diff --git a/.golangci.yaml b/.golangci.yaml
index b7a075d9fa..96c1f42822 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -27,10 +27,25 @@ linters:
   default: standard
 
   enable:
+    # Import restrictions, see depguard settings below.
+    - depguard
     # Spelling errors in comments, strings, and identifiers.
     - misspell
 
   settings:
+    depguard:
+      rules:
+        # internal/ateworker is the ateworker binaries' shared code. Anything
+        # else should import a flat package under internal/ instead.
+        ateworker:
+          files:
+            - "$all"
+            - "!**/cmd/ateworker-*/**"
+            - "!**/internal/ateworker/**"
+          deny:
+            - pkg: github.com/agent-substrate/substrate/internal/ateworker
+              desc: only the ateworker binaries may import internal/ateworker
+
     errcheck:
       # Functions where ignoring the return is idiomatic in this codebase.
       # Note: errcheck's exclude-functions matches on the static receiver
diff --git a/cmd/ateapi/internal/controlapi/workflow_resume.go b/cmd/ateapi/internal/controlapi/workflow_resume.go
index ba39301a34..111849aecb 100644
--- a/cmd/ateapi/internal/controlapi/workflow_resume.go
+++ b/cmd/ateapi/internal/controlapi/workflow_resume.go
@@ -619,7 +619,7 @@ func workerAssignmentFrom(w *ateapipb.Worker, snapRuntime *ateapipb.SandboxRunti
 		// with a runtime that did not produce it. Resolve the assets for the
 		// matched version once SandboxConfig can name them, or treat a
 		// restorable-only match as incompatible until it can. Latent for now:
-		// worker reports no restorable_runtimes (internal/ateom/register.go).
+		// worker reports no restorable_runtimes (internal/ateworker/register.go).
 		SandboxRuntime: proto.CloneOf(hardware.RuntimeFor(w.GetStatus(), snapRuntime)),
 	}
 }
diff --git a/cmd/atecontroller/internal/controllers/workerpool_apply.go b/cmd/atecontroller/internal/controllers/workerpool_apply.go
index f90e43fc5c..728e106a9a 100644
--- a/cmd/atecontroller/internal/controllers/workerpool_apply.go
+++ b/cmd/atecontroller/internal/controllers/workerpool_apply.go
@@ -26,11 +26,11 @@ import (
 	corev1ac "k8s.io/client-go/applyconfigurations/core/v1"
 	metav1ac "k8s.io/client-go/applyconfigurations/meta/v1"
 
-	"github.com/agent-substrate/substrate/internal/ateom"
 	"github.com/agent-substrate/substrate/internal/deviceplugin"
 	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/preview"
+	"github.com/agent-substrate/substrate/internal/workercapacity"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 )
 
@@ -185,7 +185,7 @@ func buildDeploymentApplyConfig(wp *atev1alpha1.WorkerPool, otel workerOTelSetti
 		WithVolumeMounts(
 			corev1ac.VolumeMount().
 				WithName(workerCapacityVolume).
-				WithMountPath(ateom.CapacityMountPath).
+				WithMountPath(workercapacity.MountPath).
 				WithReadOnly(true),
 			corev1ac.VolumeMount().
 				WithName("ate-base").
@@ -210,8 +210,8 @@ func buildDeploymentApplyConfig(wp *atev1alpha1.WorkerPool, otel workerOTelSetti
 				WithName(workerCapacityVolume).
 				WithDownwardAPI(corev1ac.DownwardAPIVolumeSource().
 					WithItems(
-						resourceFieldRefFile(ateom.CPULimitFile, "limits.cpu", milliCores),
-						resourceFieldRefFile(ateom.MemoryLimitFile, "limits.memory", wholeBytes),
+						resourceFieldRefFile(workercapacity.CPULimitFile, "limits.cpu", milliCores),
+						resourceFieldRefFile(workercapacity.MemoryLimitFile, "limits.memory", wholeBytes),
 					)),
 			corev1ac.Volume().
 				WithName("ate-base").
diff --git a/cmd/atecontroller/internal/controllers/workerpool_apply_test.go b/cmd/atecontroller/internal/controllers/workerpool_apply_test.go
index 5f8ffb7e2f..237811ba14 100644
--- a/cmd/atecontroller/internal/controllers/workerpool_apply_test.go
+++ b/cmd/atecontroller/internal/controllers/workerpool_apply_test.go
@@ -30,12 +30,12 @@ import (
 	metav1ac "k8s.io/client-go/applyconfigurations/meta/v1"
 	"k8s.io/utils/ptr"
 
-	"github.com/agent-substrate/substrate/internal/ateom"
 	"github.com/agent-substrate/substrate/internal/deviceplugin"
 	"github.com/agent-substrate/substrate/internal/egresspolicy"
 	"github.com/agent-substrate/substrate/internal/installdefaults"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/preview"
+	"github.com/agent-substrate/substrate/internal/workercapacity"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 )
 
@@ -783,8 +783,8 @@ func expectedDeploymentApplyConfig(mutatePodSpec func(*corev1ac.PodSpecApplyConf
 				WithName(workerCapacityVolume).
 				WithDownwardAPI(corev1ac.DownwardAPIVolumeSource().
 					WithItems(
-						resourceFieldRefFile(ateom.CPULimitFile, "limits.cpu", milliCores),
-						resourceFieldRefFile(ateom.MemoryLimitFile, "limits.memory", wholeBytes),
+						resourceFieldRefFile(workercapacity.CPULimitFile, "limits.cpu", milliCores),
+						resourceFieldRefFile(workercapacity.MemoryLimitFile, "limits.memory", wholeBytes),
 					)),
 			corev1ac.Volume().
 				WithName("ate-base").
@@ -883,7 +883,7 @@ func expectedDeploymentApplyConfig(mutatePodSpec func(*corev1ac.PodSpecApplyConf
 			WithVolumeMounts(
 				corev1ac.VolumeMount().
 					WithName(workerCapacityVolume).
-					WithMountPath(ateom.CapacityMountPath).
+					WithMountPath(workercapacity.MountPath).
 					WithReadOnly(true),
 				corev1ac.VolumeMount().
 					WithName("ate-base").
diff --git a/cmd/atelet/statspoller.go b/cmd/atelet/statspoller.go
index cfb000470d..37de64876a 100644
--- a/cmd/atelet/statspoller.go
+++ b/cmd/atelet/statspoller.go
@@ -37,9 +37,9 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	"github.com/agent-substrate/substrate/internal/ateattr"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // workerPoolLabel is the label the pool controller stamps on every worker pod
@@ -326,7 +326,7 @@ func (p *statsPoller) collect(ctx context.Context) map[templateKey]*templateAggr
 					templateNamespace: sample.GetActorTemplateAtespace(),
 					templateName:      sample.GetActorTemplateName(),
 					sandboxClass:      ateattr.NormalizeSandboxClass(sample.GetSandboxClass()),
-					source:            ateomstats.StatsSourceLabel(sample.GetSource()),
+					source:            workerstats.StatsSourceLabel(sample.GetSource()),
 					workerPool:        pools[podUID],
 				}
 				mu.Lock()
diff --git a/cmd/atelet/ateomdialer_test.go b/cmd/atelet/workerdialer_test.go
similarity index 100%
rename from cmd/atelet/ateomdialer_test.go
rename to cmd/atelet/workerdialer_test.go
diff --git a/cmd/atelet/ateomsupport.go b/cmd/atelet/workersupport.go
similarity index 100%
rename from cmd/atelet/ateomsupport.go
rename to cmd/atelet/workersupport.go
diff --git a/cmd/atelet/ateomsupport_test.go b/cmd/atelet/workersupport_test.go
similarity index 100%
rename from cmd/atelet/ateomsupport_test.go
rename to cmd/atelet/workersupport_test.go
diff --git a/cmd/ateworker-gvisor/hosted.go b/cmd/ateworker-gvisor/hosted.go
index e6658c3884..e236f5a1c9 100644
--- a/cmd/ateworker-gvisor/hosted.go
+++ b/cmd/ateworker-gvisor/hosted.go
@@ -25,34 +25,34 @@ import (
 	"time"
 
 	"github.com/agent-substrate/substrate/internal/apierror"
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
 	"github.com/agent-substrate/substrate/internal/atunnel"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
 	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // hostedActor holds one actor's attribution, network, and runtime state.
 type hostedActor struct {
 	// Attribution is available during boot.
 	attribution resources.ActorAttribution
-	network     *ateomnet.SandboxSession
+	network     *actornet.SandboxSession
 	// resolvConf is the actor's resolver bind source, removed with its network.
 	resolvConf string
 	// Set once the containers exist.
 	session *workloadSession
 	// usage is this activation's epoch, CPU baseline, and latest sample.
-	usage *ateomstats.Activation
+	usage *workerstats.Activation
 	// deadReported keeps the usage sweep to one warning per activation.
 	deadReported atomic.Bool
 }
 
 // admitActor reserves capacity before network setup. An actor that is already
 // hosted keeps its slot; its old network is returned for the caller to close.
-func (s *AteWorkerService) admitActor(attribution resources.ActorAttribution) (*hostedActor, *ateomnet.SandboxSession, error) {
+func (s *AteWorkerService) admitActor(attribution resources.ActorAttribution) (*hostedActor, *actornet.SandboxSession, error) {
 	s.actorsMu.Lock()
 	defer s.actorsMu.Unlock()
-	var stale *ateomnet.SandboxSession
+	var stale *actornet.SandboxSession
 	if old, ok := s.actors[attribution.UID]; ok {
 		stale = old.network
 	} else if len(s.actors)+s.draining >= s.maxActors {
@@ -60,7 +60,7 @@ func (s *AteWorkerService) admitActor(attribution resources.ActorAttribution) (*
 	}
 	// The sandbox cgroup is new with every activation, so its counters start
 	// at zero.
-	hosted := &hostedActor{attribution: attribution, usage: ateomstats.NewActivation(time.Now(), false)}
+	hosted := &hostedActor{attribution: attribution, usage: workerstats.NewActivation(time.Now(), false)}
 	s.actors[attribution.UID] = hosted
 	return hosted, stale, nil
 }
@@ -85,7 +85,7 @@ func (s *AteWorkerService) hostActor(ctx context.Context, attribution resources.
 		}
 	}
 
-	session, err := ateomnet.ServeSandbox(ctx, ateomnet.SandboxNetworkConfig{
+	session, err := actornet.ServeSandbox(ctx, actornet.SandboxNetworkConfig{
 		ActorUID:   uid,
 		Veth:       true,
 		EgressPort: s.tunnel.EgressPort,
@@ -189,7 +189,7 @@ func (s *AteWorkerService) setSession(actorUID string, session *workloadSession)
 func (s *AteWorkerService) sandboxDialer(actorUID string) atunnel.DialFunc {
 	return func(ctx context.Context, network, address string) (net.Conn, error) {
 		s.actorsMu.RLock()
-		var session *ateomnet.SandboxSession
+		var session *actornet.SandboxSession
 		if hosted := s.actors[actorUID]; hosted != nil {
 			session = hosted.network
 		}
diff --git a/cmd/ateworker-gvisor/internal/ateom/stopwatch.go b/cmd/ateworker-gvisor/internal/ateom/stopwatch.go
deleted file mode 100644
index ed0aeff8bc..0000000000
--- a/cmd/ateworker-gvisor/internal/ateom/stopwatch.go
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright 2026 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ateom
-
-import (
-	"log/slog"
-	"time"
-)
-
-type Lap struct {
-	Name          string
-	Time          time.Time
-	StepDuration  time.Duration
-	TotalDuration time.Duration
-}
-
-type Stopwatch struct {
-	Laps []Lap
-}
-
-var _ slog.LogValuer = (*Stopwatch)(nil)
-
-func (s *Stopwatch) Click(name string) {
-	now := time.Now()
-	lap := Lap{
-		Name: name,
-		Time: now,
-	}
-	if len(s.Laps) > 0 {
-		lap.StepDuration = now.Sub(s.Laps[len(s.Laps)-1].Time)
-		lap.TotalDuration = now.Sub(s.Laps[0].Time)
-	}
-	s.Laps = append(s.Laps, lap)
-}
-
-type FormattedLap struct {
-	Name  string
-	Step  string
-	Total string
-}
-
-func (s *Stopwatch) LogValue() slog.Value {
-	formatted := []FormattedLap{}
-	for _, l := range s.Laps {
-		formatted = append(formatted, FormattedLap{
-			Name:  l.Name,
-			Step:  l.StepDuration.String(),
-			Total: l.TotalDuration.String(),
-		})
-	}
-	return slog.AnyValue(formatted)
-}
diff --git a/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats.go b/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats.go
index 1718a0b3f2..ea3a7aa689 100644
--- a/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats.go
+++ b/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats.go
@@ -61,7 +61,7 @@ type Sample struct {
 
