@plurnk/plurnk-service 4.1.0 → 4.3.0

package/dist/server/Daemon.js

@@ -4,81 +4,62 @@ import { readFile } from "node:fs/promises";
 import { resolve, dirname } from "node:path";
 import { Share } from "@plurnk/plurnk-digest";
 import EvidenceReader from "@plurnk/plurnk-service/evidence";
-import ChannelWrite, {} from "../core/ChannelWrite.js";
 import Paths from "../Paths.js";
-import Engine from "../core/Engine.js";
+import Engine, {} from "../core/Engine.js";
 import ExecutorRegistry from "../core/ExecutorRegistry.js";
 import Exec from "../schemes/Exec.js";
 import SchemeRegistry from "../core/SchemeRegistry.js";
 import { Mimetypes } from "@plurnk/plurnk-mimetypes";
 import { RuntimeDeclaration } from "@plurnk/plurnk-execs";
-import { projectModelRoute, routeForSpec, specForRoute } from "./model-route.js";
-import { discoverDaemonModules } from "./module-discovery.js";
 import EffectPolicy from "../schemes/EffectPolicy.js";
 import QuestionTool, { questionRuntimeDecl } from "../schemes/QuestionTool.js";
 import DrainSupervisor, {} from "./DrainSupervisor.js";
 import MessageAbandonment from "./MessageAbandonment.js";
 import Retention, { retentionPolicy } from "./Retention.js";
 import TurnDispositionHandler from "../core/TurnDispositionHandler.js";
-import { Validator } from "@plurnk/plurnk-contracts";
+import { Validator, isRecord, isSafeInteger } from "@plurnk/plurnk-contracts";
 import LogEntry from "./logEntry.js";
-import HttpListener from "./HttpListener.js";
 import Credentials from "./Credentials.js";
 import Envelope, { projectWorkerRow } from "./envelope.js";
 import WorkerReferences from "./WorkerReferences.js";
+import WorkerOverview from "./WorkerOverview.js";
+import Places, {} from "./Places.js";
 import ClientInput from "./client-input.js";
-import Turn from "../core/Turn.js";
 import WorkspacePlugins from "./WorkspacePlugins.js";
 import { agentRootScopes, workspacePaths } from "./AgentRoots.js";
 import ExecEnv from "../schemes/exec-env.js";
 import PlurnkSkill from "./PlurnkSkill.js";
 import ResourceTreeScheme from "../schemes/ResourceTreeScheme.js";
 import MembersFunctionality, { modelScope, serviceMembers } from "./MembersFunctionality.js";
-import Rollback from "./Rollback.js";
 import FileCreationPolicy from "../core/file-creation-policy.js";
 import EnvFunctionality, { ENV_OWNER } from "./EnvFunctionality.js";
 import EnvScheme from "../schemes/Env.js";
 import HostPaths from "../core/HostPaths.js";
 import WorkspaceStorage from "./WorkspaceStorage.js";
 import Fork from "../core/fork.js";
-import WorkerControlAddress from "../core/WorkerControlAddress.js";
 import LoopLifecycle from "../core/LoopLifecycle.js";
-import { ConfigurationError, Knob } from "@plurnk/plurnk-meta";
+import { Knob } from "@plurnk/plurnk-meta";
 import ProposalPolicies from "../core/ProposalPolicies.js";
 import WorkerOwners from "../core/WorkerOwners.js";
 import RuntimeWorker from "../core/RuntimeWorker.js";
 import { contentWeight } from "../core/content-weight.js";
 import MessageResources from "../core/MessageResources.js";
-import ContentUse from "../core/ContentUse.js";
-import { parseAliasesFromEnv, resolveActiveRoute } from "@plurnk/plurnk-providers";
+import { resolveActiveRoute } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "../core/ProviderInstantiate.js";
 import Results, { OperationFailureError } from "../core/results.js";
 import WorkspaceGate from "../core/WorkspaceGate.js";
 import StopDeadline from "../core/StopDeadline.js";
+import { WorkerNameConflictError } from "../core/WorkerName.js";
 import WorkspaceResidency from "./WorkspaceResidency.js";
 import Functionality from "./Functionality.js";
 import { observed, observedSync } from "../observe/spans.js";
-import { listModelCatalog } from "./model-catalog.js";
-import { daemonFailure, modelRouteLabel } from "./daemon-results.js";
-import WorkerModelResolver from "./WorkerModelResolver.js";
+import { daemonFailure } from "./daemon-results.js";
+import WorkerModels, {} from "./WorkerModels.js";
 import ClientReads from "./ClientReads.js";
+import MessageDelivery from "./MessageDelivery.js";
+import DaemonModules from "./DaemonModules.js";
+import ClientOperations from "./ClientOperations.js";
 import ConfigurationDiagnostics from "./ConfigurationDiagnostics.js";
-// {§connection-lifecycle} A client operation cancelled mid-way settles its loop with what happened.
-const clientOperationCancelled = (reason) => {
-    const said = typeof reason === "string" ? reason : "cancelled";
-    return Results.failure("daemon:client", "operation-cancelled", 499, `The client operation was cancelled: ${said}.`, {}, {
-        reason: said, stage: "client-action", retryable: false,
-    });
-};
-const clientActionFailure = (error) => {
-    if (error instanceof OperationFailureError)
-        return error.result;
-    console.error("Client action failed outside its operation result contract:", error);
-    return Results.failure("daemon:client", "action-threw", 500, "The client action failed outside its operation result contract.", {}, {
-        stage: "client-action",
-        retryable: false
-    });
-};
 export default class Daemon {
     static validateConfiguration() {
         Credentials.posture();
@@ -119,17 +100,12 @@ export default class Daemon {
     #secretMinted;
     #discoveryCwd;
     #started = false; // {§module-lifecycle}: one discovery/module boot; no listener
-    #modules = [];
-    // {§module-http-mounts} — each claimed prefix's owner, and the claims mounted at start.
-    #mountClaims = new Map();
-    #mounted = new Set();
-    #moduleLifetimes = [];
-    #moduleActions = new Map();
-    // {§connection-lifecycle} Each running client operation's loop, its own cancellation scope and its settlement.
-    #clientLoops = new Map();
-    // {§worker-lifecycle-total-reap} Every client operation's scope descends from this one, which shutdown aborts:
-    // an operation still dispatching, and every execution an operation started, ends with the daemon.
-    #clientOperations = new AbortController();
+    // {§module-discovery} — the daemon's modules, composed and discovered, with their mounts, phases and actions.
+    #modules;
+    // {§connection-lifecycle} — the client operations in flight: their loops, scopes and settlement.
+    #clientOperations;
+    // {§methods-loop-run} {§machine-processes} — a message's delivery to a worker: the loop it starts or continues.
+    #delivery;
     #residency;
     #functionality;
     // {§retention-policy} — the operator's retention, run on a cadence and at shutdown.
@@ -189,12 +165,17 @@ export default class Daemon {
             workspaceGate: this.#workspaceGate,
             normalizeRuntime: (registration) => this.#normalizeRuntime(registration)
         });
+        // {§module-discovery} — the modules' owner exists before Core registers its own families below: their
+        // actions register through the same seam a module's do.
+        this.#modules = new DaemonModules({
+            db, http: this.#http, configuration: this.#configuration, residency: this.#residency, workspaceGate: this.#workspaceGate,
+        });
         // {§functionality-coordinator} — the one owner above every family
         // adapter; Core hosts it, modules register adapters through the seam.
         this.#functionality = new Functionality({
             signal: this.#residency.signal,
             registerModuleAction: (registration) => this.registerModuleAction(registration),
-            registerWorkspaceCapabilityProvider: (owner, provider) => this.registerWorkspaceCapabilityProvider(owner, provider),
+            registerWorkspaceCapabilityProvider: (owner, capabilities) => this.registerWorkspaceCapabilityProvider(owner, capabilities),
             readWorkspaceModuleState: (workspaceId, owner) => this.readWorkspaceModuleState(workspaceId, owner),
             replaceWorkspaceCapabilities: (replacement, options) => this.replaceWorkspaceCapabilities(replacement, options),
             readWorkerModuleState: (workerId, owner) => this.#residency.readWorkerModuleState(workerId, owner),
@@ -226,79 +207,7 @@ export default class Daemon {
             reasoningEventNotify: (workspaceId, event) => this.notifyReasoningEvent(workspaceId, event),
             outsideEventNotify: (workspaceId, event) => this.notifyOutsideEvent(workspaceId, event),
             wakeWorkerNotify: (payload) => this.#drains.notifyWakeWorker(payload),
-            // worker:// loop-start primitive — spawn/fork/irc deliver through
-            // Daemon.inject (active sister → fold; idle → enqueue + drain). The
-            // daemon owns provider + the law-file system prompt; the worker scheme
-            // handler carries neither. Fire-and-forget: the returned drain runs
-            // independently (the sister is its own worker). {§machine-processes}
-            injectWorker: async ({ workspaceId, workerId, sourceLoopId, prompt, spawn, environment, attachments, opener }) => {
-                await this.#assertModelWorker(workspaceId, workerId);
-                const sender = await this.#db.drain_message_source.get({ loop_id: sourceLoopId });
-                if (sender === undefined || sender.workspace_id !== workspaceId) {
-                    throw new Error(`injectWorker: source loop ${sourceLoopId} does not belong to workspace ${workspaceId}`);
-                }
-                const source = await this.#messageSource(workspaceId, sourceLoopId, sender.worker_id, workerId);
-                const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-                let providerSpec;
-                let childProviderSpec;
-                let effort;
-                if (spawn !== true) {
-                    // {§worker-model-selection} — the voice door addresses an
-                    // existing worker. Its own durable generation policy is the
-                    // receiver's identity; the daemon default and sender do not
-                    // overwrite it merely because a new loop must be minted.
