, ctx.workspaceId)) {
+        if (!this.#schemes.has(schemeName, ctx.functionalityWorkerId)) {
             return _a.#failure("scheme-not-found", 501, `Scheme '${schemeName}' is not registered.`, {}, { scheme: schemeName, retryable: false });
         }
+        const handler = this.#schemes.get(schemeName, ctx.functionalityWorkerId);
+        if (handler === undefined || manifest?.category !== "data") {
+            return _a.#failure("entry-operation-unsupported", 400, `KILL requires an entry-bearing target; '${schemeName}' does not provide one.`, {}, { scheme: schemeName, retryable: false });
+        }
+        const resolved = await this.#resolveDataEntryAddress({
+            target: path,
+            routedScheme: schemeName,
+            handler,
+            manifest,
+            ctx,
+        });
+        if (resolved.result !== null)
+            return resolved.result;
+        if (resolved.address === null) {
+            return _a.#failure("entry-not-found", 404, "The KILL target does not exist.");
+        }
         // A host-effecting delete (file) returns 202 to PROPOSE — pass its attrs through so the proposal
         // carries the delete target to review (#isProposal fires on 202). Plurnk-internal deletes execute inline.
-        return this.#deleteEntry(schemeName, entryPathnameOf(path), ctx);
+        return this.#deleteEntry(schemeName, resolved.address, ctx);
     }
     async #writeActionlessEntry({ verbatim, workerId, loopId, turnId, sequence, origin, kind, folded, modelCallId = null, attrs = {} }) {
         const durableAttrs = { ...attrs, kind };
@@ -925,7 +952,7 @@ class Dispatcher {
         const row = await this.#db.engine_insert_log_entry.get({
             worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence,
             origin, source: null, model_call_id: modelCallId,
-            op: null, suffix: "", signal: null,
+            op: null, delimiter: "", signal: null,
             scheme: null, username: null, password: null, hostname: null, port: null,
             pathname: null, query: null, fragment: null, lineMarker: null,
             tx: "", mimetype_tx: "text/vnd.plurnk",
@@ -949,30 +976,29 @@ class Dispatcher {
             await this.#db.engine_fold_log_entry.run({ id: row.id });
         return row.id;
     }
-    // {§worker-initialization-entry} — the kernel-authored, born-open worked
-    // turn that initializes a worker's log without impersonating model output.
-    async writeInitializationEntry({ verbatim, workerId, loopId, turnId, sequence }) {
+    // {§turn-ops-entry} — preserve exact admitted source beside, never instead
+    // of, the ordinary operation-result rows produced by dispatch.
+    async writeTurnOps({ verbatim, workerId, loopId, turnId, sequence, origin, folded, modelCallId = null, reasoningItems }) {
         return this.#writeActionlessEntry({
             verbatim, workerId, loopId, turnId, sequence,
-            origin: "plurnk", kind: "initialization", folded: false,
+            origin, kind: "turnOps", folded, modelCallId,
+            attrs: {
+                ...(reasoningItems !== undefined && reasoningItems.length > 0 ? { reasoning: reasoningItems } : {}),
+            },
         });
     }
-    // {§model-entry} — mirror a model emission back as an actionless log row, so
-    // the model can inspect and curate its own prior behavior. Ordinary admitted
-    // emissions are folded; the bounded invalid-emission lifeline is the one
-    // born-open rejected item under {§invalid-emission-attempts} and labels
-    // that admission fact structurally.
-    async writeModelEntry({ verbatim, workerId, loopId, turnId, sequence, folded, modelCallId, admission = "accepted", reasoningItems }) {
+    // {§rejected-emission-entry} — provider bytes that fail admission are an
+    // attempt artifact, never a turn program.