 	// CPUUsageUsec is cpu.stat's usage_usec: cumulative CPU time consumed by the
 	// cgroup since it was created. Zero if the cpu controller was not delegated
-	// to this cgroup (see ateomcgroup.Delegate, which enables controllers
+	// to this cgroup (see cgroup.Delegate, which enables controllers
 	// best-effort and carries on when one cannot be enabled).
 	CPUUsageUsec uint64
 
diff --git a/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats_test.go b/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats_test.go
index 8b5198a295..c7728b0b11 100644
--- a/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats_test.go
+++ b/cmd/ateworker-gvisor/internal/cgroupstats/cgroupstats_test.go
@@ -103,7 +103,7 @@ func TestRead(t *testing.T) {
 			},
 		},
 		{
-			// ateomcgroup.Delegate enables controllers one at a time and carries on
+			// cgroup.Delegate enables controllers one at a time and carries on
 			// when one cannot be enabled, so a cgroup with memory but no cpu is a
 			// state this actually reaches.
 			name: "no cpu.stat (cpu controller not delegated)",
diff --git a/cmd/ateworker-gvisor/main.go b/cmd/ateworker-gvisor/main.go
index 5c5486adf2..be216acb61 100644
--- a/cmd/ateworker-gvisor/main.go
+++ b/cmd/ateworker-gvisor/main.go
@@ -38,13 +38,12 @@ import (
 	"github.com/agent-substrate/substrate/internal/actorlog"
 	"github.com/agent-substrate/substrate/internal/apierror"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
-	"github.com/agent-substrate/substrate/internal/ateom"
-	"github.com/agent-substrate/substrate/internal/ateomcgroup"
-	"github.com/agent-substrate/substrate/internal/ateominit"
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomphaselog"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
-	"github.com/agent-substrate/substrate/internal/ateomtunnel"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
+	"github.com/agent-substrate/substrate/internal/ateworker/cgroup"
+	"github.com/agent-substrate/substrate/internal/ateworker/phaselog"
+	"github.com/agent-substrate/substrate/internal/ateworker/pid1"
+	"github.com/agent-substrate/substrate/internal/ateworker/register"
+	"github.com/agent-substrate/substrate/internal/ateworker/tunnel"
 	"github.com/agent-substrate/substrate/internal/imagecache"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/ocispec"
@@ -56,6 +55,7 @@ import (
 	"github.com/agent-substrate/substrate/internal/sizing"
 	"github.com/agent-substrate/substrate/internal/version"
 	"github.com/agent-substrate/substrate/internal/wakeupprobe"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 	"github.com/spf13/pflag"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
@@ -75,7 +75,7 @@ func flagsConfigPath() string {
 var (
 	podUID = pflag.String("pod-uid", "", "The UID of the current pod")
 
-	tunnelConfig = ateomtunnel.RegisterFlags(pflag.CommandLine)
+	tunnelConfig = tunnel.RegisterFlags(pflag.CommandLine)
 
 	readinessListenAddress = pflag.String("readiness-listen-address", "0.0.0.0:8080", "Address for the HTTP /readyz and /healthz probes")
 	maxActors              = pflag.Int("max-actors", 1000, "How many actors this worker will host at once")
@@ -100,7 +100,7 @@ const minUsageSampleInterval = 50 * time.Second
 const workloadGracePeriod = 30 * time.Minute
 
 func main() {
-	ateominit.RunIfPID1()
+	pid1.RunIfPID1()
 	pflag.Parse()
 	if *showVersion {
 		fmt.Println(version.String())
@@ -202,7 +202,7 @@ func do(ctx context.Context) error {
 
 	// Prepare the pod cgroup so runsc can create per-actor-container leaves under
 	// it with real accounting.
-	if _, err := ateomcgroup.Delegate(ctx); err != nil {
+	if _, err := cgroup.Delegate(ctx); err != nil {
 		return fmt.Errorf("while setting up cgroup delegation: %w", err)
 	}
 
@@ -228,20 +228,20 @@ func do(ctx context.Context) error {
 	}
 
 	actorLogger := actorlog.NewActorLogger(syncedWriter, metadata.OnGCE())
-	tunnel, err := ateomtunnel.Start(ctx, *tunnelConfig, ateomnet.ActorHTTPUpstream)
+	tunnel, err := tunnel.Start(ctx, *tunnelConfig, actornet.ActorHTTPUpstream)
 	if err != nil {
 		return err
 	}
 	ateworkerService := NewService(tunnel, actorLogger, *maxActors, flags)
 	// The controller sets both from the downward API.
-	pool := ateomstats.Pool{Namespace: os.Getenv("POD_NAMESPACE"), Name: os.Getenv("WORKER_POOL_NAME")}
+	pool := workerstats.Pool{Namespace: os.Getenv("POD_NAMESPACE"), Name: os.Getenv("WORKER_POOL_NAME")}
 	if pool.Namespace == "" || pool.Name == "" {
 		slog.WarnContext(ctx, "Worker pool unknown; usage records will name no pool", slog.Any("pool", pool))
 	}
-	usageStdout := ateomstats.NewStdoutHandler(syncedWriter)
+	usageStdout := workerstats.NewStdoutHandler(syncedWriter)
 	defer usageStdout.Close()
-	ateworkerService.usage = ateomstats.NewUsageEmitter(lp, usageStdout, pool)
-	defer ateomstats.StartSampler(ctx, *usageSampleInterval, func(ctx context.Context) { ateworkerService.sweepUsage(ctx) })()
+	ateworkerService.usage = workerstats.NewUsageEmitter(lp, usageStdout, pool)
+	defer workerstats.StartSampler(ctx, *usageSampleInterval, func(ctx context.Context) { ateworkerService.sweepUsage(ctx) })()
 
 	svr := grpc.NewServer(
 		grpc.StatsHandler(otelgrpc.NewServerHandler()),
@@ -273,7 +273,7 @@ func do(ctx context.Context) error {
 	// outlast, including the window before the Worker record exists; anything
 	// that reaches here is a misconfiguration no restart-in-place will fix.
 	go func() {
-		err := ateom.Report(ctx, ateom.ReportConfig{
+		err := register.Report(ctx, register.ReportConfig{
 			SocketPath:           nodepath.WorkerSupportSocket,
 			CredentialBundlePath: tunnelConfig.CredentialBundle,
 			TrustBundlePath:      tunnelConfig.TrustBundle,
@@ -327,16 +327,16 @@ type AteWorkerService struct {
 	maxActors int
 
 	actorLogger *actorlog.ActorLogger
-	tunnel      *ateomtunnel.Tunnel
+	tunnel      *tunnel.Tunnel
 	// usage writes the usage records. Nil writes none.
-	usage *ateomstats.UsageEmitter
+	usage *workerstats.UsageEmitter
 
 	// shuttingDown is set once SIGTERM has been received. While true, new
 	// workload RPCs are rejected with codes.Unavailable.
 	shuttingDown atomic.Bool
 
 	// cgroupRoot is where the sandbox's cgroup v2 leaves live: the worker pod's
-	// own cgroup scope, which ateomcgroup.Delegate prepares. A field rather
+	// own cgroup scope, which cgroup.Delegate prepares. A field rather
 	// than a constant so tests can point GetWorkloadStats at a fixture tree.
 	cgroupRoot string
 
@@ -353,7 +353,7 @@ type AteWorkerService struct {
 var _ ateworkerpb.WorkerServer = (*AteWorkerService)(nil)
 
 // NewService creates a new AteWorkerService.
-func NewService(tunnel *ateomtunnel.Tunnel, actorLogger *actorlog.ActorLogger, maxActors int, flags *flagStore) *AteWorkerService {
+func NewService(tunnel *tunnel.Tunnel, actorLogger *actorlog.ActorLogger, maxActors int, flags *flagStore) *AteWorkerService {
 	return &AteWorkerService{
 		locks:       actorlock.New(),
 		inFlight:    actorlock.NewInFlight(),
@@ -602,11 +602,11 @@ func (s *AteWorkerService) RunWorkload(ctx context.Context, req *ateworkerpb.Run
 		return nil, err
 	}
 
-	if err := s.tunnel.Deactivate(ctx, ateomstats.ActorAttributionFromRequest(req)); err != nil {
+	if err := s.tunnel.Deactivate(ctx, workerstats.ActorAttributionFromRequest(req)); err != nil {
 		return nil, err
 	}
 
-	attribution := ateomstats.ActorAttributionFromRequest(req)
+	attribution := workerstats.ActorAttributionFromRequest(req)
 	s.actorLogger.EmitLifecycleLog(ctx, "Actor starting", attribution)
 
 	// Contract with atelet:
@@ -614,7 +614,7 @@ func (s *AteWorkerService) RunWorkload(ctx context.Context, req *ateworkerpb.Run
 	//   * Correct runsc version is downloaded and placed on disk.
 	//   * All OCI bundles are set up, including for the pause container.
 
-	egress, err := s.tunnel.PrepareEgress(ctx, ateomstats.ActorAttributionFromRequest(req), req.GetEgressGateway())
+	egress, err := s.tunnel.PrepareEgress(ctx, workerstats.ActorAttributionFromRequest(req), req.GetEgressGateway())
 	if err != nil {
 		return nil, err
 	}
@@ -637,7 +637,7 @@ func (s *AteWorkerService) RunWorkload(ctx context.Context, req *ateworkerpb.Run
 		if retErr != nil {
 			cleanupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
 			defer cancel()
-			if err := s.tunnel.Deactivate(cleanupCtx, ateomstats.ActorAttributionFromRequest(req)); err != nil {
+			if err := s.tunnel.Deactivate(cleanupCtx, workerstats.ActorAttributionFromRequest(req)); err != nil {
 				slog.WarnContext(cleanupCtx, "Failed to deactivate actor networking after Run failure", slog.Any("err", err))
 			}
 			deleteContainers(cleanupCtx, rcmd, containersToDelete, "Run")
@@ -697,10 +697,10 @@ func (s *AteWorkerService) RunWorkload(ctx context.Context, req *ateworkerpb.Run
 	}
 
 	// Block until every wakeup-probe-enabled container reports 200.
-	if err := wakeupprobe.WaitAll(ctx, req.GetSpec().GetContainers(), ateomnet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(req.GetActorUid()))); err != nil {
+	if err := wakeupprobe.WaitAll(ctx, req.GetSpec().GetContainers(), actornet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(req.GetActorUid()))); err != nil {
 		return nil, fmt.Errorf("while waiting for container wakeup probe: %w", err)
 	}
-	if err := s.tunnel.Activate(ateomstats.ActorAttributionFromRequest(req), s.sandboxDialer(req.GetActorUid()), egress); err != nil {
+	if err := s.tunnel.Activate(workerstats.ActorAttributionFromRequest(req), s.sandboxDialer(req.GetActorUid()), egress); err != nil {
 		return nil, err
 	}
 
@@ -737,14 +737,14 @@ func (s *AteWorkerService) CheckpointWorkload(ctx context.Context, req *ateworke
 