-                    const targetPolicy = await this.#workerModels.resolveWorkerModel(workerId, undefined);
-                    if (targetPolicy === null) {
-                        throw new Error(`injectWorker: worker ${workerId} has no resolvable model route`);
-                    }
-                    providerSpec = targetPolicy.providerSpec;
-                    effort = targetPolicy.effort;
-                    childProviderSpec = await this.#workerModels.resolveWorkerSpawnModel(workerId, undefined);
-                }
-                else {
-                    const parentPolicy = await this.#providerPolicyForLoop(sourceLoopId);
-                    providerSpec = parentPolicy.childProviderSpec ?? parentPolicy.providerSpec;
-                    effort = parentPolicy.effort;
-                    // {§worker-model-selection} — lineage inheritance by value:
-                    // the child begins with the spawning loop's effective spawn
-                    // model and no separate override of its own.
-                    childProviderSpec = null;
-                    // {§worker-effort-source} — inherited by value, chosen by nobody on this worker.
-                    await this.#workerModels.persistGenerationPolicy(workerId, {
-                        model_route_id: await routeForSpec(this.#db, providerSpec),
-                        spawn_model_route_id: null,
-                        effort: effort,
-                        effort_source: "default"
-                    });
-                }
-                // {§env-option} — a created worker's explicit overrides replace copied values and enable them.
-                // Names were admitted at the operation; a refusal here is a defect and throws.
-                for (const [alias, value] of Object.entries(environment ?? {})) {
-                    await this.#functionality.invoke("env", "replace", { alias, definition: { value } }, { workspaceId, workerId }, "operation");
-                    await this.#functionality.invoke("env", "enable", { alias }, { workspaceId, workerId }, "operation");
-                }
-                const { action, loopId, messageId } = await ContentUse.read(this.#db, async () => {
-                    const delivered = await this.#prepareMessage(workspaceId, workerId, prompt, attachments);
-                    return this.inject({
-                        workspaceId,
-                        workerId,
-                        prompt: delivered.body,
-                        evidence: delivered.evidence,
-                        sourceLoopId,
-                        ...(source === undefined ? {} : { source }),
-                        ...(opener === undefined ? {} : { opener }),
-                        providerSpec,
-                        effort,
-                        childProviderSpec,
-                        systemPrompt
-                    });
-                });
-                // {§worker-obligations} — the message's durable address, as Open Work names it.
-                const message = await this.#db.drain_message_path.get({ id: messageId });
-                if (message === undefined)
-                    throw new Error(`injectWorker: message ${messageId} has no address`);
-                return { action, loopId, message: message.path };
-            },
+            injectWorker: (args) => this.#delivery.injectWorker(args),
             withWorkspaceTurn: (workspaceId, workerId, run, signal) => this.#workspaceGate.withTurn(workspaceId, workerId, run, signal),
             // {§functionality-hotload} — skills and plugins change out of band.
             // Republish under the workspace turn gate before packet assembly so
@@ -310,6 +219,19 @@ export default class Daemon {
             // worker:// KILL (terminate) — cancel the addressed worker subtree and
             // tear down its held streams before the operation completes.
             cancelWorker: async (workerId, reason) => this.#drains.cancelWorkerTree(workerId, reason),
+            // {§membership-auto-add} — a READ or FIND admits what it reached for as the Worker's own
+            // definition; the members scope's refusal admits nothing and is not a failure of the read.
+            admitMembers: async (identity, files) => {
+                try {
+                    const result = await this.#functionality.invoke("members", "add", { files }, identity, "operation");
+                    return result.status < 400 ? files : [];
+                }
+                catch (cause) {
+                    if (cause instanceof OperationFailureError && cause.result.status < 500)
+                        return [];
+                    throw cause;
+                }
+            },
             noticeNotify: (workspaceId, payload) => this.notifyNotice(workspaceId, payload),
             loopPacketNotify: (workspaceId, payload) => {
                 this.#broadcast({ workspaceId }, "loop/packet", payload);
@@ -321,54 +243,16 @@ export default class Daemon {
             completeAbandonedMessages: (workspaceId, workerId, loopId, status) => MessageAbandonment.complete(this.#engine, this.#db, workspaceId, workerId, loopId, status),
             lifecycle: this.#lifecycle,
             injectPrompt: (loopId, prompt, openPaths, source, evidence, messageAddress, opener) => this.#engine.injectIntoLoop(loopId, prompt, openPaths, source, evidence, messageAddress, opener),
-            assertInjectionCompatibility: async ({ workerId, loopId, providerSpec, providerSpecExplicit, effort, childProviderSpec, turnCeiling }) => {
-                // An omitted selector keeps the loop's durable provider; only an
-                // explicit selection is checked against it (a deliberate switch).
-                if (providerSpecExplicit !== false) {
-                    await this.#assertLoopProvider(loopId, providerSpec);
-                }
-                await this.#assertLoopEffort(loopId, effort);
-                if (childProviderSpec !== undefined) {
-                    await this.#assertLoopChildProvider(loopId, childProviderSpec);
-                }
-                await this.#assertLoopMaxTurns(loopId, turnCeiling?.source === "explicit" ? turnCeiling.effective : undefined);
-            },
-            runLoop: async ({ workspaceId, workerId, loopId, maxTurns, prompt, systemPrompt, signal, onSettled }) => {
-                // The drain callback is the final provider/model boundary. Every
-                // admission path, including boot recovery, terminates here.
-                await this.#assertModelWorker(workspaceId, workerId);
-                const releaseCapabilities = await this.#residency.acquire(workspaceId);
-                try {
-                    // Worker settings can change while Functionality remains
-                    // resident. Reconcile the worker-private discovery surface
-                    // at the same pre-inference boundary used for activation.
-                    await this.#residency.reconcile(workspaceId);
-                    const { provider, childProvider } = await this.#providersForLoop(loopId);
-                    return await this.#engine.runLoop({
-                        provider,
-                        childProvider,
-                        workspaceId,
-                        workerId,
-                        loopId,
-                        maxTurns,
-                        messages: [
-                            { role: "system", content: systemPrompt },
-                            { role: "user", content: prompt },
-                        ],
-                        signal,
-                        onSettled
-                    });
-                }
-                finally {
-                    releaseCapabilities();
-                }
-            },
+            assertInjectionCompatibility: (args) => this.#workerModels.assertInjectionCompatibility(args),
+            runLoop: (args) => this.#runDrainLoop(args),
             loopUsage: (loopId) => this.#engine.loopUsage(loopId),
             loopAttributions: (loopId) => this.#engine.loopAttributions(loopId),
             discardLoopNotices: (loopId) => this.#engine.discardLoopNotices(loopId),
             cancelSubscription: (subscriptionId) => this.#engine.cancelSubscription(subscriptionId),
+            subscriptionConcluded: (subscriptionId) => this.#engine.subscriptionConcluded(subscriptionId),
+            reapLoopStreams: (loopId) => this.#engine.reapLoopStreams(loopId),
             hasActiveStreams: (workerId) => this.#workerHasActiveStreams(workerId),
-            readSystemPrompt: () => readFile(Paths.instructionsSystem, "utf8"),
+            readSystemPrompt: () => readFile(Paths.instructionsSystem, "utf8"), // {§card-read-per-wake}
             emitLogEntry: async (workspaceId, logEntryId) => {
                 const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
                 this.#broadcast({ workspaceId }, "log/entry", { entry });
@@ -386,8 +270,53 @@ export default class Daemon {
             const { workspaceId, ...interaction } = event;
             this.#broadcast({ workspaceId }, "loop/interaction", interaction);
         });
-        this.#workerModels = new WorkerModelResolver({ db: this.#db });
+        this.#workerModels = new WorkerModels({ db: this.#db, provider: this.#provider, policyChanged: (workerId) => this.#announceWorkerPolicy(workerId) });
+        this.#delivery = new MessageDelivery({
+            db, workerModels: this.#workerModels, functionality: this.#functionality, mimetypes: this.#mimetypes,
+            inject: (args) => this.inject(args),
+        });
         this.#reads = new ClientReads({ db: this.#db, engine: this.#engine, workspaceGate: this.#workspaceGate, residency: this.#residency });
+        this.#clientOperations = new ClientOperations({
+            db, engine: this.#engine, residency: this.#residency, workspaceGate: this.#workspaceGate,
+            assertModelWorker: (workspaceId, workerId) => this.#workerModels.assertModelWorker(workspaceId, workerId),
+            assertWorkerOwned: (workspaceId, workerId) => this.#assertWorkerOwned(workspaceId, workerId),
+            emitLogEntry: async (workspaceId, logEntryId) => {
+                const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
+                this.#broadcast({ workspaceId }, "log/entry", { entry });
+            },
+        });
+    }
+    // The drain callback is the final provider/model boundary. Every admission path, including boot recovery,
+    // terminates here.
+    async #runDrainLoop({ workspaceId, workerId, loopId, maxTurns, prompt, systemPrompt, signal, onSettled }) {
+        // The drain callback is the final provider/model boundary. Every
+        // admission path, including boot recovery, terminates here.
+        await this.#workerModels.assertModelWorker(workspaceId, workerId);
+        const releaseCapabilities = await this.#residency.acquire(workspaceId);
+        try {
+            // Worker settings can change while Functionality remains
+            // resident. Reconcile the worker-private discovery surface
+            // at the same pre-inference boundary used for activation.