+    async writeEmissionAttempt({ verbatim, workerId, loopId, turnId, sequence, modelCallId, reasoningItems }) {
         return this.#writeActionlessEntry({
             verbatim, workerId, loopId, turnId, sequence,
-            origin: "model", kind: "model_emission", folded, modelCallId,
+            origin: "model", kind: "emissionAttempt", folded: true, modelCallId,
             attrs: {
-                ...(admission === "rejected" ? { admission } : {}),
                 ...(reasoningItems !== undefined && reasoningItems.length > 0 ? { reasoning: reasoningItems } : {}),
             },
         });
     }
-    // PLAN — the model's intended-goals op. An ordinary op: dispatched like any
+    // PLAN — the model's complete current Plan. An ordinary op: dispatched like any
     // other, logged, and broadcast to the client as a log entry — but a pure no-op for
     // state (PLAN ∉ MUTATING_OPS); its body serializes into the log row's tx, no effect.
     #handlePlan(statement) {
@@ -987,6 +1013,7 @@ class Dispatcher {
         Results.assert(result);
         const logEntryId = await this.#writeLog({
             ...context,
+            functionalityWorkerId: context.functionalityWorkerId ?? context.workerId,
             result,
             curationPlan: null,
             modelCallId,
@@ -1013,8 +1040,10 @@ class Dispatcher {
         const boundaries = await this.#nextPacketBoundaries(workerId, turnId);
         if (boundaries.retrievals)
             pending.push("this turn's retrieval results (they land in the NEXT packet's Log)");
-        if (boundaries.streamTerminations) {
-            pending.push("completed stream results that land in the NEXT packet's Log");
+        if (boundaries.streamTerminations.length > 0) {
+            // Name the exact streams (bench#5 requiem #9): the model can wait on
+            // or KILL them specifically instead of guessing what remains.
+            pending.push(`completed stream results that land in the NEXT packet's Log: ${boundaries.streamTerminations.join("; ")}`);
         }
         if (boundaries.childTerminations)
             pending.push("worker results that arrived during this turn (they land NEXT turn)");
@@ -1026,17 +1055,17 @@ class Dispatcher {
     // their distinct contracts: retrievals block explicit completion, whereas FOLD only
     // prevents an empty wait from being inferred as completion.
     async #nextPacketBoundaries(workerId, turnId) {
-        const [turnBoundaries, streamTermination, childTermination] = await Promise.all([
+        const [turnBoundaries, streamTerminations, childTermination] = await Promise.all([
             this.#db.engine_turn_packet_boundaries.all({ turn_id: turnId }),
             this.#db.engine_worker_has_undelivered_stream_term
-                .get({ worker_id: workerId }),
+                .all({ worker_id: workerId }),
             this.#db.engine_worker_has_undelivered_child_term
                 .get({ worker_id: workerId }),
         ]);
         return {
             retrievals: turnBoundaries.some(({ op }) => op !== "FOLD"),
             folds: turnBoundaries.some(({ op }) => op === "FOLD"),
-            streamTerminations: streamTermination !== undefined,
+            streamTerminations: streamTerminations.map(({ handle }) => handle),
             childTerminations: childTermination !== undefined,
         };
     }
@@ -1118,7 +1147,7 @@ class Dispatcher {
             // fired, so do not park; continue directly to the packet that
             // materializes them.
             const boundaries = await this.#nextPacketBoundaries(workerId, turnId);
-            if (boundaries.retrievals || boundaries.folds || boundaries.streamTerminations || boundaries.childTerminations) {
+            if (boundaries.retrievals || boundaries.folds || boundaries.streamTerminations.length > 0 || boundaries.childTerminations) {
                 return { status: 102 };
             }
             const failCount = await this.#unobservedFailureCount(turnId);
@@ -1135,58 +1164,45 @@ class Dispatcher {
                 attrs: { joined: true, pending: 0 },
             };
         }
-        // {§send-300-choices} — ask the operator and park (the answer returns via loop.inject).
-        // The three-state cascade (owner design): PLURNK_QUESTIONS unset = ALLOWED (not enabled);
-        // =0 = DENIED servicewide (a ceiling the client cannot override); ENABLED requires the
-        // client to affirmatively pass it per workspace (settings.questions — the interactive client
-        // with a human enables its own workspaces; headless/bench never asks). Enabled workspaces ALSO
-        // get the questions.md teaching injected (docEntries) — capability and teaching gate as one.