 	// Per-phase timing, recorded on the way out so a failed checkpoint still
 	// reports the phases it completed, and the failing step its elapsed time.
-	attribution := ateomstats.ActorAttributionFromRequest(req)
+	attribution := workerstats.ActorAttributionFromRequest(req)
 	fidelity := req.GetFidelity()
 	var timing checkpointTiming
 	tLast := tStart
 	defer func() {
 		timing.total = time.Since(tStart)
-		ateomphaselog.LogSnapshotPhases(ctx, "Checkpoint timing breakdown", attribution, fidelity,
-			ateomphaselog.CheckpointDurationKey, err, timing.phases())
+		phaselog.LogSnapshotPhases(ctx, "Checkpoint timing breakdown", attribution, fidelity,
+			phaselog.CheckpointDurationKey, err, timing.phases())
 	}()
 
 	if err := s.tunnel.Deactivate(ctx, attribution); err != nil {
@@ -948,14 +948,14 @@ func (s *AteWorkerService) RestoreWorkload(ctx context.Context, req *ateworkerpb
 	// reports the phases it completed, and the failing step its elapsed time.
 	// Registered ahead of the failure cleanup below, so on failure the total
 	// includes that cleanup; the record is marked by error.type either way.
-	attribution := ateomstats.ActorAttributionFromRequest(req)
+	attribution := workerstats.ActorAttributionFromRequest(req)
 	fidelity := req.GetFidelity()
 	containers := req.GetSpec().GetContainers()
 	var timing restoreTiming
 	tLast := tStart
 	defer func() {
 		timing.total = time.Since(tStart)
-		attrs := ateomphaselog.SnapshotPhaseAttrs(attribution, fidelity, ateomphaselog.RestoreDurationKey, retErr, timing.phases())
+		attrs := phaselog.SnapshotPhaseAttrs(attribution, fidelity, phaselog.RestoreDurationKey, retErr, timing.phases())
 		attrs = append(attrs, slog.Int(containerCountKey, len(containers)))
 		slog.LogAttrs(ctx, slog.LevelInfo, "Restore timing breakdown", attrs...)
 	}()
@@ -1109,7 +1109,7 @@ func (s *AteWorkerService) RestoreWorkload(ctx context.Context, req *ateworkerpb
 	}
 
 	// Block until every wakeup-probe-enabled container reports 200.
-	err = wakeupprobe.WaitAll(ctx, containers, ateomnet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(req.GetActorUid())))
+	err = wakeupprobe.WaitAll(ctx, containers, actornet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(req.GetActorUid())))
 	timing.wakeupProbe = lap(&tLast)
 	if err != nil {
 		return nil, fmt.Errorf("while waiting for container wakeup probe: %w", err)
@@ -1139,7 +1139,7 @@ func (s *AteWorkerService) TerminateWorkload(ctx context.Context, req *ateworker
 	}
 	defer s.locks.Unlock(req.GetActorUid())
 
-	attribution := ateomstats.ActorAttributionFromRequest(req)
+	attribution := workerstats.ActorAttributionFromRequest(req)
 
 	hosted := s.lookupActor(attribution.UID)
 	if hosted != nil {
diff --git a/cmd/ateworker-gvisor/phaselog.go b/cmd/ateworker-gvisor/phaselog.go
index 6c73cca5c0..c7190d23dd 100644
--- a/cmd/ateworker-gvisor/phaselog.go
+++ b/cmd/ateworker-gvisor/phaselog.go
@@ -20,10 +20,10 @@ import (
 	"time"
 
 	"github.com/agent-substrate/substrate/internal/ateattr"
-	"github.com/agent-substrate/substrate/internal/ateomphaselog"
+	"github.com/agent-substrate/substrate/internal/ateworker/phaselog"
 )
 
-// The phase names, suffixed onto the ateomphaselog duration keys. Kept out of
+// The phase names, suffixed onto the phaselog duration keys. Kept out of
 // ateattr on purpose: that package's SnapshotPhase* values are the
 // ate.snapshot.phase metric enum, and these are not values of it. "total" is
 // shared so the two layers' records agree on the denominator.
@@ -66,8 +66,8 @@ type restoreTiming struct {
 	wakeupProbe, activate, total           time.Duration
 }
 
-func (t restoreTiming) phases() []ateomphaselog.Phase {
-	return []ateomphaselog.Phase{
+func (t restoreTiming) phases() []phaselog.Phase {
+	return []phaselog.Phase{
 		{Name: phasePrep, D: t.prep},
 		{Name: phaseEgressPrepare, D: t.egressPrepare},
 		{Name: phaseNetSetup, D: t.netSetup},
@@ -89,8 +89,8 @@ type checkpointTiming struct {
 	prep, checkpoint, durableDir, teardown, total time.Duration
 }
 
-func (t checkpointTiming) phases() []ateomphaselog.Phase {
-	return []ateomphaselog.Phase{
+func (t checkpointTiming) phases() []phaselog.Phase {
+	return []phaselog.Phase{
 		{Name: phasePrep, D: t.prep},
 		{Name: phaseCheckpoint, D: t.checkpoint},
 		{Name: phaseDurableDir, D: t.durableDir},
diff --git a/cmd/ateworker-gvisor/phaselog_test.go b/cmd/ateworker-gvisor/phaselog_test.go
index 3f8149a176..55d750159c 100644
--- a/cmd/ateworker-gvisor/phaselog_test.go
+++ b/cmd/ateworker-gvisor/phaselog_test.go
@@ -24,7 +24,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/agent-substrate/substrate/internal/ateomphaselog"
+	"github.com/agent-substrate/substrate/internal/ateworker/phaselog"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
 	"github.com/agent-substrate/substrate/internal/resources"
 )
@@ -61,8 +61,8 @@ func TestRestoreTimingPhases(t *testing.T) {
 		activate:      2 * time.Millisecond,
 		total:         2 * time.Second,
 	}
-	attrs := ateomphaselog.SnapshotPhaseAttrs(resources.ActorAttribution{UID: "uid-abc"},
-		ateworkerpb.SnapshotFidelity_SNAPSHOT_FIDELITY_MEMORY, ateomphaselog.RestoreDurationKey, nil, timing.phases())
+	attrs := phaselog.SnapshotPhaseAttrs(resources.ActorAttribution{UID: "uid-abc"},
+		ateworkerpb.SnapshotFidelity_SNAPSHOT_FIDELITY_MEMORY, phaselog.RestoreDurationKey, nil, timing.phases())
 	attrs = append(attrs, slog.Int(containerCountKey, 2))
 
 	seen := make(map[string]bool, len(attrs))
@@ -115,8 +115,8 @@ func TestCheckpointTimingPhases(t *testing.T) {
 		teardown:   150 * time.Millisecond,
 		total:      500 * time.Millisecond,
 	}
-	rec := renderPhaseRecord(t, ateomphaselog.SnapshotPhaseAttrs(resources.ActorAttribution{UID: "uid-abc"},
-		ateworkerpb.SnapshotFidelity_SNAPSHOT_FIDELITY_VOLUMES, ateomphaselog.CheckpointDurationKey, nil, timing.phases()))
+	rec := renderPhaseRecord(t, phaselog.SnapshotPhaseAttrs(resources.ActorAttribution{UID: "uid-abc"},
+		ateworkerpb.SnapshotFidelity_SNAPSHOT_FIDELITY_VOLUMES, phaselog.CheckpointDurationKey, nil, timing.phases()))
 
 	for k, want := range map[string]float64{
 		"ateworker.actor.checkpoint.duration.prep":        0.02,
diff --git a/cmd/ateworker-gvisor/sandboxnet.go b/cmd/ateworker-gvisor/sandboxnet.go
index 1386001c48..5da536dddc 100644
--- a/cmd/ateworker-gvisor/sandboxnet.go
+++ b/cmd/ateworker-gvisor/sandboxnet.go
@@ -25,8 +25,8 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
 )
 
@@ -40,7 +40,7 @@ func actorResolvConf(actorDirs *ateworkerpb.ActorDirs) (string, error) {
 	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
 		return "", fmt.Errorf("creating the actor directory: %w", err)
 	}
-	if err := os.WriteFile(path, dns.SandboxResolvConf(ateomnet.ActorVethGateway, pod), 0o644); err != nil {
+	if err := os.WriteFile(path, dns.SandboxResolvConf(actornet.ActorVethGateway, pod), 0o644); err != nil {
 		return "", fmt.Errorf("writing the actor resolv.conf: %w", err)
 	}
 	return path, nil
diff --git a/cmd/ateworker-gvisor/stats.go b/cmd/ateworker-gvisor/stats.go
index ab6f25bf4b..54ad824491 100644
--- a/cmd/ateworker-gvisor/stats.go
+++ b/cmd/ateworker-gvisor/stats.go
@@ -36,7 +36,7 @@ import (
 // defaultCgroupRoot is the worker pod's own cgroup scope. The worker runs in a
 // private cgroup namespace, so this path is the pod's cgroup rather than the
 // host root, and runsc's per-container leaves are its direct children (see
-// ateomcgroup.Delegate).
+// cgroup.Delegate).
 const defaultCgroupRoot = "/sys/fs/cgroup"
 
 // sandboxCgroupContainer is the container whose cgroup leaf accounts for the
@@ -52,7 +52,7 @@ const defaultCgroupRoot = "/sys/fs/cgroup"
 // cgroup, because runsc resolves cgroupsPath against the parent of the cgroup
 // it is running in: cgroup v2 forbids a cgroup from holding processes and
 // delegating controllers to children at once, so runsc walks up one level to
-// find a directory it is allowed to create in. ateomcgroup.Delegate moves
+// find a directory it is allowed to create in. cgroup.Delegate moves
 // ateworker into /sys/fs/cgroup/ateworker precisely so that one level up is the
 // delegated scope.
 //
diff --git a/cmd/ateworker-gvisor/stats_test.go b/cmd/ateworker-gvisor/stats_test.go
index 6b0a741dc8..e03ca0c564 100644
--- a/cmd/ateworker-gvisor/stats_test.go
+++ b/cmd/ateworker-gvisor/stats_test.go
@@ -34,10 +34,10 @@ import (
 
 	"github.com/agent-substrate/substrate/cmd/ateworker-gvisor/internal/cgroupstats"
 	"github.com/agent-substrate/substrate/internal/apierror"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
 	"github.com/agent-substrate/substrate/internal/ocispec"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
 	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // The lifecycle RPCs that host and unhost actors need netlink, runsc, and
@@ -490,8 +490,8 @@ func TestGetActiveWorkloadStatsOneUnreadable(t *testing.T) {
 // so the sweep samples it. It starts at the unix epoch, so a sample's epoch is
 // zero and the expected samples here need not name it; the epoch has tests of
 // its own.
-func testActivation() *ateomstats.Activation {
-	a := ateomstats.NewActivation(time.Unix(0, 0), false)
+func testActivation() *workerstats.Activation {
+	a := workerstats.NewActivation(time.Unix(0, 0), false)
 	a.Initial(nil, nil)
 	return a
 }
diff --git a/cmd/ateworker-gvisor/usage_test.go b/cmd/ateworker-gvisor/usage_test.go
index 3a2e072cab..e7f8d997f8 100644
--- a/cmd/ateworker-gvisor/usage_test.go
+++ b/cmd/ateworker-gvisor/usage_test.go
@@ -26,21 +26,21 @@ import (
 
 	"github.com/agent-substrate/substrate/internal/actorlock"
 	"github.com/agent-substrate/substrate/internal/ateattr"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
-	"github.com/agent-substrate/substrate/internal/ateomstats/ateomstatstest"
 	"github.com/agent-substrate/substrate/internal/ocispec"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
+	"github.com/agent-substrate/substrate/internal/workerstats"
+	"github.com/agent-substrate/substrate/internal/workerstats/workerstatstest"
 )
 
-func withUsageRecorder(s *AteWorkerService) *ateomstatstest.Recorder {
-	e, rec := ateomstatstest.NewEmitter()
+func withUsageRecorder(s *AteWorkerService) *workerstatstest.Recorder {
+	e, rec := workerstatstest.NewEmitter()
 	s.usage = e
 	return rec
 }
 
 // hostWithEpoch hosts testActor; running means its initial reading is done.
 func hostWithEpoch(s *AteWorkerService, epoch time.Time, running bool) *hostedActor {
-	h := &hostedActor{attribution: testActor, usage: ateomstats.NewActivation(epoch, false)}
+	h := &hostedActor{attribution: testActor, usage: workerstats.NewActivation(epoch, false)}
 	if running {
 		h.usage.Initial(nil, nil)
 	}
diff --git a/cmd/ateworker-microvm/checkpoint.go b/cmd/ateworker-microvm/checkpoint.go
index 0f893b94ba..394a9dee5f 100644
--- a/cmd/ateworker-microvm/checkpoint.go
+++ b/cmd/ateworker-microvm/checkpoint.go
@@ -30,10 +30,10 @@ import (
 