+            await this.#residency.reconcile(workspaceId);
+            const { provider: loopProvider, childProvider } = await this.#workerModels.providersForLoop(loopId);
+            return await this.#engine.runLoop({
+                provider: loopProvider,
+                childProvider,
+                workspaceId,
+                workerId,
+                loopId,
+                maxTurns,
+                messages: [
+                    { role: "system", content: systemPrompt },
+                    { role: "user", content: prompt },
+                ],
+                signal,
+                onSettled
+            });
+        }
+        finally {
+            releaseCapabilities();
+        }
     }
     // {§methods-event-subscribe}. A transport module subscribes to the daemon's in-process
     // event source: it receives every workspace-scoped engine event as `(workspaceId, method, params)`
@@ -442,179 +371,24 @@ export default class Daemon {
         ClientInput.assertId("resolveClientInteraction", "workspaceId", respondent.workspaceId);
         await this.#engine.resolveClientInteraction(checkedInteractionId, checkedResolution, respondent, message);
     }
-    async #prepareMessage(workspaceId, workerId, body, attachments = [], envelope) {
-        const published = await MessageResources.publish(body, attachments, {
-            db: this.#db, workspaceId, workerId, loopId: 0, turnId: 0, writer: "_plurnk", signal: undefined,
-            weigh: contentWeight, mimetypes: this.#mimetypes,
-        });
-        return { body: published.body, evidence: {
-                ...(envelope === undefined ? {} : { envelope: structuredClone(envelope) }),
-                ...(published.attachments.length === 0 ? {} : { attachments: published.attachments }),
-            } };
-    }
     async readMessages(args) {
-        await this.#assertModelWorker(args.workspaceId, args.workerId);
+        await this.#workerModels.assertModelWorker(args.workspaceId, args.workerId);
         return MessageResources.read(this.#db, args);
     }
+    // {§methods-worker-inbox}
+    async readInbox(args) {
+        await this.#workerModels.assertModelWorker(args.workspaceId, args.workerId);
+        return MessageResources.inbox(this.#db, args);
+    }
     // {§message-idempotency}
     async messageAdmission(args) {
         const workspaceId = ClientInput.assertId("messageAdmission", "workspaceId", args.workspaceId);
         return await MessageResources.admission(this.#db, workspaceId, args.address, args.body);
     }
-    // {§methods-loop-run} — drive/steer a loop. The module supplies only workspace/worker/prompt;
-    // the provider and the law-file system prompt are core's and stay inside. Returns immediately — the
-    // loop runs async and its outcome arrives on the event source (loop/terminated). `cancelDrain` (public)
-    // is the cancel hook. Both funnel through the unified `inject`, which owns the drain lifecycle.
-    async runLoop(args) {
-        const workspaceId = ClientInput.assertId("runLoop", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("runLoop", "workerId", args.workerId);
-        const recipientLoopId = args.loopId === undefined ? undefined : ClientInput.assertId("runLoop", "loopId", args.loopId);
-        await this.#assertModelWorker(workspaceId, workerId);
-        const attachments = ClientInput.assertMessageResources("runLoop", args.attachments);
-        const body = ClientInput.assertPrompt("runLoop", args.prompt, attachments.length > 0);
-        const source = ClientInput.assertOptionalSource("runLoop", args.source);
-        const messageAddress = ClientInput.assertOptionalSource("runLoop", args.messageAddress);
-        const requestedMaxTurns = ClientInput.assertMaxTurns("runLoop", args.maxTurns);
-        const openPaths = ClientInput.assertOpenPaths("runLoop", args.openPaths);
-        const selector = ClientInput.assertOptionalSelector("runLoop", "selector", args.selector);
-        const childSelector = ClientInput.assertOptionalChildSelector("runLoop", args.childSelector);
-        // {§worker-model-selection} — the worker owns the model. An explicit selector
-        // persists onto the worker; an omitted selector resolves the worker's durable model
-        // (seeded once from the daemon default). The loop then snapshots the resolved route.
-        // A continuation's omitted selector must still keep the loop's durable provider.
-        const selectorExplicit = selector !== undefined;
-        const generationPolicy = await this.#workerModels.resolveWorkerModel(workerId, selector);
-        if (generationPolicy === null) {
-            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this worker.", {}, {
-                stage: "provider-selection",
-                recovery: "Select a configured model provider.",
-                retryable: false
-            }));
-        }
-        const { providerSpec: selection, effort } = generationPolicy;
-        // {§methods-loop-run-child-provider} — the worker's persistent spawn override.
-        const childSelection = await this.#workerModels.resolveWorkerSpawnModel(workerId, childSelector);
-        const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
-        // {§operator-config-max-turns-ceiling} — the operator ceiling clamps a per-call maxTurns; a
-        // seam caller must not bypass operator policy (inject only DEFAULTS from env, never clamps).
-        const ceiling = Knob.integer("PLURNK_SERVICE_MAX_TURNS", -1);
-        const requested = requestedMaxTurns ?? ceiling;
-        const maxTurns = ceiling < 0 ? requested : (requested < 0 ? ceiling : Math.min(requested, ceiling));
-        const turnCeiling = {
-            effective: maxTurns,
-            source: requestedMaxTurns === undefined ? "implicit" : "explicit"
-        };
-        const { action, loopId, turnSeq } = await ContentUse.read(this.#db, async () => {
-            const delivered = await this.#prepareMessage(workspaceId, workerId, body, attachments, args.envelope);
-            return this.inject({
-                workspaceId,
-                workerId,
-                prompt: delivered.body,
-                ...(recipientLoopId === undefined ? {} : { loopId: recipientLoopId }),
-                evidence: delivered.evidence,
-                ...(messageAddress === undefined ? {} : { messageAddress }),
-                ...(source === undefined ? {} : { source }),
-                ...(openPaths !== undefined ? { openPaths } : {}),
-                turnCeiling,
-                providerSpec: selection,
-                providerSpecExplicit: selectorExplicit,
-                effort,
-                childProviderSpec: childSelection,
-                systemPrompt
-            });
-        });
-        return { status: 100, action, loopId, ...(turnSeq !== undefined ? { turnSeq } : {}) };
-    }
-    // {§worker-model-selection} — the loop's durable snapshot is the immutable route ids,
-    // resolved through model_routes at the claim boundary; never re-resolved through the
-    // alias cascade (a changed alias declaration must not rewrite history).
-    async #providerPolicyForLoop(loopId) {
-        const row = await this.#db.drain_loop_generation_policy.get({ loop_id: loopId });
-        if (row === undefined)
-            throw new Error(`loop ${loopId}: provider selection row is missing`);
-        const providerSpec = await specForRoute(this.#db, row.model_route_id);
-        if (providerSpec === null) {
-            throw new Error(`loop ${loopId}: persisted provider selection is missing — refusing boot-default substitution`);
-        }
-        if (row.effort === null) {
-            throw new Error(`loop ${loopId}: persisted effort is missing`);
-        }
-        return {
-            providerSpec,
-            childProviderSpec: await specForRoute(this.#db, row.spawn_model_route_id),
-            effort: row.effort
-        };
-    }
-    async #providerSpecForLoop(loopId) {
-        return (await this.#providerPolicyForLoop(loopId)).providerSpec;
-    }
-    async #providersForLoop(loopId) {
-        const policy = await this.#providerPolicyForLoop(loopId);
-        const provider = await this.#workerModels.providerForPolicy(policy.providerSpec, policy.effort);
-        const childProvider = policy.childProviderSpec === null
-            ? provider
-            : await this.#workerModels.providerForPolicy(policy.childProviderSpec, policy.effort);
-        return { provider, childProvider };
-    }
-    async #assertLoopProvider(loopId, requested) {
-        const selected = await this.#providerSpecForLoop(loopId);
-        if (JSON.stringify(selected) !== JSON.stringify(requested)) {
-            throw daemonFailure("daemon:provider", "loop-provider-conflict", 409, `Loop ${loopId} uses ${modelRouteLabel(selected)}, not ${modelRouteLabel(requested)}.`, {
-                loopId,
-                ...(selected.alias === undefined ? {} : { selectedAlias: selected.alias }),
-                selectedModel: `${selected.provider}/${selected.model}`,
-                ...(requested.alias === undefined ? {} : { requestedAlias: requested.alias }),
-                requestedModel: `${requested.provider}/${requested.model}`,
-                stage: "loop-injection",
-                recovery: "Cancel or conclude the loop before selecting another provider.",
-                retryable: false
-            });
-        }
-    }
-    async #assertLoopEffort(loopId, requested) {
-        const selected = (await this.#providerPolicyForLoop(loopId)).effort;
-        if (selected !== requested) {
-            throw daemonFailure("daemon:provider", "loop-effort-conflict", 409, `Loop ${loopId} uses effort '${selected}', not '${requested}'.`, {
-                loopId,
-                selectedEffort: selected,
-                requestedEffort: requested,
-                stage: "loop-injection",
-                recovery: "Cancel or conclude the loop before selecting another effort.",
-                retryable: false
-            });
-        }
-    }
-    async #assertLoopChildProvider(loopId, requested) {
-        const selected = (await this.#providerPolicyForLoop(loopId)).childProviderSpec;
-        if (JSON.stringify(selected) !== JSON.stringify(requested)) {
-            throw daemonFailure("daemon:provider", "loop-child-provider-conflict", 409, `Loop ${loopId} already has a different child provider policy.`, {
-                loopId,
-                selectedChildAlias: selected?.alias ?? null,
-                selectedChildModel: selected === null ? null : `${selected.provider}/${selected.model}`,
-                requestedChildAlias: requested?.alias ?? null,
-                requestedChildModel: requested === null ? null : `${requested.provider}/${requested.model}`,
-                stage: "loop-injection",
-                recovery: "Cancel or conclude the loop before changing its child provider policy.",
-                retryable: false
-            });
-        }
-    }
-    async #assertLoopMaxTurns(loopId, requested) {
-        if (requested === undefined)
-            return;
-        const durable = await this.#db.drain_get_loop_max_turns.get({ loop_id: loopId });
-        if (durable === undefined)
-            throw new Error(`inject: loop ${loopId} has no durable turn ceiling`);
-        if (durable.max_turns !== requested) {
-            throw daemonFailure("daemon:loop", "turn-ceiling-conflict", 409, `Loop ${loopId} has turn ceiling ${durable.max_turns}, not ${requested}.`, {
-                loopId,
-                selectedMaximumTurns: durable.max_turns,
-                requestedMaximumTurns: requested,
-                stage: "loop-injection",
-                recovery: "Cancel or conclude the loop before selecting another turn ceiling.",
-                retryable: false
-            });
-        }
+    // {§methods-loop-run} — a message delivered to a worker drives or steers its loop: the delivery's owner resolves
+    // the worker's model and the card and injects into the drain; the port's entry point delegates.