-        // Disabled → refused with a self-decide steer, never a park into the void.
-        if (status === 300) {
-            if (!(await WorkspaceSettings.questionsEnabled(this.#db, ctx.workspaceId))) {
-                return _a.#failure("operator-questions-disabled", 409, "Operator questions are disabled in this workspace.", {}, {
-                    recovery: "Decide from the available evidence and continue or conclude.",
-                    retryable: false,
-                });
-            }
-            // {§send-300-choices} — return a proposal whose accepted body becomes
-            // the answer; zero choices denotes an open question.
-            const parts = raw.split(";").map((x) => x.trim()).filter((x) => x.length > 0);
-            const [question = "", ...choices] = parts;
-            return { status: 202, attrs: choices.length > 0 ? { question, choices } : { question } };
-        }
         // [200] — terminate, gated by the pending set (post-batch). The row records the refused
         // attempt faithfully (status_rx=409, never erased); the loop stays a continue; the strike
         // couples in runTurn. [499] abandons and cancels the descendant scope.
         if (status === 200) {
-            // {§send-premature-terminate} — same-turn failures are unobserved
-            // pending results and therefore refuse completion.
-            const failCount = await this.#unobservedFailureCount(turnId);
-            if (failCount > 0)
-                return _a.#unobservedFailures(failCount);
-            const pending = await this.#pendingSet(workerId, turnId);
-            if (pending.length > 0) {
-                // A retrieval-only refusal needs no KILL/park remedy menu: the results simply
-                // arrive in the next packet. Streams and children retain their remedy steer.
-                const retrievalsOnly = pending.every((k) => k.startsWith("this turn's retrieval results"));
-                if (retrievalsOnly) {
-                    return _a.#failure("retrieval-results-unobserved", 409, "Last turn both performed retrieval operations and attempted to terminate. Retrieval operations force an additional turn so their results can be reviewed.", {}, {
+            // Model completion is a claim about the Worker's observed work and
+            // therefore crosses the pending-result rails. A `_plurnk`
+            // maintenance program closes only its own administrative loop; it
+            // must not claim, consume, or be blocked by model work elsewhere in
+            // the same Worker.
+            if (ctx.origin === "model") {
+                // {§send-premature-terminate} — same-turn failures are unobserved
+                // pending results and therefore refuse completion.
+                const failCount = await this.#unobservedFailureCount(turnId);
+                if (failCount > 0)
+                    return _a.#unobservedFailures(failCount);
+                const pending = await this.#pendingSet(workerId, turnId);
+                if (pending.length > 0) {
+                    // A retrieval-only refusal needs no KILL/park remedy menu: the results simply
+                    // arrive in the next packet. Streams and children retain their remedy steer.