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/ch"
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/kata"
-	"github.com/agent-substrate/substrate/internal/ateomphaselog"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
+	"github.com/agent-substrate/substrate/internal/ateworker/phaselog"
 	"github.com/agent-substrate/substrate/internal/imagecache"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -88,11 +88,11 @@ func (s *AteWorkerService) CheckpointWorkload(ctx context.Context, req *ateworke
 	// independent observations rather than a partition of the total.
 	tStart := time.Now()
 	var dPrep, dPause, dSnapshot, dDurable, dUpper, dTeardown time.Duration
-	attribution := ateomstats.ActorAttributionFromRequest(req)
+	attribution := workerstats.ActorAttributionFromRequest(req)
 	scope := req.GetFidelity()
 	defer func() {
-		ateomphaselog.LogSnapshotPhases(ctx, "Checkpoint timing breakdown", attribution, scope,
-			ateomphaselog.CheckpointDurationKey, err, []ateomphaselog.Phase{
+		phaselog.LogSnapshotPhases(ctx, "Checkpoint timing breakdown", attribution, scope,
+			phaselog.CheckpointDurationKey, err, []phaselog.Phase{
 				{Name: phasePrep, D: dPrep},
 				{Name: phasePause, D: dPause},
 				{Name: phaseSnapshot, D: dSnapshot},
@@ -415,7 +415,7 @@ func (s *AteWorkerService) TerminateWorkload(ctx context.Context, req *ateworker
 	}
 	defer s.locks.Unlock(req.GetActorUid())
 
-	attribution := ateomstats.ActorAttributionFromRequest(req)
+	attribution := workerstats.ActorAttributionFromRequest(req)
 
 	hosted := s.lookupActor(attribution.UID)
 	if hosted != nil {
diff --git a/cmd/ateworker-microvm/hosted.go b/cmd/ateworker-microvm/hosted.go
index 33aaa48284..0c33ae705b 100644
--- a/cmd/ateworker-microvm/hosted.go
+++ b/cmd/ateworker-microvm/hosted.go
@@ -25,13 +25,13 @@ import (
 
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/kata"
 	"github.com/agent-substrate/substrate/internal/apierror"
-	"github.com/agent-substrate/substrate/internal/ateomcgroup"
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
+	"github.com/agent-substrate/substrate/internal/ateworker/cgroup"
 	"github.com/agent-substrate/substrate/internal/atunnel"
+	"github.com/agent-substrate/substrate/internal/netns"
 	"github.com/agent-substrate/substrate/internal/resources"
 	"github.com/agent-substrate/substrate/internal/sizing"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // hostedActor holds one actor's attribution, network, and runtime state.
@@ -40,7 +40,7 @@ type hostedActor struct {
 	attribution resources.ActorAttribution
 
 	// Mutable fields are guarded by actorsMu.
-	network *ateomnet.SandboxSession
+	network *actornet.SandboxSession
 	// Nil until boot publishes the VM.
 	vm *runningActor
 	// Nil when no guest stats connection is available.
@@ -48,23 +48,23 @@ type hostedActor struct {
 
 	// usage is this activation's epoch, CPU baseline, and latest sample.
 	// Immutable after admission.
-	usage *ateomstats.Activation
+	usage *workerstats.Activation
 }
 
 // admitActor reserves capacity before network setup. An actor that is already
 // hosted keeps its slot; its old network is returned for the caller to close.
 // resumesGuest is true when the activation resumes a guest from a snapshot,
 // whose CPU counters come back with it.
-func (s *AteWorkerService) admitActor(attribution resources.ActorAttribution, resumesGuest bool) (*hostedActor, *ateomnet.SandboxSession, error) {
+func (s *AteWorkerService) admitActor(attribution resources.ActorAttribution, resumesGuest bool) (*hostedActor, *actornet.SandboxSession, error) {
 	s.actorsMu.Lock()
 	defer s.actorsMu.Unlock()
-	var stale *ateomnet.SandboxSession
+	var stale *actornet.SandboxSession
 	if old, ok := s.actors[attribution.UID]; ok {
 		stale = old.network
 	} else if len(s.actors)+s.draining >= s.maxActors {
 		return nil, nil, apierror.ResourceExhausted("worker is full: %d actors", s.maxActors)
 	}
-	hosted := &hostedActor{attribution: attribution, usage: ateomstats.NewActivation(time.Now(), resumesGuest)}
+	hosted := &hostedActor{attribution: attribution, usage: workerstats.NewActivation(time.Now(), resumesGuest)}
 	s.actors[attribution.UID] = hosted
 	return hosted, stale, nil
 }
@@ -91,7 +91,7 @@ func (s *AteWorkerService) hostActor(ctx context.Context, attribution resources.
 	}
 
 	// The tap and atunnel share a namespace; the guest owns the other end.
-	session, err := ateomnet.ServeSandbox(ctx, ateomnet.SandboxNetworkConfig{
+	session, err := actornet.ServeSandbox(ctx, actornet.SandboxNetworkConfig{
 		ActorUID:   uid,
 		EgressPort: s.tunnel.EgressPort,
 		DNSPolicy:  s.tunnel.ActorEgressPolicy(attribution),
@@ -110,11 +110,11 @@ func (s *AteWorkerService) hostActor(ctx context.Context, attribution resources.
 }
 
 // actorLeaf opens the actor's cgroup, or returns nil when the worker has none.
-func (s *AteWorkerService) actorLeaf(actorUID string, size sizing.SandboxSize) (*ateomcgroup.ActorLeaf, error) {
+func (s *AteWorkerService) actorLeaf(actorUID string, size sizing.SandboxSize) (*cgroup.ActorLeaf, error) {
 	if !s.actorCgroups {
 		return nil, nil
 	}
-	return ateomcgroup.OpenActorLeaf(actorUID, size.MilliCPU)
+	return cgroup.OpenActorLeaf(actorUID, size.MilliCPU)
 }
 
 // cleanupSandboxState kills what is left of the actor's host processes and
@@ -122,7 +122,7 @@ func (s *AteWorkerService) actorLeaf(actorUID string, size sizing.SandboxSize) (
 func (s *AteWorkerService) cleanupSandboxState(ctx context.Context, actorUID string) {
 	if s.actorCgroups {
 		killCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-		if err := ateomcgroup.KillActorLeaf(killCtx, actorUID); err != nil {
+		if err := cgroup.KillActorLeaf(killCtx, actorUID); err != nil {
 			slog.WarnContext(ctx, "Failed to kill the actor's leftover processes", slog.Any("err", err))
 		}
 		cancel()
@@ -151,7 +151,7 @@ func (s *AteWorkerService) unhostActor(ctx context.Context, actorUID string) err
 	}()
 
 	if s.actorCgroups {
-		if err := ateomcgroup.RemoveActorLeaf(actorUID); err != nil {
+		if err := cgroup.RemoveActorLeaf(actorUID); err != nil {
 			slog.WarnContext(ctx, "Failed to remove the actor's cgroup", slog.Any("err", err))
 		}
 	}
@@ -238,7 +238,7 @@ func (s *AteWorkerService) sandboxDialer(actorUID string) atunnel.DialFunc {
 	return func(ctx context.Context, network, address string) (net.Conn, error) {
 		s.actorsMu.RLock()
 		hosted := s.actors[actorUID]
-		var session *ateomnet.SandboxSession
+		var session *actornet.SandboxSession
 		if hosted != nil {
 			session = hosted.network
 		}
diff --git a/cmd/ateworker-microvm/main.go b/cmd/ateworker-microvm/main.go
index 64dd34ab9e..b577fc05d2 100644
--- a/cmd/ateworker-microvm/main.go
+++ b/cmd/ateworker-microvm/main.go
@@ -41,12 +41,11 @@ import (
 	"github.com/agent-substrate/substrate/internal/actorlog"
 	"github.com/agent-substrate/substrate/internal/apierror"
 	"github.com/agent-substrate/substrate/internal/ateinterceptors"
-	"github.com/agent-substrate/substrate/internal/ateom"
-	"github.com/agent-substrate/substrate/internal/ateomcgroup"
-	"github.com/agent-substrate/substrate/internal/ateominit"
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
-	"github.com/agent-substrate/substrate/internal/ateomtunnel"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
+	"github.com/agent-substrate/substrate/internal/ateworker/cgroup"
+	"github.com/agent-substrate/substrate/internal/ateworker/pid1"
+	"github.com/agent-substrate/substrate/internal/ateworker/register"
+	"github.com/agent-substrate/substrate/internal/ateworker/tunnel"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/otlprelay"
 	"github.com/agent-substrate/substrate/internal/preview"
@@ -54,6 +53,7 @@ import (
 	"github.com/agent-substrate/substrate/internal/resources"
 	"github.com/agent-substrate/substrate/internal/serverboot"
 	"github.com/agent-substrate/substrate/internal/version"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 	"github.com/spf13/pflag"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
@@ -75,7 +75,7 @@ var (
 	otlpRelaySocket = pflag.String("otlp-relay-socket", nodepath.AteletOTLPSocketPath(),
 		"Unix socket of atelet's OTLP relay to export telemetry through, keeping it off the pod network. Empty, or absent at startup, exports directly to OTEL_EXPORTER_OTLP_ENDPOINT instead.")
 
-	tunnelConfig = ateomtunnel.RegisterFlags(pflag.CommandLine)
+	tunnelConfig = tunnel.RegisterFlags(pflag.CommandLine)
 
 	readinessListenAddress = pflag.String("readiness-listen-address", "0.0.0.0:8080", "Address for the HTTP /readyz and /healthz probes")
 	maxActors              = pflag.Int("max-actors", 1000, "How many actors this worker will host at once")
@@ -87,7 +87,7 @@ var (
 const minUsageSampleInterval = 50 * time.Second
 
 func main() {
-	ateominit.RunIfPID1()
+	pid1.RunIfPID1()
 	pflag.Parse()
 	if *showVersion {
 		fmt.Println(version.String())
@@ -223,26 +223,26 @@ func do(ctx context.Context) error {
 	actorLogger := actorlog.NewActorLogger(logWriter, metadata.OnGCE())
 	// Give each actor's VMM and virtiofsd a cgroup of their own, so one busy
 	// guest cannot starve the rest.
-	actorCgroups, err := ateomcgroup.Delegate(ctx)
+	actorCgroups, err := cgroup.Delegate(ctx)
 	if err != nil {
 		return fmt.Errorf("while delegating the worker cgroup: %w", err)
 	}
 
-	tunnel, err := ateomtunnel.Start(ctx, *tunnelConfig, ateomnet.ActorHTTPUpstream)
+	tunnel, err := tunnel.Start(ctx, *tunnelConfig, actornet.ActorHTTPUpstream)
 	if err != nil {
 		return err
 	}
 	ateworkerService := NewService(*podUID, *chBinary, *guestDebug, *vmmMemReserve, *maxActors, tunnel, actorLogger)
 	ateworkerService.actorCgroups = actorCgroups
 	// The controller sets both from the downward API.
-	pool := ateomstats.Pool{Namespace: os.Getenv("POD_NAMESPACE"), Name: os.Getenv("WORKER_POOL_NAME")}
+	pool := workerstats.Pool{Namespace: os.Getenv("POD_NAMESPACE"), Name: os.Getenv("WORKER_POOL_NAME")}
 	if pool.Namespace == "" || pool.Name == "" {
 		slog.WarnContext(ctx, "Worker pool unknown; usage records will name no pool", slog.Any("pool", pool))
 	}
-	usageStdout := ateomstats.NewStdoutHandler(logWriter)
+	usageStdout := workerstats.NewStdoutHandler(logWriter)
 	defer usageStdout.Close()
-	ateworkerService.usage = ateomstats.NewUsageEmitter(lp, usageStdout, pool)
-	defer ateomstats.StartSampler(ctx, *usageSampleInterval, func(ctx context.Context) { ateworkerService.sweepUsage(ctx) })()
+	ateworkerService.usage = workerstats.NewUsageEmitter(lp, usageStdout, pool)
+	defer workerstats.StartSampler(ctx, *usageSampleInterval, func(ctx context.Context) { ateworkerService.sweepUsage(ctx) })()
 
 	svr := grpc.NewServer(
 		grpc.StatsHandler(otelgrpc.NewServerHandler()),
@@ -278,7 +278,7 @@ func do(ctx context.Context) error {
 	// outlast, including the window before the Worker record exists; anything
 	// that reaches here is a misconfiguration no restart-in-place will fix.
 	go func() {
-		err := ateom.Report(ctx, ateom.ReportConfig{
+		err := register.Report(ctx, register.ReportConfig{
 			SocketPath:           nodepath.WorkerSupportSocket,
 			CredentialBundlePath: tunnelConfig.CredentialBundle,
 			TrustBundlePath:      tunnelConfig.TrustBundle,
@@ -364,9 +364,9 @@ type AteWorkerService struct {
 	// stdout as ate.dev/*-labeled JSON and emits actor lifecycle events (parity
 	// with ateworker-gvisor).
 	actorLogger *actorlog.ActorLogger
-	tunnel      *ateomtunnel.Tunnel
+	tunnel      *tunnel.Tunnel
 	// usage writes the usage records. Nil writes none.
-	usage *ateomstats.UsageEmitter
+	usage *workerstats.UsageEmitter
 