+    runLoop(args) {
+        return this.#delivery.runLoop(args);
     }
     async ensureRuntimeWorker(workspaceId) {
         const checked = ClientInput.assertId("worker.ensure-runtime", "workspaceId", workspaceId);
@@ -632,130 +406,34 @@ export default class Daemon {
     async setWorkspaceCapabilities(args) {
         const workspaceId = ClientInput.assertId("workspace.capabilities.set", "workspaceId", args.workspaceId);
         const settings = JSON.parse(ClientInput.parseSettings({ capabilities: args.policy }));
-        if (settings.capabilities === undefined)
+        const capabilities = isRecord(settings) && settings.capabilities !== undefined ? Validator.assertCapabilityPolicy(settings.capabilities) : undefined;
+        if (capabilities === undefined)
             throw daemonFailure("daemon:input", "capability-policy-required", 400, "policy is required.", { field: "policy", retryable: false });
         return this.#residency.exclusively(workspaceId, "capabilities", "try", async () => {
             const row = await this.#db.workspace_capability_policy_update.get({
-                workspace_id: workspaceId, policy: JSON.stringify(settings.capabilities),
+                workspace_id: workspaceId, policy: JSON.stringify(capabilities),
             });
             if (row === undefined)
                 throw daemonFailure("daemon:workspace", "workspace-not-found", 404, `Workspace ${workspaceId} does not exist.`, { workspaceId });
             return await this.#engine.capabilityProjection(workspaceId);
         });
     }
-    // {§worker-model-selection} — project a worker's durable model and spawn override
-    // for a client-interface get/set surface. Ownership is checked at this boundary.
-    async readWorkerModel(args) {
-        const workspaceId = ClientInput.assertId("worker.model.get", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.model.get", "workerId", args.workerId);
-        await this.#assertModelWorker(workspaceId, workerId);
-        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
-        if (row === undefined)
-            throw new Error(`worker ${workerId}: model route row missing`);
-        const modelSpec = await specForRoute(this.#db, row.model_route_id);
-        const spawnModelSpec = await specForRoute(this.#db, row.spawn_model_route_id);
-        return {
-            model: modelSpec === null ? null : projectModelRoute(modelSpec, row.effort, row.effort_source),
-            spawnModel: spawnModelSpec === null ? null : projectModelRoute(spawnModelSpec, row.effort, row.effort_source)
-        };
+    // {§worker-model-selection} {§worker-effort} — the worker's durable model, effort and spawn override are
+    // WorkerModels' to read and set; the port's entry points delegate.
+    readWorkerModel(args) {
+        return this.#workerModels.readWorkerModel(args);
     }
-    // {§worker-model-selection} — persist an explicit model selection onto the worker
-    // and return the resolved spec. An unresolvable selector fails loud here.
-    async setWorkerModel(args) {
-        const workspaceId = ClientInput.assertId("worker.model.set", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.model.set", "workerId", args.workerId);
-        await this.#assertModelWorker(workspaceId, workerId);
-        const selector = ClientInput.assertSelector("worker.model.set", "selector", args.selector);
-        let chosen;
-        if (args.effort !== undefined) {
-            try {
-                chosen = Validator.assertEffort(args.effort);
-            }
-            catch (cause) {
-                throw daemonFailure("daemon:input", "effort-invalid", 400, cause instanceof Error ? cause.message : "The effort is invalid.", { field: "effort", retryable: false });
-            }
-        }
-        const policy = await this.#workerModels.resolveWorkerModel(workerId, selector, chosen);
-        if (policy === null) {
-            throw new OperationFailureError(Results.failure("daemon:provider", "not-configured", 501, "No provider is configured for this worker.", {}, { stage: "provider-selection", recovery: "Select a configured model provider.", retryable: false }));
-        }
-        return projectModelRoute(policy.providerSpec, policy.effort, policy.effortSource);
-    }
-    // {§worker-effort} — the worker's effort is durable and
-    // provider-relative. A model-less worker remains explicitly uninitialized.
-    async readWorkerEffort(args) {
-        const workspaceId = ClientInput.assertId("worker.effort.get", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.effort.get", "workerId", args.workerId);
-        await this.#assertModelWorker(workspaceId, workerId);
-        await this.#workerModels.resolveWorkerModel(workerId, undefined);
-        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
-        if (row === undefined)
-            throw new Error(`worker ${workerId}: generation policy row missing`);
-        if (row.model_route_id === null) {
-            if (row.effort !== null) {
-                throw new Error(`worker ${workerId}: effort exists without a model route`);
-            }
-            return { effort: null, source: "default", supportedEfforts: [] };
-        }
-        if (row.effort === null) {
-            throw new Error(`worker ${workerId}: durable model has no effort`);
-        }
-        return {
-            effort: row.effort,
-            source: row.effort_source,
-            supportedEfforts: await this.#workerModels.supportedEfforts(row)
-        };
+    setWorkerModel(args) {
+        return this.#workerModels.setWorkerModel(args);
     }
-    // {§worker-effort} — mutate between loops, validate against both
-    // the worker model and its optional spawn model, then persist atomically.
-    async setWorkerEffort(args) {
-        const workspaceId = ClientInput.assertId("worker.effort.set", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.effort.set", "workerId", args.workerId);
-        let effort;
-        try {
-            effort = Validator.assertEffort(args.effort);
-        }
-        catch (cause) {
-            throw daemonFailure("daemon:input", "effort-invalid", 400, cause instanceof Error ? cause.message : "The effort is invalid.", { field: "effort", retryable: false });
-        }
-        await this.#assertModelWorker(workspaceId, workerId);
-        // A model-less worker takes the default first; an existing pair is replaced, not re-validated, so an
-        // effort its model no longer supports can be corrected ({§worker-effort}).
-        const current = await this.#db.worker_generation_policy_read.get({ id: workerId });
-        if (current?.model_route_id === null)
-            await this.#workerModels.resolveWorkerModel(workerId, undefined);
-        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
-        if (row === undefined)
-            throw new Error(`worker ${workerId}: generation policy row missing`);
-        const spec = await specForRoute(this.#db, row.model_route_id);
-        if (spec === null) {
-            throw daemonFailure("daemon:provider", "worker-model-unset", 409, `Worker ${workerId} has no model against which to validate an effort.`, {
-                workerId,
-                stage: "provider-selection",
-                recovery: "Select a model before selecting its effort.",
-                retryable: false
-            });
-        }
-        const supportedEfforts = await this.#workerModels.persistGenerationPolicy(workerId, {
-            model_route_id: row.model_route_id,
-            spawn_model_route_id: row.spawn_model_route_id,
-            effort,
-            effort_source: "explicit"
-        });
-        return { effort, source: "explicit", supportedEfforts };
-    }
-    // {§worker-model-selection} — persist the worker's spawn override; a null
-    // selector means inherit (clears the override).
-    async setWorkerSpawnModel(args) {
-        const workspaceId = ClientInput.assertId("worker.child.set", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("worker.child.set", "workerId", args.workerId);
-        await this.#assertModelWorker(workspaceId, workerId);
-        const selector = ClientInput.assertChildSelector("worker.child.set", args.selector);
-        const spec = await this.#workerModels.resolveWorkerSpawnModel(workerId, selector);
-        if (spec === null)
-            return null;
-        const row = await this.#db.worker_generation_policy_read.get({ id: workerId });
-        return projectModelRoute(spec, row?.effort ?? null, row?.effort_source ?? "default");
+    readWorkerEffort(args) {
+        return this.#workerModels.readWorkerEffort(args);
+    }
+    setWorkerEffort(args) {
+        return this.#workerModels.setWorkerEffort(args);
+    }
+    setWorkerSpawnModel(args) {
+        return this.#workerModels.setWorkerSpawnModel(args);
     }
     async #assertWorkerOwned(workspaceId, workerId) {
         const owner = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
@@ -766,46 +444,6 @@ export default class Daemon {
             throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, { workerId, workspaceId, actualWorkspaceId: owner.workspace_id });
         }
     }
-    // {§machine-processes} — provider inference is an exclusive capability of a
-    // model worker. The same assertion is used by early client admissions, the final
-    // drain callback, and the model, reasoning, and spawn-model controls
-    // ({§worker-model-selection}), so recovery and internal callers cannot bypass it.
-    async #assertModelWorker(workspaceId, workerId) {
-        const worker = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
-        if (worker === undefined) {
-            throw daemonFailure("daemon:worker", "worker-not-found", 404, `Worker ${workerId} does not exist.`, { workerId });
-        }
-        if (worker.workspace_id !== workspaceId) {
-            throw daemonFailure("daemon:worker", "workspace-mismatch", 409, `Worker ${workerId} does not belong to workspace ${workspaceId}.`, {
-                workerId,
-                workspaceId,
-                actualWorkspaceId: worker.workspace_id,
-                retryable: false
-            });
-        }
-        if (worker.origin !== "model") {
-            throw daemonFailure("daemon:worker", "model-worker-required", 409, `Worker ${workerId} is not a model worker.`, {
-                workerId,
-                actualOrigin: worker.origin,
-                recovery: "Select or create a model worker.",
-                retryable: false
-            });
-        }
-    }
-    // {§actor-boundary-client-operations} A message speaks for its loop's actor: a person's operation for that
-    // person, as a thread message does; any other loop for its worker.