+                    const retrievalsOnly = pending.every((k) => k.startsWith("this turn's retrieval results"));
+                    if (retrievalsOnly) {
+                        return _a.#failure("retrieval-results-unobserved", 409, "Last turn both performed retrieval operations and attempted to terminate. Retrieval operations force an additional turn so their results can be reviewed.", {}, {
+                            pending: [...pending],
+                            stage: "completion",
+                            recovery: "Review the results, then use only `# PLAN0` and `## SEND0 [200]` to conclude.",
+                            retryable: false,
+                        });
+                    }
+                    return _a.#failure("work-remains", 409, `Completion was refused while work remains: ${pending.join("; ")}.`, {}, {
                         pending: [...pending],
                         stage: "completion",
-                        recovery: "Review the results, then use only `# PLAN0` and `## SEND0 [200]` to conclude.",
+                        recovery: "Resolve the listed pending work before concluding.",
                         retryable: false,
                     });
                 }
-                return _a.#failure("work-remains", 409, `Completion was refused while work remains: ${pending.join("; ")}.`, {}, {
-                    pending: [...pending],
-                    stage: "completion",
-                    recovery: "Resolve the listed pending work before concluding.",
-                    retryable: false,
-                });
+                const branchDenial = await this.#branchCompletionGate?.(workerId) ?? null;
+                if (branchDenial !== null)
+                    return branchDenial;
             }
-            const branchDenial = await this.#branchCompletionGate?.(workerId) ?? null;
-            if (branchDenial !== null)
-                return branchDenial;
             const finished = await this.#lifecycle.finish(loopId, TerminalResult.success(raw));
             return _a.#statusResult(finished !== null ? 200 : await this.#lifecycle.status(loopId), "loop-already-terminal", "The loop was already terminal when SEND attempted to conclude it.");
         }
@@ -1230,13 +1246,56 @@ class Dispatcher {
                     : {};
             return _a.#failure("target-scheme-required", 400, `${statement.op} requires a target scheme.`, fields, { operation: statement.op, retryable: false });
         }
-        if (statement.op === "SEND" && statement.signal === 499 && statement.target?.kind === "url") {
+        const manifest = this.#schemes.manifestFor(schemeName, ctx.functionalityWorkerId);
+        const handler = this.#schemes.get(schemeName, ctx.functionalityWorkerId);
+        if (handler === undefined) {
+            return _a.#failure("scheme-not-found", 501, `Scheme '${schemeName}' is not registered.`, {}, { scheme: schemeName, retryable: false });
+        }
+        const methodName = statement.op.toLowerCase();
+        const method = handler[methodName];
+        const addressedScheme = statement.target?.kind === "url" ? statement.target.scheme : null;
+        if (manifest === undefined)
+            throw new Error(`scheme '${schemeName}' has no manifest`);
+        const publishedChannel = statement.target?.kind === "url"
+            ? statement.target.fragment ?? manifest.defaultChannel
+            : manifest.defaultChannel;
+        const authoredCoordinate = statement.target === null
+            ? { authority: "", pathname: "" }
+            : entryCoordinateOf(statement.target, manifest.authority ?? "namespace");
+        // EXEC's authored target belongs to its declared invocation contract;
+        // a resource target is input to the executor, never the output-stream
+        // address owned by the internal exec scheme. {§exec-target-routing}
+        const addressResolution = manifest.category === "data"
+            && statement.target !== null
+            && statement.op !== "EXEC"
+            ? await this.#resolveDataEntryAddress({
+                target: statement.target,
+                routedScheme: schemeName,
+                handler: handler,
+                manifest,
+                ctx,
+            })
+            : null;
+        if (addressResolution?.result !== null && addressResolution?.result !== undefined) {
+            return addressResolution.result;
+        }
+        const operationAddress = addressResolution?.address ?? null;
+        const schemeCtx = new SchemeCtxImpl(ctx, addressedScheme ?? schemeName, manifest, this.#liveSubscriptions, {
+            authority: operationAddress?.authority ?? authoredCoordinate.authority,
+            ownerId: operationAddress?.ownerId ?? await this.#fixedEntryOwnerId(manifest, ctx),
+            publishedChannel,
+        });
+        if (statement.op === "SEND"
+            && statement.signal === 499
+            && statement.target?.kind === "url"
+            && operationAddress !== null) {