 	// Guards actors, draining, and mutable hostedActor fields.
 	actorsMu sync.RWMutex
@@ -386,7 +386,7 @@ type AteWorkerService struct {
 var _ ateworkerpb.WorkerServer = (*AteWorkerService)(nil)
 
 // NewService creates a new AteWorkerService.
-func NewService(podUID, chBinary string, guestDebug bool, memReserveMiB, maxActors int, tunnel *ateomtunnel.Tunnel, actorLogger *actorlog.ActorLogger) *AteWorkerService {
+func NewService(podUID, chBinary string, guestDebug bool, memReserveMiB, maxActors int, tunnel *tunnel.Tunnel, actorLogger *actorlog.ActorLogger) *AteWorkerService {
 	return &AteWorkerService{
 		locks:         actorlock.New(),
 		inFlight:      actorlock.NewInFlight(),
diff --git a/cmd/ateworker-microvm/net.go b/cmd/ateworker-microvm/net.go
index 6c59e985e8..ef4703492e 100644
--- a/cmd/ateworker-microvm/net.go
+++ b/cmd/ateworker-microvm/net.go
@@ -24,8 +24,8 @@ import (
 
 	"github.com/vishvananda/netlink"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
+	"github.com/agent-substrate/substrate/internal/netns"
 )
 
 const (
@@ -47,7 +47,7 @@ const (
 	actorTapMTU = 1500
 )
 
-var gatewayHWAddr = ateomnet.MustParseMAC(gatewayMAC)
+var gatewayHWAddr = actornet.MustParseMAC(gatewayMAC)
 
 // setupActorTap creates the guest's tap with a fixed gateway address and MAC.
 // Returns the FDs cloud-hypervisor adopts on boot or restore.
@@ -80,7 +80,7 @@ func setupActorTap(ctx context.Context, actorNetNS netns.Handle, name string, qu
 		if err := netlink.LinkSetHardwareAddr(link, gatewayHWAddr); err != nil {
 			return fmt.Errorf("setting the gateway MAC on tap %q: %w", name, err)
 		}
-		if err := netlink.AddrReplace(link, ateomnet.HostVethAddr); err != nil {
+		if err := netlink.AddrReplace(link, actornet.HostVethAddr); err != nil {
 			return fmt.Errorf("assigning the gateway address to tap %q: %w", name, err)
 		}
 		if err := netlink.LinkSetUp(link); err != nil {
diff --git a/cmd/ateworker-microvm/net_linux_test.go b/cmd/ateworker-microvm/net_linux_test.go
index 48d2807cce..0f6b220985 100644
--- a/cmd/ateworker-microvm/net_linux_test.go
+++ b/cmd/ateworker-microvm/net_linux_test.go
@@ -22,10 +22,10 @@ import (
 
 	"github.com/vishvananda/netlink"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
-	"github.com/agent-substrate/substrate/internal/ateomtunnel"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
+	"github.com/agent-substrate/substrate/internal/ateworker/tunnel"
 	"github.com/agent-substrate/substrate/internal/atunnel"
+	"github.com/agent-substrate/substrate/internal/netns"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/resources"
 	"github.com/agent-substrate/substrate/internal/roottest"
@@ -41,7 +41,7 @@ func TestHostActorReplacesSameActor(t *testing.T) {
 		t.Fatal(err)
 	}
 	service := &AteWorkerService{
-		tunnel:    &ateomtunnel.Tunnel{Egress: egress, EgressPort: 15001},
+		tunnel:    &tunnel.Tunnel{Egress: egress, EgressPort: 15001},
 		actors:    map[string]*hostedActor{},
 		maxActors: 1,
 	}
@@ -121,12 +121,12 @@ func TestSetupActorTap(t *testing.T) {
 		}
 		var found bool
 		for _, a := range addrs {
-			if a.IPNet.String() == ateomnet.HostVethAddr.IPNet.String() {
+			if a.IPNet.String() == actornet.HostVethAddr.IPNet.String() {
 				found = true
 			}
 		}
 		if !found {
-			t.Errorf("tap addresses = %v, want the gateway %s the guest routes to", addrs, ateomnet.HostVethAddr)
+			t.Errorf("tap addresses = %v, want the gateway %s the guest routes to", addrs, actornet.HostVethAddr)
 		}
 		return nil
 	}); err != nil {
diff --git a/cmd/ateworker-microvm/phaselog.go b/cmd/ateworker-microvm/phaselog.go
index bde1ee32ea..f277b26cd5 100644
--- a/cmd/ateworker-microvm/phaselog.go
+++ b/cmd/ateworker-microvm/phaselog.go
@@ -18,7 +18,7 @@ package main
 
 import "github.com/agent-substrate/substrate/internal/ateattr"
 
-// The phase names, suffixed onto the ateomphaselog duration keys. Kept out of
+// The phase names, suffixed onto the phaselog duration keys. Kept out of
 // ateattr on purpose: that package's SnapshotPhase* values are the
 // ate.snapshot.phase metric enum, and these are not values of it. "total" is
 // shared so the two layers' records agree on the denominator.
diff --git a/cmd/ateworker-microvm/restore.go b/cmd/ateworker-microvm/restore.go
index 750d723d4c..02bf2971bf 100644
--- a/cmd/ateworker-microvm/restore.go
+++ b/cmd/ateworker-microvm/restore.go
@@ -28,10 +28,10 @@ import (
 	"time"
 
 	"github.com/agent-substrate/substrate/internal/apierror"
-	"github.com/agent-substrate/substrate/internal/ateomphaselog"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
+	"github.com/agent-substrate/substrate/internal/ateworker/phaselog"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
 
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/ch"
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/kata"
@@ -128,7 +128,7 @@ func (s *AteWorkerService) RestoreWorkload(ctx context.Context, req *ateworkerpb
 	}
 	defer release()
 
-	if err := s.tunnel.Deactivate(ctx, ateomstats.ActorAttributionFromRequest(req)); err != nil {
+	if err := s.tunnel.Deactivate(ctx, workerstats.ActorAttributionFromRequest(req)); err != nil {
 		return nil, err
 	}
 
@@ -196,8 +196,8 @@ func (s *AteWorkerService) RestoreWorkload(ctx context.Context, req *ateworkerpb
 		dTotal := time.Since(tStart)
 		slog.InfoContext(ctx, "Actor restored (rootfs upper + durable-dir volumes, cold boot)",
 			slog.String("id", p.actorUID), slog.Duration("total", dTotal))
-		ateomphaselog.LogSnapshotPhases(ctx, "Restore timing breakdown", attribution, scope,
-			ateomphaselog.RestoreDurationKey, nil, []ateomphaselog.Phase{{Name: phaseTotal, D: dTotal}})
+		phaselog.LogSnapshotPhases(ctx, "Restore timing breakdown", attribution, scope,
+			phaselog.RestoreDurationKey, nil, []phaselog.Phase{{Name: phaseTotal, D: dTotal}})
 	case ateworkerpb.SnapshotFidelity_SNAPSHOT_FIDELITY_VOLUMES:
 		// A VOLUMES snapshot holds no guest state, so this is a cold boot that
 		// happens to start with the volumes already populated. wakeup probe gating comes
@@ -210,8 +210,8 @@ func (s *AteWorkerService) RestoreWorkload(ctx context.Context, req *ateworkerpb
 			slog.String("id", p.actorUID), slog.Duration("total", dTotal))
 		// A cold boot has none of the memory-restore phases, so the total is the
 		// only observation on its record.
-		ateomphaselog.LogSnapshotPhases(ctx, "Restore timing breakdown", attribution, scope,
-			ateomphaselog.RestoreDurationKey, nil, []ateomphaselog.Phase{{Name: phaseTotal, D: dTotal}})
+		phaselog.LogSnapshotPhases(ctx, "Restore timing breakdown", attribution, scope,
+			phaselog.RestoreDurationKey, nil, []phaselog.Phase{{Name: phaseTotal, D: dTotal}})
 	default:
 		return nil, apierror.InvalidArgument("unsupported snapshot fidelity: %v", scope)
 	}
@@ -451,7 +451,7 @@ func (s *AteWorkerService) restoreMemoryFidelity(ctx context.Context, p actorBoo
 	}
 
 	// Block until every wakeup-probe-enabled container reports 200.
-	if err := wakeupprobe.WaitAll(ctx, containers, ateomnet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(actorUID))); err != nil {
+	if err := wakeupprobe.WaitAll(ctx, containers, actornet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(actorUID))); err != nil {
 		return fmt.Errorf("while waiting for container wakeup probe: %w", err)
 	}
 
@@ -476,8 +476,8 @@ func (s *AteWorkerService) restoreMemoryFidelity(ctx context.Context, p actorBoo
 	// The joinable per-actor record the benchmarking tooling aggregates. The
 	// durable delta is not carried: tDurable is pinned to tLowers today, so it
 	// would always be the zero a record skips.
-	ateomphaselog.LogSnapshotPhases(ctx, "Restore timing breakdown", p.actorAttribution(), scope,
-		ateomphaselog.RestoreDurationKey, nil, []ateomphaselog.Phase{
+	phaselog.LogSnapshotPhases(ctx, "Restore timing breakdown", p.actorAttribution(), scope,
+		phaselog.RestoreDurationKey, nil, []phaselog.Phase{
 			{Name: phasePrep, D: tPrep.Sub(tStart)},
 			{Name: phaseBundles, D: tBundles.Sub(tPrep)},
 			{Name: phaseUpperJoin, D: tUpper.Sub(tBundles)},
diff --git a/cmd/ateworker-microvm/run.go b/cmd/ateworker-microvm/run.go
index a632ac9271..ea076e6888 100644
--- a/cmd/ateworker-microvm/run.go
+++ b/cmd/ateworker-microvm/run.go
@@ -30,9 +30,9 @@ import (
 	"time"
 
 	"github.com/agent-substrate/substrate/internal/apierror"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
 
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/ch"
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/kata"
@@ -251,7 +251,7 @@ func (s *AteWorkerService) RunWorkload(ctx context.Context, req *ateworkerpb.Run
 	}
 	defer release()
 
-	if err := s.tunnel.Deactivate(ctx, ateomstats.ActorAttributionFromRequest(req)); err != nil {
+	if err := s.tunnel.Deactivate(ctx, workerstats.ActorAttributionFromRequest(req)); err != nil {
 		return nil, err
 	}
 
@@ -594,7 +594,7 @@ func (s *AteWorkerService) coldBootActor(ctx context.Context, p actorBootParams)
 	tContainers := time.Now()
 
 	// Block until every wakeup-probe-enabled container reports 200.
-	if err := wakeupprobe.WaitAll(ctx, containers, ateomnet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(actorUID))); err != nil {
+	if err := wakeupprobe.WaitAll(ctx, containers, actornet.ActorVethIP, wakeupprobe.DialFunc(s.sandboxDialer(actorUID))); err != nil {
 		return fmt.Errorf("while waiting for container wakeup probe: %w", err)
 	}
 