-    async #messageSource(workspaceId, sourceLoopId, sourceWorkerId, targetWorkerId) {
-        const person = await this.#db.envelope_client_operation_person.get({ loop_id: sourceLoopId });
-        if (person !== undefined)
-            return person.person;
-        if (sourceWorkerId === targetWorkerId)
-            return undefined;
-        const source = await this.#db.envelope_get_worker_by_id.get({ id: sourceWorkerId });
-        if (source === undefined || source.workspace_id !== workspaceId) {
-            throw new Error(`Worker prompt source ${sourceWorkerId} does not belong to workspace ${workspaceId}.`);
-        }
-        return WorkerControlAddress.render(source.name);
-    }
     // {§functionality-model-mutation} — await every queued Functionality
     // publication (a Worker's accepted mutation publishes at its turn boundary).
     async settleFunctionality(workspaceId) {
@@ -816,154 +454,20 @@ export default class Daemon {
     }
     // {§connection-lifecycle} A person's client operation: one administrative loop in the workspace's runtime
     // worker, attributed to its actor, reading `log:///` in the worker that person acts for
-    // ({§actor-boundary-client-operations}).
-    async dispatchClientAction(args) {
-        const workspaceId = ClientInput.assertId("operation.dispatch-batch", "workspaceId", args.workspaceId);
-        const actor = ClientInput.assertActor("operation.dispatch-batch", args.actor);
-        const contextWorkerId = args.contextWorkerId === undefined
-            ? undefined
-            : ClientInput.assertId("operation.dispatch-batch", "contextWorkerId", args.contextWorkerId);
-        if (contextWorkerId !== undefined)
-            await this.#assertModelWorker(workspaceId, contextWorkerId);
-        const { statements } = args;
-        if (statements.length === 0)
-            return [];
-        return await this.#clientOperation({ workspaceId, actor, contextWorkerId, onLoop: args.onLoop }, async (dispatch) => {
-            const results = [];
-            for (const statement of statements)
-                results.push(await dispatch(statement));
-            return results;
-        });
+    // ({§actor-boundary-client-operations}). The operations' owner runs it; the port's entry points delegate.
+    dispatchClientAction(args) {
+        return this.#clientOperations.dispatchClientAction(args);
     }
-    // {§connection-lifecycle} One client operation: the runtime worker's administrative loop with its own
-    // cancellation scope, settled when the operation ends. Nothing else in the runtime worker shares the scope.
-    async #clientOperation(operation, body) {
-        const { workspaceId, actor, contextWorkerId } = operation;
-        const workerId = await RuntimeWorker.ensure(this.#db, workspaceId);
-        const releaseCapabilities = await this.#residency.acquire(workspaceId);
-        try {
-            const loopId = await Envelope.ensureClientLoop(this.#db, workerId, actor);
-            const scope = new AbortController();
-            const signal = AbortSignal.any([scope.signal, this.#clientOperations.signal]);
-            const settled = Promise.withResolvers();
-            this.#clientLoops.set(loopId, { workspaceId, scope, settled: settled.promise });
-            const unbind = this.#engine.bindLoopSignal(loopId, signal);
-            try {
-                operation.onLoop?.({ workerId, loopId });
-                const result = await body(async (statement) => {
-                    signal.throwIfAborted();
-                    return await this.#dispatchClientStatement({
-                        workspaceId, workerId, loopId, statement,
-                        contextWorkerId: contextWorkerId ?? null,
-                    });
-                });
-                signal.throwIfAborted();
-                await Envelope.closeClientLoop(this.#db, loopId, { status: 200 });
-                return result;
-            }
-            catch (error) {
-                // A cancelled operation settles cancelled, however its statement in flight ended.
-                const failure = signal.aborted ? new OperationFailureError(clientOperationCancelled(signal.reason)) : error;
-                await Envelope.closeClientLoop(this.#db, loopId, clientActionFailure(failure));
-                throw failure;
-            }
-            finally {
-                unbind();
-                this.#clientLoops.delete(loopId);
-                settled.resolve();
-            }
-        }
-        finally {
-            releaseCapabilities();
-        }
-    }
-    // {§connection-lifecycle} Cancel exactly one client operation: its dispatch while it runs, and every execution its
-    // rows started that still runs. The rest of the runtime worker runs on.
-    async cancelLoop(args) {
-        const workspaceId = ClientInput.assertId("operation.cancel", "workspaceId", args.workspaceId);
-        const loopId = ClientInput.assertId("operation.cancel", "loopId", args.loopId);
-        const operation = this.#clientLoops.get(loopId);
-        const dispatching = operation !== undefined && operation.workspaceId === workspaceId && !operation.scope.signal.aborted;
-        if (dispatching)
-            operation.scope.abort(args.reason ?? "user_cancelled");
-        const executions = await ChannelWrite.findOpenSubscriptionsForClientLoop(this.#db, { workspaceId, loopId });
-        const reaped = await Promise.all(executions.map((subscriptionId) => this.#engine.cancelSubscription(subscriptionId)));
-        return dispatching || reaped.includes(true);
-    }
-    async #dispatchClientStatement(args) {
-        const { workspaceId, workerId, loopId, statement, contextWorkerId } = args;
-        return this.#workspaceGate.withTurn(workspaceId, workerId, async () => {
-            await this.#residency.reconcile(workspaceId);
-            const { id: turnId } = await Turn.open(this.#db, {
-                loopId,
-                producer: "client",
-                kind: "operation"
-            });
-            let turnOpen = true;
-            try {
-                const entryIds = [];
-                const result = await this.#engine.dispatch({
-                    statement, workspaceId, workerId, loopId, turnId, sequence: 1,
-                    origin: "client", client: { contextWorkerId },
-                    onDispatch: (logEntryId) => { entryIds.push(logEntryId); }
-                });
-                await Turn.complete(this.#db, turnId, result.status);
-                turnOpen = false;
-                for (const logEntryId of entryIds) {
-                    const entry = await LogEntry.fetchLogEntry(this.#db, logEntryId);
-                    this.#broadcast({ workspaceId }, "log/entry", { entry });
-                }
-                return result;
-            }
-            catch (cause) {
-                if (turnOpen) {
-                    try {
-                        await Turn.complete(this.#db, turnId, 500);
-                    }
-                    catch (completionCause) {
-                        throw new AggregateError([cause, completionCause], `client operation turn ${turnId} failed and could not be completed`);
-                    }
-                }
-                throw cause;
-            }
-        }, this.#clientLoops.get(loopId)?.scope.signal);
+    cancelLoop(args) {
+        return this.#clientOperations.cancelLoop(args);
     }
     // {§methods} — the module's render surface beyond the journal. Thin delegations
     // into core's envelope / membership / provider machinery; the module fans the results into its own views.
     listProviders() {
-        const active = process.env.PLURNK_MODEL?.toLowerCase();
-        let aliases;
-        try {
-            aliases = parseAliasesFromEnv();
-        }
-        catch (cause) {
-            if (!(cause instanceof ConfigurationError))
-                throw cause;
-            throw new OperationFailureError(Results.configurationFailure(cause), { cause });
-        }
-        return {
-            aliases: aliases.map((a) => {
-                const isActive = active === a.alias;
-                // {§agui-provider-routes} — the route a worker seeded from this alias gets: what it would read back.
-                let effort;
-                try {
-                    effort = ProviderInstantiate.configuredEffort(a);
-                }
-                catch (cause) {
-                    const invalid = new ConfigurationError("PLURNK_PROVIDERS_EFFORT", cause instanceof Error ? cause.message : String(cause), { cause });
-                    throw new OperationFailureError(Results.configurationFailure(invalid), { cause });
-                }
-                return {
-                    ...projectModelRoute(a, effort, "default"), alias: a.alias, active: isActive,
-                    inputCapacity: isActive && this.#provider !== null ? this.#provider.inputCapacity : null
-                };
-            })
-        };
+        return this.#workerModels.listProviders();
     }
-    // {§model-catalog} The catalog is a bounded, daemon-local projection.
-    // It performs no provider I/O and never changes the worker's selection.
     listModels(query) {
-        return listModelCatalog(query);
+        return this.#workerModels.listModels(query);
     }
     // {§client-display-capabilities} Core composes the installed family
     // declarations; interface modules expose this contracts-owned wire without
@@ -988,8 +492,9 @@ export default class Daemon {
         }));
         return Validator.assertClientDisplayCapabilities([...schemes, ...mimetypes]);
     }
-    async listWorkspaces() {
-        return (await Envelope.listWorkspaces(this.#db)).map((row) => ({ ...row, project_label: this.#projectLabel(row.project_root) }));
+    async listWorkspaces(query = {}) {
+        const hidden = query.hidden === undefined ? undefined : ClientInput.assertFlag("workspace.list", "hidden", query.hidden);
+        return (await Envelope.listWorkspaces(this.#db, hidden)).map((row) => ({ ...row, project_label: this.#projectLabel(row.project_root) }));
     }
     // {§workspace-label} — the folder as the daemon spells it for display: the spelling a default name takes.
