@projectpac/worker

The process that spawns models. It is a cordis app of its own, not a thread of the daemon's: a model is heavy, holds handles, and may not come back, and the daemon has to keep answering while one runs.

It keeps a folder of its own under the node's data directory, defaultWorker/ by default, holding its row file executors.yml and one folder per executor row for whatever that executor writes. It never opens the node's store. It asks the daemon's control api for work -- claim, renew, settle -- naming the executor rows it carries, and is handed the oldest pending turn for one of them. Every claim is also its sign of life.

Four rules it keeps:

• It pulls. Nothing tells it a turn is waiting; it asks, once a second when idle. The only latency a turn pays is that interval.
• The executor decides whether a payload is runnable. A payload the executor refuses fails the turn as invalid-payload before anything is spawned. The worker reads neither payload.
• It decides nothing about what a turn means. It hands the executor's text back exactly as produced, and the loop on the daemon's side tells the caller.
• A turn it claimed is always answered. A settle whose reply was lost is retried, and the api takes the repeat; a lease it can no longer renew is given up, and the model stopped, because the daemon has already failed the turn without it.

Shutdown is bounded: claiming stops, turns in flight are asked to stop and then made to, and whatever was still running when the process went is failed by its lapsed lease on the daemon's side.