@@ -1039,25 +1039,25 @@ func tailString(s string, n int) string {
 // neighbor entry stays valid).
 func (s *AteWorkerService) configureGuestNetwork(ctx context.Context, ac *kata.AgentClient, mtu uint64) error {
 	if err := ac.UpdateInterface(ctx, &agentpb.Interface{
-		Device: ateomnet.ActorVethName,
-		Name:   ateomnet.ActorVethName,
+		Device: actornet.ActorVethName,
+		Name:   actornet.ActorVethName,
 		HwAddr: actorGuestMAC,
 		Mtu:    mtu,
 		IPAddresses: []*agentpb.IPAddress{
-			{Family: agentpb.IPFamily_v4, Address: ateomnet.ActorVethIP, Mask: "30"},
+			{Family: agentpb.IPFamily_v4, Address: actornet.ActorVethIP, Mask: "30"},
 		},
 	}); err != nil {
 		return err
 	}
 	if err := ac.UpdateRoutes(ctx, []*agentpb.Route{
-		{Dest: ateomnet.ActorVethSubnet, Device: ateomnet.ActorVethName, Scope: uint32(unix.RT_SCOPE_LINK), Family: agentpb.IPFamily_v4},
-		{Dest: "", Gateway: ateomnet.ActorVethGateway, Device: ateomnet.ActorVethName, Family: agentpb.IPFamily_v4},
+		{Dest: actornet.ActorVethSubnet, Device: actornet.ActorVethName, Scope: uint32(unix.RT_SCOPE_LINK), Family: agentpb.IPFamily_v4},
+		{Dest: "", Gateway: actornet.ActorVethGateway, Device: actornet.ActorVethName, Family: agentpb.IPFamily_v4},
 	}); err != nil {
 		return err
 	}
 	return ac.AddARPNeighbors(ctx, []*agentpb.ARPNeighbor{{
-		ToIPAddress: &agentpb.IPAddress{Family: agentpb.IPFamily_v4, Address: ateomnet.ActorVethGateway},
-		Device:      ateomnet.ActorVethName,
+		ToIPAddress: &agentpb.IPAddress{Family: agentpb.IPFamily_v4, Address: actornet.ActorVethGateway},
+		Device:      actornet.ActorVethName,
 		Lladdr:      gatewayMAC,
 		State:       0x80, // NUD_PERMANENT
 	}})
diff --git a/cmd/ateworker-microvm/sandboxnet.go b/cmd/ateworker-microvm/sandboxnet.go
index cb841209fe..3749205ce5 100644
--- a/cmd/ateworker-microvm/sandboxnet.go
+++ b/cmd/ateworker-microvm/sandboxnet.go
@@ -20,8 +20,8 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns"
 )
 
 // writeActorResolvConf points the guest resolver at its fixed gateway address.
@@ -30,5 +30,5 @@ func writeActorResolvConf(rootfs string) error {
 	if err != nil {
 		return fmt.Errorf("reading the worker pod resolv.conf: %w", err)
 	}
-	return dns.WriteRootfsResolvConf(rootfs, dns.SandboxResolvConf(ateomnet.ActorVethGateway, pod))
+	return dns.WriteRootfsResolvConf(rootfs, dns.SandboxResolvConf(actornet.ActorVethGateway, pod))
 }
diff --git a/cmd/ateworker-microvm/stats_test.go b/cmd/ateworker-microvm/stats_test.go
index 737f8288c8..6340144dd0 100644
--- a/cmd/ateworker-microvm/stats_test.go
+++ b/cmd/ateworker-microvm/stats_test.go
@@ -33,9 +33,9 @@ import (
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/third_party/kata/agentpb"
 	"github.com/agent-substrate/substrate/internal/actorlock"
 	"github.com/agent-substrate/substrate/internal/apierror"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
 	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // TestActorBootParamsAttribution pins the mapping from actorBootParams onto the
@@ -101,7 +101,7 @@ func TestActorBootParamsAttributionMatchesRequest(t *testing.T) {
 		templateName:     req.GetActorTemplateName(),
 	}
 
-	if diff := cmp.Diff(ateomstats.ActorAttributionFromRequest(req), p.actorAttribution()); diff != "" {
+	if diff := cmp.Diff(workerstats.ActorAttributionFromRequest(req), p.actorAttribution()); diff != "" {
 		t.Errorf("attribution via actorBootParams differs from attribution via request (-request +params):\n%s", diff)
 	}
 }
@@ -759,8 +759,8 @@ func TestGetActiveWorkloadStatsTransition(t *testing.T) {
 // so the sweep samples it. It starts at the unix epoch, so a sample's epoch is
 // zero and the expected samples here need not name it; the epoch has tests of
 // its own.
-func testActivation() *ateomstats.Activation {
-	a := ateomstats.NewActivation(time.Unix(0, 0), false)
+func testActivation() *workerstats.Activation {
+	a := workerstats.NewActivation(time.Unix(0, 0), false)
 	a.Initial(nil, nil)
 	return a
 }
diff --git a/cmd/ateworker-microvm/usage_test.go b/cmd/ateworker-microvm/usage_test.go
index d9096c0e87..b78f71482c 100644
--- a/cmd/ateworker-microvm/usage_test.go
+++ b/cmd/ateworker-microvm/usage_test.go
@@ -25,25 +25,25 @@ import (
 
 	"github.com/agent-substrate/substrate/cmd/ateworker-microvm/internal/third_party/kata/agentpb"
 	"github.com/agent-substrate/substrate/internal/ateattr"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
-	"github.com/agent-substrate/substrate/internal/ateomstats/ateomstatstest"
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
+	"github.com/agent-substrate/substrate/internal/workerstats"
+	"github.com/agent-substrate/substrate/internal/workerstats/workerstatstest"
 )
 
-func withUsageRecorder(s *AteWorkerService) *ateomstatstest.Recorder {
-	e, rec := ateomstatstest.NewEmitter()
+func withUsageRecorder(s *AteWorkerService) *workerstatstest.Recorder {
+	e, rec := workerstatstest.NewEmitter()
 	s.usage = e
 	return rec
 }
 
 // running is a after its initial reading, so the sweep samples it.
-func running(a *ateomstats.Activation) *ateomstats.Activation {
+func running(a *workerstats.Activation) *workerstats.Activation {
 	a.Initial(nil, nil)
 	return a
 }
 
 // setActivation replaces the test actor's activation.
-func setActivation(s *AteWorkerService, a *ateomstats.Activation) *hostedActor {
+func setActivation(s *AteWorkerService, a *workerstats.Activation) *hostedActor {
 	h := s.lookupActor(testActor.UID)
 	s.actorsMu.Lock()
 	h.usage = a
@@ -55,7 +55,7 @@ func TestSweepStampsEpochAndDiscoveryServesIt(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	epoch := time.Unix(1700, 0)
-	setActivation(s, running(ateomstats.NewActivation(epoch, false)))
+	setActivation(s, running(workerstats.NewActivation(epoch, false)))
 
 	before, err := s.GetActiveWorkloadStats(context.Background(), &ateworkerpb.GetActiveWorkloadStatsRequest{})
 	if err != nil {
@@ -83,7 +83,7 @@ func TestSweepStampsEpochAndDiscoveryServesIt(t *testing.T) {
 func TestResumedGuestCPUIsActivationRelative(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 9_000_000)}}
 	s := newStatsService(agent, "app_ovl")
-	h := setActivation(s, running(ateomstats.NewActivation(time.Now(), true)))
+	h := setActivation(s, running(workerstats.NewActivation(time.Now(), true)))
 
 	s.sweepUsage(context.Background())
 	if got := h.usage.Latest().GetCpuUsageUsec(); got != 0 {
@@ -102,7 +102,7 @@ func TestRecordInitialAndFinal(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	rec := withUsageRecorder(s)
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 
 	s.recordInitial(context.Background(), h)
 	if h.usage.Latest() == nil {
@@ -125,7 +125,7 @@ func TestRecordInitialAndFinal(t *testing.T) {
 func TestRecordFinalIfEnded(t *testing.T) {
 	s := newStatsService(&fakeAgent{}, "app_ovl")
 	rec := withUsageRecorder(s)
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 
 	s.recordFinalIfEnded(context.Background(), h)
 	if got := rec.Kinds(); len(got) != 0 {
@@ -143,7 +143,7 @@ func TestRecordFinalIfEnded(t *testing.T) {
 func TestReadFinal(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	s.recordInitial(context.Background(), h)
 
 	agent.stats["app_ovl"] = containerStats(1000, 2000, 100, 9_000_000)
@@ -166,7 +166,7 @@ func TestEndPreviousActivation(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	rec := withUsageRecorder(s)
-	old := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	old := setActivation(s, workerstats.NewActivation(time.Now(), false))
 
 	if err := s.endPreviousActivation(context.Background(), testActor.UID, nil); err != nil {
 		t.Fatal(err)
@@ -180,7 +180,7 @@ func TestEndPreviousActivation(t *testing.T) {
 func TestRecordFinalWithNoSampleIsPending(t *testing.T) {
 	s := newStatsService(&fakeAgent{}, "app_ovl")
 	rec := withUsageRecorder(s)
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	s.recordFinal(context.Background(), h)
 	if len(rec.Sources()) != 1 || rec.Sources()[0] != ateattr.StatsSourceUnspecified {
 		t.Errorf("final record sources = %v, want one pending", rec.Sources())
@@ -193,7 +193,7 @@ func TestRecordInitialAfterFinal(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	rec := withUsageRecorder(s)
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	agent.onCall = func() { s.recordFinal(context.Background(), h) }
 
 	s.recordInitial(context.Background(), h)
@@ -208,7 +208,7 @@ func TestRecordInitialRecoversFromPanic(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	rec := withUsageRecorder(s)
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	agent.onCall = func() { panic("guest read") }
 
 	s.recordInitial(context.Background(), h)
@@ -226,7 +226,7 @@ func TestSweepRecoversFromPanic(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	rec := withUsageRecorder(s)
-	setActivation(s, running(ateomstats.NewActivation(time.Now(), false)))
+	setActivation(s, running(workerstats.NewActivation(time.Now(), false)))
 	agent.onCall = func() { panic("guest read") }
 
 	s.sweepUsage(context.Background())
@@ -241,7 +241,7 @@ func TestRecordInitialTakesASlot(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	withUsageRecorder(s)
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	for range statsFanOut {
 		s.guestSlots <- struct{}{}
 	}
@@ -260,7 +260,7 @@ func TestRecordInitialAfterRehost(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	withUsageRecorder(s)
-	old := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	old := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	target := s.guestOf(old)
 	agent.onCall = func() { hostTestActor(s, testActor, target) }
 
@@ -282,7 +282,7 @@ func TestPartialGuestReadDoesNotDoubleCharge(t *testing.T) {
 		"b_ovl": containerStats(1000, 2000, 100, 400_000_000),
 	}}
 	s := newStatsService(agent, "a_ovl", "b_ovl")
-	h := setActivation(s, running(ateomstats.NewActivation(time.Now(), true)))
+	h := setActivation(s, running(workerstats.NewActivation(time.Now(), true)))
 
 	s.sweepUsage(context.Background())
 	agent.mu.Lock()
@@ -311,7 +311,7 @@ func TestSweepWaitsForInitialAndStopsAtFinal(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	rec := withUsageRecorder(s)
-	h := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	h := setActivation(s, workerstats.NewActivation(time.Now(), false))
 
 	s.sweepUsage(context.Background())
 	if len(agent.calls) != 0 {
@@ -339,9 +339,9 @@ func TestRecordInitialReadsItsOwnGuest(t *testing.T) {
 	newAgent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 9_000_000)}}
 	s := newStatsService(oldAgent, "app_ovl")
 	withUsageRecorder(s)
-	old := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	old := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	fresh := hostTestActor(s, testActor, &guestStatsTarget{actorUID: testActor.UID, agent: newAgent, workloadIDs: []string{"app_ovl"}})
-	fresh.usage = ateomstats.NewActivation(time.Now(), false)
+	fresh.usage = workerstats.NewActivation(time.Now(), false)
 
 	s.recordInitial(context.Background(), old)
 	if got := old.usage.Latest().GetCpuUsageUsec(); got != 5000 {
@@ -362,10 +362,10 @@ func TestLateInitialLeavesNewActivationAlone(t *testing.T) {
 	agent := &fakeAgent{stats: map[string]*agentpb.CgroupStats{"app_ovl": containerStats(1000, 2000, 100, 5_000_000)}}
 	s := newStatsService(agent, "app_ovl")
 	rec := withUsageRecorder(s)
-	old := setActivation(s, ateomstats.NewActivation(time.Now(), false))
+	old := setActivation(s, workerstats.NewActivation(time.Now(), false))
 	s.recordFinal(context.Background(), old)
 	fresh := hostTestActor(s, testActor, nil)
-	fresh.usage = ateomstats.NewActivation(time.Now(), false)
+	fresh.usage = workerstats.NewActivation(time.Now(), false)
 
 	s.recordInitial(context.Background(), old)
 	if got := rec.Kinds(); len(got) != 1 || got[0] != ateattr.StatsKindFinal {
diff --git a/docs/glossary.md b/docs/glossary.md
index 97f59b7a2b..7b99b303b0 100644
--- a/docs/glossary.md
+++ b/docs/glossary.md
@@ -69,8 +69,7 @@ for etcd.
   lifecycle from the sandboxed agent process. It embeds a networking service
   called `atunnel` that handles network traffic for the sandboxed Actor.
   ateworker is Substrate's worker implementation, one binary per sandbox class
-  (`ateworker-gvisor`, `ateworker-microvm`). Some internal Go packages still
-  use its former name, ateom.
+  (`ateworker-gvisor`, `ateworker-microvm`).
 