     #projectLabel(projectRoot) {
@@ -998,21 +503,23 @@ export default class Daemon {
     #labelled(envelope) {
         return { ...envelope, projectLabel: this.#projectLabel(envelope.projectRoot) };
     }
-    listWorkers(workspaceId, query = {}) {
+    async listWorkers(workspaceId, query = {}) {
         const origin = query.origin;
         if (origin !== undefined && !["model", "client", "_plurnk"].includes(origin)) {
-            throw daemonFailure("daemon:worker", "origin-invalid", 400, `Worker origin '${String(origin)}' is invalid.`, { origin, retryable: false });
+            throw daemonFailure("daemon:worker", "origin-invalid", 400, `Worker origin '${origin}' is invalid.`, { origin, retryable: false });
         }
         const parentWorkerId = query.parentWorkerId === undefined
             ? undefined
             : query.parentWorkerId === null
                 ? null
                 : ClientInput.assertId("workspace.workers", "parentWorkerId", query.parentWorkerId);
+        const hidden = query.hidden === undefined ? undefined : ClientInput.assertFlag("workspace.workers", "hidden", query.hidden);
         // {§methods-worker-list} — an omitted parent filter must stay absent:
         // the envelope keys the filter on the property's presence, not its value.
-        return Envelope.listWorkersForWorkspace(this.#db, ClientInput.assertId("workspace.workers", "workspaceId", workspaceId), {
+        return await Envelope.listWorkersForWorkspace(this.#db, ClientInput.assertId("workspace.workers", "workspaceId", workspaceId), {
             ...(origin === undefined ? {} : { origin }),
-            ...(parentWorkerId === undefined ? {} : { parentWorkerId })
+            ...(parentWorkerId === undefined ? {} : { parentWorkerId }),
+            ...(hidden === undefined ? {} : { hidden })
         });
     }
     async readWorker(args) {
@@ -1044,6 +551,16 @@ export default class Daemon {
         await this.#assertWorkerOwned(workspaceId, workerId);
         return this.#engine.workerAccounting(workerId);
     }
+    // {§methods-worker-gauge}
+    async workerGauge(args) {
+        const workspaceId = ClientInput.assertId("worker.gauge", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.gauge", "workerId", args.workerId);
+        await this.#assertWorkerOwned(workspaceId, workerId);
+        const latest = await this.#db.application_latest_packet_loop.get({ worker_id: workerId });
+        if (latest === undefined)
+            return { curationWeight: null, curationBudget: null, contextTokens: null, contextCapacity: null };
+        return Engine.clientGauge(await this.#engine.loopGauge(latest.id));
+    }
     async listWorkerLoops(args) {
         const workspaceId = ClientInput.assertId("worker.loops", "workspaceId", args.workspaceId);
         const workerId = ClientInput.assertId("worker.loops", "workerId", args.workerId);
@@ -1062,9 +579,25 @@ export default class Daemon {
             waitUntil: row.waitUntil,
             invocation: row.invocation === null || row.invocationWorkerId === null ? null : { workerId: row.invocationWorkerId, address: row.invocation },
             // {§validation-topology}: a stored result is chapter 3's (`loops_terminal_result_contract`); it is parsed, not re-asserted.
-            terminalResult: row.terminalResult === null ? null : JSON.parse(row.terminalResult)
+            terminalResult: row.terminalResult === null ? null : Results.fromRow(row.terminalResult)
         }));
     }
+    // {§methods-worker-overview} The places of the daemon, or of one workspace, with what waits there.
+    async readWorkerOverview(args) {
+        const workspaceId = args.workspaceId === undefined ? null : ClientInput.assertId("worker.overview", "workspaceId", args.workspaceId);
+        const { limit, excerptChars } = args;
+        if (!isSafeInteger(limit) || limit < 1 || !isSafeInteger(excerptChars) || excerptChars < 1) {
+            throw new TypeError("readWorkerOverview takes a positive limit and excerpt length.");
+        }
+        if (workspaceId !== null && await this.#db.envelope_get_workspace.get({ id: workspaceId }) === undefined) {
+            throw daemonFailure("daemon:workspace", "workspace-not-found", 404, `Workspace ${workspaceId} does not exist.`, { workspaceId });
+        }
+        return await WorkerOverview.read(this.#db, {
+            workspaceId, limit, excerptChars, projectLabel: (projectRoot) => this.#projectLabel(projectRoot),
+            // {§agui-status-descendants} The gates the status tree counts: the pending proposals and client interactions.
+            pending: async (id) => [...await this.#engine.pendingProposals(id), ...await this.#engine.pendingClientInteractions(id)],
+        });
+    }
     // {§methods-workspace-prompts}: root-worker loop seeds, newest-first.
     // {§share} — one workspace's share. The daemon names its own database; the caller names an absolute folder.
     async shareWorkspace({ workspaceId, folder }) {
@@ -1111,7 +644,12 @@ export default class Daemon {
             if (derived === undefined)
                 return undefined;
             const existing = await this.#db.envelope_get_workspace_by_name.get({ name: derived });
-            return existing === undefined ? undefined : this.#labelled(await Envelope.attachToWorkspace(this.#db, existing.id));
+            if (existing === undefined)
+                return undefined;
+            // {§place-hiding} Creating by the folder selects a hidden workspace and shows it.
+            if (existing.hidden_at !== null)
+                await this.setWorkspaceHidden({ workspaceId: existing.id, hidden: false });
+            return this.#labelled(await Envelope.attachToWorkspace(this.#db, existing.id));
         };
         return observed(// {§observability-boundary}
         "workspace.create", {}, async (span) => {
@@ -1172,29 +710,46 @@ export default class Daemon {
         await this.#assertWorkerOwned(workspaceId, workerId);
         return (await this.#db.worker_reference_list.all({ namespace, worker_id: workerId })).map(({ reference }) => reference);
     }
-    // {§rollback} {§methods-workspace-rollback} — the compensations are one client operation of the acting person
-    // ({§connection-lifecycle}): attributed to that person and, being that person's decision, never routed for review.
-    async rollback(args) {
-        const workspaceId = ClientInput.assertId("workspace.rollback", "workspaceId", args.workspaceId);
-        const workerId = ClientInput.assertId("workspace.rollback", "workerId", args.workerId);
-        const actor = ClientInput.assertActor("workspace.rollback", args.actor);
-        if (typeof args.to !== "string")
-            throw daemonFailure("daemon:rollback", "coordinate-invalid", 400, "The rollback coordinate must be a string.", {});
-        await this.#assertWorkerOwned(workspaceId, workerId);
-        const report = await this.#clientOperation({ workspaceId, actor, contextWorkerId: workerId }, (dispatch) => Rollback.run({
-            db: this.#db,
-            projectRoot: async (id) => (await this.#db.envelope_get_workspace.get({ id }))?.project_root ?? null,
-            executorTags: (id) => this.#engine.executorTags(id),
-            apply: async (statement) => await dispatch(statement),
-        }, { workspaceId, workerId, to: args.to }));
-        return Validator.assertRollbackReport(report);
+    rollback(args) {
+        return this.#clientOperations.rollback(args);
     }
     async renameWorkspace(workspaceId, name) {
         const checkedWorkspaceId = ClientInput.assertId("workspace.rename", "workspaceId", workspaceId);
         const checkedName = ClientInput.assertOptionalWorkspaceName("workspace.rename", "name", name);
         if (checkedName === undefined)
             throw new Error("ClientInput.assertOptionalWorkspaceName accepted a required name as undefined");
-        return { id: checkedWorkspaceId, name: await Envelope.updateWorkspaceName(this.#db, checkedWorkspaceId, checkedName) };
+        const renamed = { id: checkedWorkspaceId, name: await Envelope.updateWorkspaceName(this.#db, checkedWorkspaceId, checkedName) };
+        // {§notifications-workspace-renamed}
+        this.#broadcast({ workspaceId: checkedWorkspaceId }, "workspace/renamed", renamed);
+        return renamed;
+    }
+    // {§methods-workspace-hide} {§place-hiding}
+    async setWorkspaceHidden(args) {
+        const workspaceId = ClientInput.assertId("workspace.hidden", "workspaceId", args.workspaceId);
+        const hidden = ClientInput.assertFlag("workspace.hidden", "hidden", args.hidden);
+        const { hiding, changed } = await Places.setWorkspaceHidden(this.#db, (id) => this.#placeGates(id), workspaceId, hidden);
+        // {§notifications-workspace-hidden}
+        if (changed)
+            this.#broadcast({ workspaceId }, "workspace/hidden", hiding);
+        return hiding;
+    }
+    // {§methods-worker-hide} {§place-hiding}
+    async setWorkerHidden(args) {
+        const workspaceId = ClientInput.assertId("worker.hidden", "workspaceId", args.workspaceId);
+        const workerId = ClientInput.assertId("worker.hidden", "workerId", args.workerId);
+        const hidden = ClientInput.assertFlag("worker.hidden", "hidden", args.hidden);
+        const hiding = await Places.setWorkerHidden(this.#db, (id) => this.#placeGates(id), workspaceId, workerId, hidden);
+        // {§notifications-worker-hidden}
+        if (hiding.workerIds.length > 0)
+            this.#broadcast({ workspaceId }, "worker/hidden", hiding);
+        return hiding;
+    }
+    // The gates a hide is refused over, as the overview counts them.
+    async #placeGates(workspaceId) {
+        return {
+            proposals: await this.#engine.pendingProposals(workspaceId),
+            questions: await this.#engine.pendingClientInteractions(workspaceId),
+        };
     }
     // {§methods-worker-create}: a fresh worker is model-origin, with an empty private log.
     // {§machine-processes} Workers have independent histories within a shared workspace.