             const addressedScheme = statement.target.scheme;
             const entry = await this.#db.crud_find_workspace_entry.get({
                 workspace_id: ctx.workspaceId,
-                owner_id: await Owner.commonsId(this.#db, ctx.workspaceId),
-                scheme: addressedScheme,
-                pathname: entryPathnameOf(statement.target),
+                owner_id: operationAddress.ownerId,
+                scheme: operationAddress.scheme,
+                authority: operationAddress.authority,
+                pathname: operationAddress.pathname,
             });
             if (entry !== undefined) {
                 const subscription = await ChannelWrite.findActiveSubscription(this.#db, {
@@ -1252,20 +1311,6 @@ class Dispatcher {
                 }
             }
         }
-        const handler = this.#schemes.get(schemeName, ctx.workspaceId);
-        if (handler === undefined) {
-            return _a.#failure("scheme-not-found", 501, `Scheme '${schemeName}' is not registered.`, {}, { scheme: schemeName, retryable: false });
-        }
-        const methodName = statement.op.toLowerCase();
-        const method = handler[methodName];
-        const addressedScheme = statement.target?.kind === "url" ? statement.target.scheme : null;
-        const manifest = this.#schemes.manifestFor(schemeName, ctx.workspaceId);
-        if (manifest === undefined)
-            throw new Error(`scheme '${schemeName}' has no manifest`);
-        const publishedChannel = statement.target?.kind === "url"
-            ? statement.target.fragment ?? manifest.defaultChannel
-            : manifest.defaultChannel;
-        const schemeCtx = new SchemeCtxImpl(ctx, addressedScheme ?? schemeName, manifest, this.#liveSubscriptions, { publishedChannel });
         if (statement.op === "READ"
             && handler instanceof CoreSchemeAdapterBase
             && typeof handler.resolveCoreRepresentation === "function") {
@@ -1307,8 +1352,8 @@ class Dispatcher {
                     handler: handler,
                     manifest,
                     ctx,
-                    schemeCtx,
                     publishedChannel,
+                    ...(addressResolution === null ? {} : { resolved: addressResolution }),
                 });
             if (prepared.result !== null)
                 return prepared.result;
@@ -1321,9 +1366,10 @@ class Dispatcher {
             }
             const storageScheme = resolved?.scheme ?? manifest.storedScheme ?? addressedScheme ?? schemeName;
             const projected = Results.assertReadResult(await EntryOps.readWorkspaceEntry(statement, ctx, { ...manifest, name: storageScheme, storedScheme: storageScheme }, resolved === null
-                ? {}
+                ? null
                 : {
                     ownerId: resolved.ownerId,
+                    authority: resolved.authority,
                     pathname: resolved.pathname,
                 }));
             return projected;
@@ -1345,7 +1391,7 @@ class Dispatcher {
             && (targetPathname === "" || targetPathname.endsWith("/"));
         const exactTarget = statement.target !== null
             && !collectionTarget
-            && !PathSyntax.hasGlob(entryPathnameOf(statement.target));
+            && !PathSyntax.hasGlob(authoredCoordinate.pathname);
         if (exactTarget && statement.target !== null) {
             const prepared = await this.#prepareDataRepresentation({
                 target: statement.target,
@@ -1353,8 +1399,8 @@ class Dispatcher {
                 handler: handler,
                 manifest,
                 ctx,
-                schemeCtx,
                 publishedChannel,
+                ...(addressResolution === null ? {} : { resolved: addressResolution }),
             });
             if (prepared.result !== null)
                 return prepared.result;
@@ -1378,6 +1424,7 @@ class Dispatcher {
                 ?? schemeName;
             return Results.assert(await EntryFind.findWorkspaceEntries(statement, ctx, { ...manifest, name: storageScheme, storedScheme: storageScheme }, {
                 ownerId: prepared.address.ownerId,
+                authority: prepared.address.authority,
                 pathname: prepared.address.pathname,
             }));
         }
@@ -1409,23 +1456,20 @@ class Dispatcher {
         if (handler === undefined || manifest === undefined) {
             throw new Error("the core log curation owner is not registered");
         }
-        const schemeCtx = new SchemeCtxImpl(ctx, "log", manifest, this.#liveSubscriptions);
+        const schemeCtx = new SchemeCtxImpl(ctx, "log", manifest, this.#liveSubscriptions, { ownerId: null });
         const outcome = await handler.curate(statement, schemeCtx);
         return { result: Results.assert(outcome.result), plan: outcome.plan };
     }
     // {§proposal}/{§send} — status 202 is a proposal except for broadcast
     // SEND signal 202, which parks the loop. The operation disambiguates the status.