 - **atenet**: the networking stack. Its router resumes suspended Actors on
   demand and routes traffic to the right worker pod.
diff --git a/docs/metrics/registry/events.yaml b/docs/metrics/registry/events.yaml
index f479734ad2..e119254217 100644
--- a/docs/metrics/registry/events.yaml
+++ b/docs/metrics/registry/events.yaml
@@ -137,7 +137,7 @@ groups:
     annotations:
       substrate:
         emitted_by: [ateworker-gvisor, ateworker-microvm]
-        code_anchor: internal/ateomstats/usage.go
+        code_anchor: internal/workerstats/usage.go
         cuj: How much CPU and memory does this actor use, and since when?
     attributes:
       - ref: ate.atespace
diff --git a/docs/observability.md b/docs/observability.md
index f0b5e850df..c1b460be12 100644
--- a/docs/observability.md
+++ b/docs/observability.md
@@ -159,7 +159,7 @@ The duration keys are the [`ate.actor.restore.duration`](#the-metric-registry) i
 
 This is the record to use for a per-actor wake-up distribution. The histogram cannot answer that question at all, because actor identity is barred from metric labels; traces can, but the data plane is head-sampled at 1%.
 
-Both ateworkers write records with the same two messages from inside the `worker_restore` and `worker_checkpoint` phases, under `ateworker.actor.restore.duration.<phase>` and `ateworker.actor.checkpoint.duration.<phase>`. The phases are each runtime's own and are listed in `cmd/ateworker-gvisor/phaselog.go` and `cmd/ateworker-microvm/phaselog.go`; `internal/ateomphaselog` renders the record. They are not instruments. The same identity keys make the two layers' records joinable per actor, and a failed operation's record carries `error.type`.
+Both ateworkers write records with the same two messages from inside the `worker_restore` and `worker_checkpoint` phases, under `ateworker.actor.restore.duration.<phase>` and `ateworker.actor.checkpoint.duration.<phase>`. The phases are each runtime's own and are listed in `cmd/ateworker-gvisor/phaselog.go` and `cmd/ateworker-microvm/phaselog.go`; `internal/ateworker/phaselog` renders the record. They are not instruments. The same identity keys make the two layers' records joinable per actor, and a failed operation's record carries `error.type`.
 
 ateapi's `Actor state changed` is written once per committed actor state transition. ateapi owns the state machine, so this is where an actor's state and the time it reached it come from:
 
diff --git a/internal/ateomnet/dns/dnshandler.go b/internal/ateworker/actornet/dns/dnshandler.go
similarity index 99%
rename from internal/ateomnet/dns/dnshandler.go
rename to internal/ateworker/actornet/dns/dnshandler.go
index 103b733b00..665e5a30b0 100644
--- a/internal/ateomnet/dns/dnshandler.go
+++ b/internal/ateworker/actornet/dns/dnshandler.go
@@ -21,7 +21,7 @@ import (
 	"net"
 	"time"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns/protocol"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns/protocol"
 	"golang.org/x/net/dns/dnsmessage"
 )
 
diff --git a/internal/ateomnet/dns/dnshandler_test.go b/internal/ateworker/actornet/dns/dnshandler_test.go
similarity index 99%
rename from internal/ateomnet/dns/dnshandler_test.go
rename to internal/ateworker/actornet/dns/dnshandler_test.go
index cb7c052839..1551212e2a 100644
--- a/internal/ateomnet/dns/dnshandler_test.go
+++ b/internal/ateworker/actornet/dns/dnshandler_test.go
@@ -20,7 +20,7 @@ import (
 	"net"
 	"testing"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns/protocol"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns/protocol"
 	"golang.org/x/net/dns/dnsmessage"
 )
 
diff --git a/internal/ateomnet/dns/evaluator.go b/internal/ateworker/actornet/dns/evaluator.go
similarity index 100%
rename from internal/ateomnet/dns/evaluator.go
rename to internal/ateworker/actornet/dns/evaluator.go
diff --git a/internal/ateomnet/dns/evaluator_test.go b/internal/ateworker/actornet/dns/evaluator_test.go
similarity index 100%
rename from internal/ateomnet/dns/evaluator_test.go
rename to internal/ateworker/actornet/dns/evaluator_test.go
diff --git a/internal/ateomnet/dns/freemap/doc.go b/internal/ateworker/actornet/dns/freemap/doc.go
similarity index 100%
rename from internal/ateomnet/dns/freemap/doc.go
rename to internal/ateworker/actornet/dns/freemap/doc.go
diff --git a/internal/ateomnet/dns/freemap/freemap64k.go b/internal/ateworker/actornet/dns/freemap/freemap64k.go
similarity index 100%
rename from internal/ateomnet/dns/freemap/freemap64k.go
rename to internal/ateworker/actornet/dns/freemap/freemap64k.go
diff --git a/internal/ateomnet/dns/freemap/freemap64k_test.go b/internal/ateworker/actornet/dns/freemap/freemap64k_test.go
similarity index 100%
rename from internal/ateomnet/dns/freemap/freemap64k_test.go
rename to internal/ateworker/actornet/dns/freemap/freemap64k_test.go
diff --git a/internal/ateomnet/dns/limiter.go b/internal/ateworker/actornet/dns/limiter.go
similarity index 100%
rename from internal/ateomnet/dns/limiter.go
rename to internal/ateworker/actornet/dns/limiter.go
diff --git a/internal/ateomnet/dns/limiter_test.go b/internal/ateworker/actornet/dns/limiter_test.go
similarity index 100%
rename from internal/ateomnet/dns/limiter_test.go
rename to internal/ateworker/actornet/dns/limiter_test.go
diff --git a/internal/ateomnet/dns/pendingreq.go b/internal/ateworker/actornet/dns/pendingreq.go
similarity index 97%
rename from internal/ateomnet/dns/pendingreq.go
rename to internal/ateworker/actornet/dns/pendingreq.go
index ba5146adeb..65a04e7c5e 100644
--- a/internal/ateomnet/dns/pendingreq.go
+++ b/internal/ateworker/actornet/dns/pendingreq.go
@@ -21,8 +21,8 @@ import (
 	"sync"
 	"time"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns/freemap"
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns/protocol"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns/freemap"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns/protocol"
 	"golang.org/x/net/dns/dnsmessage"
 )
 
diff --git a/internal/ateomnet/dns/pendingreq_test.go b/internal/ateworker/actornet/dns/pendingreq_test.go
similarity index 100%
rename from internal/ateomnet/dns/pendingreq_test.go
rename to internal/ateworker/actornet/dns/pendingreq_test.go
diff --git a/internal/ateomnet/dns/policy.go b/internal/ateworker/actornet/dns/policy.go
similarity index 100%
rename from internal/ateomnet/dns/policy.go
rename to internal/ateworker/actornet/dns/policy.go
diff --git a/internal/ateomnet/dns/policy_test.go b/internal/ateworker/actornet/dns/policy_test.go
similarity index 99%
rename from internal/ateomnet/dns/policy_test.go
rename to internal/ateworker/actornet/dns/policy_test.go
index fa1b6f4efa..aec5aabb8e 100644
--- a/internal/ateomnet/dns/policy_test.go
+++ b/internal/ateworker/actornet/dns/policy_test.go
@@ -25,7 +25,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"golang.org/x/net/dns/dnsmessage"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns/protocol"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns/protocol"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 )
 
diff --git a/internal/ateomnet/dns/protocol/doc.go b/internal/ateworker/actornet/dns/protocol/doc.go
similarity index 100%
rename from internal/ateomnet/dns/protocol/doc.go
rename to internal/ateworker/actornet/dns/protocol/doc.go
diff --git a/internal/ateomnet/dns/protocol/protocol.go b/internal/ateworker/actornet/dns/protocol/protocol.go
similarity index 100%
rename from internal/ateomnet/dns/protocol/protocol.go
rename to internal/ateworker/actornet/dns/protocol/protocol.go
diff --git a/internal/ateomnet/dns/protocol/protocol_test.go b/internal/ateworker/actornet/dns/protocol/protocol_test.go
similarity index 100%
rename from internal/ateomnet/dns/protocol/protocol_test.go
rename to internal/ateworker/actornet/dns/protocol/protocol_test.go
diff --git a/internal/ateomnet/dns/protocol/tcp.go b/internal/ateworker/actornet/dns/protocol/tcp.go
similarity index 100%
rename from internal/ateomnet/dns/protocol/tcp.go
rename to internal/ateworker/actornet/dns/protocol/tcp.go
diff --git a/internal/ateomnet/dns/protocol/tcp_test.go b/internal/ateworker/actornet/dns/protocol/tcp_test.go
similarity index 100%
rename from internal/ateomnet/dns/protocol/tcp_test.go
rename to internal/ateworker/actornet/dns/protocol/tcp_test.go
diff --git a/internal/ateomnet/dns/readme.md b/internal/ateworker/actornet/dns/readme.md
similarity index 100%
rename from internal/ateomnet/dns/readme.md
rename to internal/ateworker/actornet/dns/readme.md
diff --git a/internal/ateomnet/dns/relay.go b/internal/ateworker/actornet/dns/relay.go
similarity index 100%
rename from internal/ateomnet/dns/relay.go
rename to internal/ateworker/actornet/dns/relay.go
diff --git a/internal/ateomnet/dns/relay_linux.go b/internal/ateworker/actornet/dns/relay_linux.go
similarity index 96%
rename from internal/ateomnet/dns/relay_linux.go
rename to internal/ateworker/actornet/dns/relay_linux.go
index 7aa6c121a8..394bf88645 100644
--- a/internal/ateomnet/dns/relay_linux.go
+++ b/internal/ateworker/actornet/dns/relay_linux.go
@@ -22,7 +22,7 @@ import (
 	"net"
 	"strconv"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
+	"github.com/agent-substrate/substrate/internal/netns"
 )
 