@@ -1216,15 +771,22 @@ export default class Daemon {
         else if (args.owner !== undefined) {
             await WorkerOwners.registered(this.#db, workspaceId, args.owner);
         }
-        if (name !== undefined) {
-            const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
-            if (taken !== undefined) {
-                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId} by a ${taken.origin} worker.`, { workspaceId, name, actualOrigin: taken.origin, recovery: "Choose another worker name.", retryable: false });
-            }
+        let worker;
+        try {
+            worker = await Envelope.createModelWorker(this.#db, workspaceId, name, parentWorkerId, args.owner);
+        }
+        catch (error) {
+            if (name === undefined || !(error instanceof WorkerNameConflictError))
+                throw error;
+            throw await this.#workerNameConflict(workspaceId, name);
         }
-        const worker = await Envelope.createModelWorker(this.#db, workspaceId, name, parentWorkerId, args.owner);
         return { workerId: worker.id, workerName: worker.name };
     }
+    // {§methods-worker-create} The claim decides a name, so a request that loses it to another, at any moment, is refused alike.
+    async #workerNameConflict(workspaceId, name) {
+        const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
+        return daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId}${taken === undefined ? "" : ` by a ${taken.origin} worker`}.`, { workspaceId, name, ...(taken === undefined ? {} : { actualOrigin: taken.origin }), recovery: "Choose another worker name.", retryable: false });
+    }
     // {§worker-scheme-fork} — branch a worker's log while sharing its workspace.
     // Core owns the workspace check and immutable worker-name admission.
     async forkWorker(args) {
@@ -1232,14 +794,16 @@ export default class Daemon {
         const workerId = ClientInput.assertId("run.fork", "workerId", args.workerId);
         const name = ClientInput.assertOptionalWorkerName("run.fork", "name", args.name);
         // {§machine-processes-worker-origin} A branch is a model's: only a model worker's log forks.
-        await this.#assertModelWorker(workspaceId, workerId);
-        if (name !== undefined) {
-            const taken = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name });
-            if (taken !== undefined) {
-                throw daemonFailure("daemon:worker", "name-conflict", 409, `Worker name '${name}' is already in use in workspace ${workspaceId} by a ${taken.origin} worker.`, { workspaceId, name, actualOrigin: taken.origin, recovery: "Choose another worker name.", retryable: false });
-            }
+        await this.#workerModels.assertModelWorker(workspaceId, workerId);
+        let branchWorkerId;
+        try {
+            branchWorkerId = await Fork.fork(this.#db, workerId, name);
+        }
+        catch (error) {
+            if (name === undefined || !(error instanceof WorkerNameConflictError))
+                throw error;
+            throw await this.#workerNameConflict(workspaceId, name);
         }
-        const branchWorkerId = await Fork.fork(this.#db, workerId, name);
         const branch = await this.#db.envelope_get_worker_by_id.get({ id: branchWorkerId });
         return { workerId: branchWorkerId, workerName: branch?.name ?? null, parentWorkerId: workerId };
     }
@@ -1282,102 +846,22 @@ export default class Daemon {
             scheme
         };
     }
-    // {§http-host} — exterior adapters mount on the daemon's one listener at start(); the
-    // daemon never opens a second transport, and a daemon without a listener says so.
+    // {§http-host} {§module-http-mounts} — a module mounts on the daemon's one listener exactly what it claimed;
+    // the modules' owner keeps the claims. {§module-action-registration}: a module's actions, registered, listed and invoked.
     registerHttpRoute(prefix, handler) {
-        if (this.#http === null)
-            throw new Error(`registerHttpRoute: this daemon has no HTTP listener to mount '${prefix}' on`);
-        // {§module-http-mounts} — a module mounts exactly what it claimed.
-        if (!this.#mountClaims.has(prefix))
-            throw new Error(`registerHttpRoute: no module declared '${prefix}' among its mounts`);
-        this.#http.registerHttpRoute(prefix, handler);
-        this.#mounted.add(prefix);
+        this.#modules.registerHttpRoute(prefix, handler);
     }
     httpAddress() {
-        if (this.#http === null)
-            throw new Error("httpAddress: this daemon has no HTTP listener");
-        return this.#http.httpAddress();
+        return this.#modules.httpAddress();
     }
     registerModuleAction(registration) {
-        const { name, scope, inputSchema, outputSchema, handler } = registration;
-        if (name.length === 0)
-            throw new Error("registerModuleAction: action name must not be empty");
-        if (scope !== "daemon" && scope !== "workspace" && scope !== "worker") {
-            throw new Error(`module action '${name}' has invalid scope '${String(scope)}'`);
-        }
-        if (inputSchema === null || typeof inputSchema !== "object" || Array.isArray(inputSchema)) {
-            throw new Error(`module action '${name}' has no input schema`);
-        }
-        if (outputSchema === null || typeof outputSchema !== "object" || Array.isArray(outputSchema)) {
-            throw new Error(`module action '${name}' has no output schema`);
-        }
-        for (const [role, schema] of [["input", inputSchema], ["output", outputSchema]]) {
-            try {
-                Validator.validateJsonSchemaInstance(schema, {});
-            }
-            catch (cause) {
-                throw new Error(`module action '${name}' has an invalid ${role} schema`, { cause });
-            }
-        }
-        if (typeof handler !== "function")
-            throw new Error(`module action '${name}' has no handler`);
-        if (registration.residency !== "required" && registration.residency !== "none") {
-            throw new Error(`module action '${name}' must declare its residency requirement`);
-        }
-        if (scope === "daemon" && registration.residency !== "none") {
-            throw new Error(`daemon module action '${name}' cannot require workspace residency`);
-        }
-        if (this.#moduleActions.has(name))
-            throw new Error(`module action '${name}' is already registered`);
-        this.#moduleActions.set(name, registration);
+        this.#modules.registerAction(registration);
     }
     listModuleActions() {
-        return [...this.#moduleActions.values()]
-            .map(({ name, scope, inputSchema, outputSchema }) => ({
-            name,
-            scope,
-            inputSchema,
-            outputSchema
-        }))
-            .toSorted((left, right) => left.name.localeCompare(right.name));
-    }
-    async invokeModuleAction(name, params, context) {
-        const registration = this.#moduleActions.get(name);
-        if (registration === undefined)
-            throw new Error(`module action '${name}' is not registered`);
-        if (registration.scope !== context.scope) {
-            throw new Error(`module action '${name}' requires ${registration.scope} context, not ${context.scope}`);
-        }
-        let releaseCapabilities;
-        if (context.scope === "worker") {
-            const workspaceId = ClientInput.assertId(`module action '${name}'`, "workspaceId", context.workspaceId);
-            const workerId = ClientInput.assertId(`module action '${name}'`, "workerId", context.workerId);
-            const worker = await this.#db.envelope_get_worker_by_id.get({ id: workerId });
-            if (worker === undefined || worker.workspace_id !== workspaceId) {
-                throw daemonFailure("daemon:module-action", "worker-not-found", 404, `Worker ${workerId} does not exist in workspace ${workspaceId}.`, { workspaceId, workerId, retryable: false });
-            }
-        }
-        if (registration.residency === "required" && context.scope !== "daemon") {
-            releaseCapabilities = await this.#residency.acquire(context.workspaceId);
-        }
-        else if (context.scope === "workspace") {
-            await this.#residency.identity(context.workspaceId);
-        }
-        try {
-            if (registration.residency === "required" && context.scope === "worker") {
-                const release = await this.#workspaceGate.acquireTurn(context.workspaceId, context.workerId);
-                try {
-                    await this.#residency.reconcile(context.workspaceId);
-                }
-                finally {
-                    release();
-                }
-            }
-            return await registration.handler(params, context);
-        }
-        finally {
-            releaseCapabilities?.();
-        }
+        return this.#modules.listActions();
+    }
+    invokeModuleAction(name, params, context) {
+        return this.#modules.invokeAction(name, params, context);
     }
     registerWorkspaceCapabilityProvider(namespaceOwner, provider) {
         this.#residency.registerProvider(namespaceOwner, provider);
@@ -1434,7 +918,7 @@ export default class Daemon {
     registerModule(module, owner) {
         if (this.#started)
             throw new Error("registerModule: modules must be registered before daemon start");
-        this.#modules.push({ module, owner });
+        this.#modules.register(module, owner);
     }
     async start() {
         if (this.#started)
@@ -1445,7 +929,7 @@ export default class Daemon {
         await this.#configuration.capture("wait", () => TurnDispositionHandler.configuredWaitSeconds());
         await this.#configuration.capture("execution", () => Exec.validateConfiguration());
         this.#retention = await this.#configuration.capture("retention", () => new Retention(this.#db, retentionPolicy()));
-        this.#clientOperations = new AbortController();
+        this.#clientOperations.start();
         this.#started = true;
         // {§db-space-reclamation} — the file is brought to the policy's auto-vacuum mode before any work.
         if (this.#retention !== null) {
@@ -1472,7 +956,7 @@ export default class Daemon {
         this.#engine.setFunctionalityDocuments((workspaceId) => this.#functionality.documents(workspaceId));
         // {§question-tool} — the native request-user-input runtime, process-wide;
         // workspace admission gates its doc visibility and dispatch ({§workspace-capability-policy}).
-        await this.#engine.registerRuntimes([{
+        this.#engine.registerRuntimes([{
                 tag: "question",
                 entry: {
                     executor: new QuestionTool({ runtime: "question", glyph: "❓" }),
@@ -1492,44 +976,9 @@ export default class Daemon {
         // (agnostic, by plurnk.kind:"scheme"). They light up http://, etc. with
         // no further engine change — #run wraps their context in SchemeCtxImpl ({§extension-discovery}).
         await this.#schemes.discoverExternal(this.#discoveryCwd);
-        // {§module-discovery} — third-party daemon-module composition: trusted
-        // packages declaring `plurnk.kind: "module"` register beside the
-        // service's explicit composition before any module setup runs.