     static #isProposal(statement, result) {
-        // {§send-300-choices} — SEND signal 300 is the proposal exception.
         if (result.status !== 202)
             return false;
-        if (statement.op === "SEND" && statement.signal === 300)
-            return true;
         return !(statement.op === "SEND" && statement.target === null);
     }
-    async #writeLog({ statement, result, workspaceId, workerId, loopId, turnId, sequence, origin, curationPlan, modelCallId, }) {
+    async #writeLog({ statement, result, workspaceId, workerId, functionalityWorkerId, loopId, turnId, sequence, origin, curationPlan, modelCallId, }) {
         const durableStatement = DurableStatement.project(statement);
-        const target = this.#extractTarget(durableStatement.target, workspaceId);
+        const target = this.#extractTarget(durableStatement.target, functionalityWorkerId);
         await this.#canonColumns(target, workspaceId); // {§fs-answer-in-canon}
         const lineMarkerJson = "lineMarker" in durableStatement && durableStatement.lineMarker !== null
             ? JSON.stringify(durableStatement.lineMarker)
@@ -1444,8 +1488,7 @@ class Dispatcher {
                 throw new Error("Dispatcher.#writeLog: result attrs collide with private log curation state");
             }
             attrsObj.__plurnk_curation = {
-                ids: curationPlan.targetLogEntryIds,
-                expanded: curationPlan.expanded,
+                targets: curationPlan.targets,
                 add: curationPlan.add,
                 remove: curationPlan.remove,
             };
@@ -1502,7 +1545,7 @@ class Dispatcher {
             source: null, // dispatch entries are self-authored; {§env-delta} deltas set this
             model_call_id: modelCallId,
             op: durableStatement.op,
-            suffix: durableStatement.suffix,
+            delimiter: durableStatement.delimiter,
             signal: this.#signalToJson(durableStatement.signal),
             scheme: target.scheme,
             username: target.username,
@@ -1538,23 +1581,26 @@ class Dispatcher {
     // inputs collapse to scheme=null in log target metadata because both render
     // as bare paths. Addressable file entries separately persist under the
     // reserved `file` identity scheme ({§entry-identity-no-null}).
-    #extractTarget(path, workspaceId) {
+    #extractTarget(path, workerId) {
         if (path === null)
             return { scheme: null, username: null, password: null, hostname: null, port: null, pathname: null, query: null, fragment: null };
         // `local` (bare path) carries no URL parts — store the raw text as the pathname for the log record, scheme=null.
         if (path.kind === "local")
             return { scheme: null, username: null, password: null, hostname: null, port: null, pathname: PathSyntax.decodeParens(path.raw), query: null, fragment: null }; // {§path-parentheses}
         const scheme = path.scheme === "file" ? null : path.scheme;
-        // {§scheme-address-namespace-fold} — a registered non-network scheme folds its
-        // namespace authority into the canonical pathname. Network authorities remain hosts;
-        // worker:// is the registered exception because its authority selects the owner.
+        // The registered scheme owns authority disposition. Namespace authority
+        // is path syntax; resource and owner authorities remain explicit in the
+        // durable operation evidence.
+        const routedScheme = schemeNameOf(path);
+        const manifest = routedScheme === null
+            ? undefined
+            : this.#schemes.manifestFor(routedScheme, workerId);
         const foldNs = scheme !== null
-            && scheme !== "worker"
-            && !NetworkAddress.supports(scheme)
-            && this.#schemes.has(scheme, workspaceId);
+            && manifest !== undefined
+            && (manifest.authority ?? "namespace") === "namespace";
         return {
             scheme, username: path.username, password: path.password,
-            hostname: foldNs ? null : path.hostname, port: path.port,
+            hostname: foldNs ? null : path.hostname, port: foldNs ? null : path.port,
             pathname: PathSyntax.decodeParens(foldNs ? foldAuthorityIntoPath(path.hostname, path.pathname) : path.pathname), // {§path-parentheses}
             query: path.query, fragment: path.fragment,
         };