-        const discoveredModules = await discoverDaemonModules({
-            cwd: this.#discoveryCwd, hostPaths: this.#hostPaths, registered: new Set(this.#modules.map(({ owner }) => owner)),
-        });
-        for (const { owner, cause } of discoveredModules.configurationErrors)
-            this.#configuration.record(owner, cause);
-        this.#configuration.pluginReports(discoveredModules.reports);
-        for (const packageName of discoveredModules.skipped) {
-            console.warn(`module discovery: '${packageName}' is discovered but untrusted (PLURNK_EXTENSIONS_TRUSTED_ONLY); not registered`);
-        }
-        for (const { module, owner } of discoveredModules.modules) {
-            this.#modules.push({ module, owner });
-        }
-        // {§module-http-mounts} — a daemon without a listener has nothing to serve a mount on: it
-        // leaves out every module that declares one, and says so.
-        if (this.#http === null) {
-            this.#modules = this.#modules.filter(({ module, owner }) => {
-                const mounts = module.mounts ?? [];
-                if (mounts.length === 0)
-                    return true;
-                this.#configuration.leftOut(`module:${owner}`, `module '${owner}' mounts ${mounts.map((prefix) => `'${prefix}'`).join(", ")} and this daemon has no HTTP listener: left out`);
-                return false;
-            });
-        }
-        // {§module-contained-configuration} — what a module contained is its own configuration diagnostic.
-        for (const { module, owner } of this.#modules) {
-            for (const { key, message } of module.contained ?? [])
-                this.#configuration.record(`module:${owner}`, new ConfigurationError(key, message));
-        }
-        this.#claimMounts();
-        const setupSeam = this;
-        for (const { module } of this.#modules) {
-            if (module.stop !== undefined || module.close !== undefined)
-                this.#moduleLifetimes.push(module);
-            await module.setup?.(setupSeam);
-        }
+        // {§module-discovery} — discovery composes beside the service's explicit modules, then every module sets
+        // up against this daemon as the seam ({§module-lifecycle}).
+        await this.#modules.setup(this, { cwd: this.#discoveryCwd, hostPaths: this.#hostPaths });
         // {§credential-authority} — the posture is never an inference: a listening daemon that
         // authenticates needs a module that issues, and it writes a minted secret where same-user
         // clients read it before any mount is admitted; a configured or absent secret leaves no file.
@@ -1548,39 +997,8 @@ export default class Daemon {
         // {§module-lifecycle} — the daemon opened its one transport before admission ({§http-host});
         // modules mount their routes on it here, only after capability publication and durable
         // lifecycle recovery are complete. None opens a listener of its own.
-        for (const { module } of this.#modules) {
-            const started = await module.start?.(this);
-            if (started !== undefined && !this.#moduleLifetimes.includes(started)) {
-                this.#moduleLifetimes.push(started);
-            }
-        }
-        this.#admitMounts();
-    }
-    // {§module-http-mounts} — every prefix is claimed before any module sets up: one owner per
-    // prefix, including the optional root mount.
-    #claimMounts() {
-        for (const { module, owner } of this.#modules) {
-            for (const prefix of module.mounts ?? []) {
-                if (!HttpListener.isPrefix(prefix)) {
-                    throw new Error(`module '${owner}' declares HTTP mount '${prefix}', which is not an absolute pathname prefix`);
-                }
-                const holder = this.#mountClaims.get(prefix);
-                if (holder !== undefined)
-                    throw new Error(`HTTP mount '${prefix}' is claimed by both '${holder}' and '${owner}'`);
-                this.#mountClaims.set(prefix, owner);
-            }
-        }
-    }
-    // {§module-http-mounts} — the listener is admitted once every module has started and every
-    // claim is mounted, so readiness never depends on registration order.
-    #admitMounts() {
-        if (this.#http === null)
-            return;
-        for (const [prefix, owner] of this.#mountClaims) {
-            if (!this.#mounted.has(prefix))
-                throw new Error(`module '${owner}' claimed HTTP mount '${prefix}' but did not mount it at start`);
-        }
-        this.#http.admit();
+        await this.#modules.start(this);
+        this.#modules.admitMounts();
     }
     async #recoverLifecycle() {
         await this.#db.recovery_settle_process_owners({});
@@ -1592,7 +1010,7 @@ export default class Daemon {
         for (const source of orphanSources) {
             await this.#drains.reconcileOrphanedMessages(source.worker_id, source.loop_id);
         }
-        const systemPrompt = await readFile(Paths.instructionsSystem, "utf8");
+        const systemPrompt = await readFile(Paths.instructionsSystem, "utf8"); // {§card-read-per-wake}
         const queued = await this.#db.recovery_queued_workers.all({});
         const invalidQueued = queued.find(({ origin }) => origin !== "model");
         if (invalidQueued !== undefined) {
@@ -1631,21 +1049,14 @@ export default class Daemon {
         this.#engine.cancelAllProposals("daemon_stopping");
         this.#engine.cancelDerivations(derivationAbort);
         this.#drains.beginStop("daemon_stopping");
-        this.#clientOperations.abort("daemon_stopping");
+        this.#clientOperations.beginStop("daemon_stopping");
         this.#residency.beginStop();
         const shutdown = deadline ?? new StopDeadline();
         // Stop accepting external work immediately, but do not await listener
         // closure before cancelling active workers: an SSE connection may itself be
         // waiting for the worker cancellation that follows.
-        const modules = this.#moduleLifetimes.toReversed();
-        this.#moduleLifetimes = [];
-        const modulePhase = async (phase) => {
-            const results = await Promise.allSettled(modules.map((module) => Promise.resolve().then(() => module[phase]?.())));
-            const errors = results.filter((result) => result.status === "rejected").map(({ reason }) => reason);
-            if (errors.length > 0)
-                throw new AggregateError(errors, `module ${phase} failed`);
-        };
-        const moduleStop = shutdown.settle("modules stop", () => modulePhase("stop"));
+        const modulePhases = this.#modules.beginStop();
+        const moduleStop = shutdown.settle("modules stop", () => modulePhases.stop());
         // Drain order: (1) tell the supervisor to abort worker scopes so
         // strike paths don't keep going, (2) await its active drains
         // to completion, (3) drain streaming schemes' background work
@@ -1664,9 +1075,7 @@ export default class Daemon {
         // process may exit with the WAL in place (SQLite recovers) rather than
         // leak as a live-but-wedged tree.
         const drainResult = await shutdown.settle("drains idle", () => this.#drains.idle());
-        const clientResult = await shutdown.settle("client operations idle", async () => {
-            await Promise.all([...this.#clientLoops.values()].map(({ settled }) => settled));
-        });
+        const clientResult = await shutdown.settle("client operations idle", () => this.#clientOperations.idle());
         const residencyResult = await shutdown.settle("workspace Functionality transitions", () => this.#residency.settle());
         // A boundary publication queued behind the last turn settles before
         // modules close and before the DB goes away ({§functionality-publication}).
@@ -1682,7 +1091,7 @@ export default class Daemon {
         // conclusion notifications. Join the supervisor-owned async tails only
         // after those producers settle, before the caller may close SQLite.
         const wakeResult = await shutdown.settle("drains idle (wake)", () => this.#drains.idle());
-        const moduleCloseResult = await shutdown.settle("modules close", () => modulePhase("close"));
+        const moduleCloseResult = await shutdown.settle("modules close", () => modulePhases.close());
         // {§db-maintenance-optimize} — the last database step before the caller closes SQLite:
         // planner statistics refreshed on the writer, bounded by SQLite's own analysis limit.
         // {§retention-policy} — the operator's retention runs once more before the statistics.
@@ -1714,10 +1123,11 @@ export default class Daemon {
     // (SSE, WS) add themselves here as they land.
     async #drainStreamingSchemes() {
         const exec = this.#schemes.get("exec");
+        if (!(exec instanceof Exec))
+            return;
         // {§exec-lifetime} — a detached spawn ends with the daemon: nothing else ever aborts it.
-        exec?.abortDetached?.();
-        if (exec?.idle !== undefined)
-            await exec.idle();
+        exec.abortDetached();
+        await exec.idle();
     }
     /**
      * Emit a stream/event notification scoped to the workspace containing the
@@ -1757,7 +1167,7 @@ export default class Daemon {
     // scheme registry rather than exposing that registry across the boundary.
     #workerHasActiveStreams(workerId) {
         const exec = this.#schemes.get("exec");
-        return exec?.hasActiveSpawns?.(workerId) ?? false;
+        return exec instanceof Exec && exec.hasActiveSpawns(workerId);
     }
     // {§methods-event-subscribe} — subscriber failures are transport-local:
     // log them at this boundary and never re-enter engine control flow.
@@ -1771,6 +1181,14 @@ export default class Daemon {
             }
         }
     }
+    // {§notifications-worker-policy} A worker's generation policy, as worker.model.get reads it, to its workspace.
+    async #announceWorkerPolicy(workerId) {
+        const workspaceId = (await this.#db.drain_get_worker_workspace.get({ worker_id: workerId }))?.workspace_id;
+        if (workspaceId === undefined)
+            return;
+        const { model, spawnModel } = await this.#workerModels.readWorkerModel({ workspaceId, workerId });
+        this.#broadcast({ workspaceId }, "worker/policy", { workerId, model, spawnModel });
+    }
     #broadcast(target, method, params) {
         observedSync(// {§observability-boundary}
         "stream.broadcast", { method, ...(target === "all" ? {} : { "workspace.id": target.workspaceId }) }, () => {
@@ -1792,5 +1210,11 @@ export default class Daemon {
     async readLog(...args) {
         return this.#reads.readLog(...args);
     }
+    async readEntryChannel(...args) {
+        return this.#reads.readEntryChannel(...args);
+    }
+    async readStreams(...args) {
+        return this.#reads.readStreams(...args);
+    }
 }
 //# sourceMappingURL=Daemon.js.map