 // Serve serves UDP and TCP DNS in the sandbox's local gateway namespace.
diff --git a/internal/ateomnet/dns/relay_test.go b/internal/ateworker/actornet/dns/relay_test.go
similarity index 100%
rename from internal/ateomnet/dns/relay_test.go
rename to internal/ateworker/actornet/dns/relay_test.go
diff --git a/internal/ateomnet/dns/resolvconf.go b/internal/ateworker/actornet/dns/resolvconf.go
similarity index 100%
rename from internal/ateomnet/dns/resolvconf.go
rename to internal/ateworker/actornet/dns/resolvconf.go
diff --git a/internal/ateomnet/dns/resolvconf_test.go b/internal/ateworker/actornet/dns/resolvconf_test.go
similarity index 100%
rename from internal/ateomnet/dns/resolvconf_test.go
rename to internal/ateworker/actornet/dns/resolvconf_test.go
diff --git a/internal/ateomnet/dns/serve_linux_test.go b/internal/ateworker/actornet/dns/serve_linux_test.go
similarity index 95%
rename from internal/ateomnet/dns/serve_linux_test.go
rename to internal/ateworker/actornet/dns/serve_linux_test.go
index 3943070a6c..995e3e3fbc 100644
--- a/internal/ateomnet/dns/serve_linux_test.go
+++ b/internal/ateworker/actornet/dns/serve_linux_test.go
@@ -21,7 +21,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
+	"github.com/agent-substrate/substrate/internal/netns"
 	"github.com/agent-substrate/substrate/internal/roottest"
 )
 
diff --git a/internal/ateomnet/dns/server.go b/internal/ateworker/actornet/dns/server.go
similarity index 100%
rename from internal/ateomnet/dns/server.go
rename to internal/ateworker/actornet/dns/server.go
diff --git a/internal/ateomnet/dns/tcphandler.go b/internal/ateworker/actornet/dns/tcphandler.go
similarity index 98%
rename from internal/ateomnet/dns/tcphandler.go
rename to internal/ateworker/actornet/dns/tcphandler.go
index 93ca9883dd..e3eab1c011 100644
--- a/internal/ateomnet/dns/tcphandler.go
+++ b/internal/ateworker/actornet/dns/tcphandler.go
@@ -24,7 +24,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns/protocol"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns/protocol"
 )
 
 const (
diff --git a/internal/ateomnet/dns/tcphandler_test.go b/internal/ateworker/actornet/dns/tcphandler_test.go
similarity index 98%
rename from internal/ateomnet/dns/tcphandler_test.go
rename to internal/ateworker/actornet/dns/tcphandler_test.go
index 6322342bdd..d79bd266f9 100644
--- a/internal/ateomnet/dns/tcphandler_test.go
+++ b/internal/ateworker/actornet/dns/tcphandler_test.go
@@ -22,7 +22,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns/protocol"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns/protocol"
 	"golang.org/x/net/dns/dnsmessage"
 )
 
diff --git a/internal/ateomnet/dns/udphandler.go b/internal/ateworker/actornet/dns/udphandler.go
similarity index 100%
rename from internal/ateomnet/dns/udphandler.go
rename to internal/ateworker/actornet/dns/udphandler.go
diff --git a/internal/ateomnet/dns/udphandler_test.go b/internal/ateworker/actornet/dns/udphandler_test.go
similarity index 100%
rename from internal/ateomnet/dns/udphandler_test.go
rename to internal/ateworker/actornet/dns/udphandler_test.go
diff --git a/internal/ateomnet/net.go b/internal/ateworker/actornet/net.go
similarity index 96%
rename from internal/ateomnet/net.go
rename to internal/ateworker/actornet/net.go
index 5d5265ced3..96080e8959 100644
--- a/internal/ateomnet/net.go
+++ b/internal/ateworker/actornet/net.go
@@ -14,8 +14,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateomnet provides shared networking configuration logic for Substrate runtime agents.
-package ateomnet
+// Package actornet provides shared networking configuration logic for Substrate runtime agents.
+package actornet
 
 import (
 	"fmt"
diff --git a/internal/ateomnet/sandbox.go b/internal/ateworker/actornet/sandbox.go
similarity index 99%
rename from internal/ateomnet/sandbox.go
rename to internal/ateworker/actornet/sandbox.go
index d1b7cd9283..3e08da95bd 100644
--- a/internal/ateomnet/sandbox.go
+++ b/internal/ateworker/actornet/sandbox.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomnet
+package actornet
 
 import (
 	"context"
@@ -26,8 +26,8 @@ import (
 	"net/netip"
 	"sync"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns"
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns"
+	"github.com/agent-substrate/substrate/internal/netns"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 
 	"github.com/google/nftables"
diff --git a/internal/ateomnet/sandbox_atunnel_linux_test.go b/internal/ateworker/actornet/sandbox_atunnel_linux_test.go
similarity index 91%
rename from internal/ateomnet/sandbox_atunnel_linux_test.go
rename to internal/ateworker/actornet/sandbox_atunnel_linux_test.go
index 4b68f8d7ea..3109a8d6da 100644
--- a/internal/ateomnet/sandbox_atunnel_linux_test.go
+++ b/internal/ateworker/actornet/sandbox_atunnel_linux_test.go
@@ -14,9 +14,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// These integration tests use an external package so that ateomnet's own test
+// These integration tests use an external package so that actornet's own test
 // binary does not depend on atunnel.
-package ateomnet_test
+package actornet_test
 
 import (
 	"context"
@@ -25,9 +25,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet"
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet"
 	"github.com/agent-substrate/substrate/internal/atunnel"
+	"github.com/agent-substrate/substrate/internal/netns"
 	"github.com/agent-substrate/substrate/internal/roottest"
 )
 
@@ -37,13 +37,13 @@ func TestSandboxEgressReachesAtunnelOnAnyPort(t *testing.T) {
 	ctx := context.Background()
 	const egressPort = 15001
 
-	n, err := ateomnet.SetupSandboxNetwork(ctx, ateomnet.SandboxNetworkConfig{
+	n, err := actornet.SetupSandboxNetwork(ctx, actornet.SandboxNetworkConfig{
 		ActorUID: "66666666-6666-6666-6666-666666666666", Veth: true, EgressPort: egressPort,
 	})
 	if err != nil {
 		t.Fatalf("SetupSandboxNetwork: %v", err)
 	}
-	t.Cleanup(func() { ateomnet.CleanupSandboxNetwork(n) })
+	t.Cleanup(func() { actornet.CleanupSandboxNetwork(n) })
 
 	listeners, err := netns.Listen(ctx, n.GatewayNetNS, []uint16{egressPort})
 	if err != nil {
@@ -102,7 +102,7 @@ func TestSandboxLinkLocalDoesNotReachAtunnel(t *testing.T) {
 	ctx := context.Background()
 	const egressPort = 15001
 
-	n, err := ateomnet.SetupSandboxNetwork(ctx, ateomnet.SandboxNetworkConfig{
+	n, err := actornet.SetupSandboxNetwork(ctx, actornet.SandboxNetworkConfig{
 		ActorUID:   "99999999-9999-9999-9999-999999999999",
 		Veth:       true,
 		EgressPort: egressPort,
@@ -110,7 +110,7 @@ func TestSandboxLinkLocalDoesNotReachAtunnel(t *testing.T) {
 	if err != nil {
 		t.Fatalf("SetupSandboxNetwork: %v", err)
 	}
-	t.Cleanup(func() { ateomnet.CleanupSandboxNetwork(n) })
+	t.Cleanup(func() { actornet.CleanupSandboxNetwork(n) })
 
 	listeners, err := netns.Listen(ctx, n.GatewayNetNS, []uint16{egressPort})
 	if err != nil {
diff --git a/internal/ateomnet/sandbox_linux_test.go b/internal/ateworker/actornet/sandbox_linux_test.go
similarity index 99%
rename from internal/ateomnet/sandbox_linux_test.go
rename to internal/ateworker/actornet/sandbox_linux_test.go
index 4a39ac9d12..6308c39b5a 100644
--- a/internal/ateomnet/sandbox_linux_test.go
+++ b/internal/ateworker/actornet/sandbox_linux_test.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomnet
+package actornet
 
 import (
 	"context"
@@ -32,7 +32,7 @@ import (
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/vishvananda/netlink"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
+	"github.com/agent-substrate/substrate/internal/netns"
 	"github.com/agent-substrate/substrate/internal/roottest"
 )
 
diff --git a/internal/ateomcgroup/actor.go b/internal/ateworker/cgroup/actor.go
similarity index 99%
rename from internal/ateomcgroup/actor.go
rename to internal/ateworker/cgroup/actor.go
index 868ae51969..54e4b29f32 100644
--- a/internal/ateomcgroup/actor.go
+++ b/internal/ateworker/cgroup/actor.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomcgroup
+package cgroup
 
 import (
 	"context"
diff --git a/internal/ateomcgroup/actor_linux_test.go b/internal/ateworker/cgroup/actor_linux_test.go
similarity index 83%
rename from internal/ateomcgroup/actor_linux_test.go
rename to internal/ateworker/cgroup/actor_linux_test.go
index 068ada3c11..991470cf7e 100644
--- a/internal/ateomcgroup/actor_linux_test.go
+++ b/internal/ateworker/cgroup/actor_linux_test.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomcgroup
+package cgroup
 
 import (
 	"context"
@@ -35,7 +35,7 @@ func TestActorLeafStartsProcessesInside(t *testing.T) {
 	root := ownCgroup(t)
 	self := "/" + strings.TrimPrefix(root, Root)
 
-	leaf, err := openActorLeaf(root, "ateomcgroup-test", 500)
+	leaf, err := openActorLeaf(root, "cgroup-test", 500)
 	if err != nil {
 		t.Skipf("cannot create a cgroup here: %v", err)
 	}
@@ -51,10 +51,10 @@ func TestActorLeafStartsProcessesInside(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if want := "0::" + filepath.Join(self, "ateomcgroup-test"); !strings.Contains(string(got), want) {
+	if want := "0::" + filepath.Join(self, "cgroup-test"); !strings.Contains(string(got), want) {
 		t.Errorf("process cgroup = %q, want %q", got, want)
 	}
-	if err := removeActorLeaf(root, "ateomcgroup-test"); err != nil {
+	if err := removeActorLeaf(root, "cgroup-test"); err != nil {
 		t.Errorf("removing the leaf after its process exited: %v", err)
 	}
 }
@@ -63,7 +63,7 @@ func TestActorLeafStartsProcessesInside(t *testing.T) {
 func TestKillActorLeaf(t *testing.T) {
 	roottest.Require(t, "creates cgroups")
 	root := ownCgroup(t)
-	leaf, err := openActorLeaf(root, "ateomcgroup-kill-test", 0)
+	leaf, err := openActorLeaf(root, "cgroup-kill-test", 0)
 	if err != nil {
 		t.Skipf("cannot create a cgroup here: %v", err)
 	}
@@ -76,15 +76,15 @@ func TestKillActorLeaf(t *testing.T) {
 	_ = leaf.Close()
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
-	if err := KillLeafUnder(ctx, root, "ateomcgroup-kill-test"); err != nil {
+	if err := KillLeafUnder(ctx, root, "cgroup-kill-test"); err != nil {
 		t.Fatalf("KillLeafUnder: %v", err)
 	}
 	_ = cmd.Wait()
-	if err := removeActorLeaf(root, "ateomcgroup-kill-test"); err != nil {
+	if err := removeActorLeaf(root, "cgroup-kill-test"); err != nil {
 		t.Errorf("removing the killed leaf: %v", err)
 	}
 	// Already gone: nothing to kill.
-	if err := KillLeafUnder(ctx, root, "ateomcgroup-kill-test"); err != nil {
+	if err := KillLeafUnder(ctx, root, "cgroup-kill-test"); err != nil {
 		t.Errorf("KillLeafUnder on a removed leaf: %v", err)
 	}
 }
diff --git a/internal/ateomcgroup/actor_test.go b/internal/ateworker/cgroup/actor_test.go
similarity index 99%
rename from internal/ateomcgroup/actor_test.go
rename to internal/ateworker/cgroup/actor_test.go
index b23e98b055..05e5fa2dae 100644
--- a/internal/ateomcgroup/actor_test.go
+++ b/internal/ateworker/cgroup/actor_test.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomcgroup
+package cgroup
 
 import (
 	"os"
diff --git a/internal/ateomcgroup/ateomcgroup.go b/internal/ateworker/cgroup/cgroup.go
similarity index 98%
rename from internal/ateomcgroup/ateomcgroup.go
rename to internal/ateworker/cgroup/cgroup.go
index 0eddc5f7a0..776856c394 100644
--- a/internal/ateomcgroup/ateomcgroup.go
+++ b/internal/ateworker/cgroup/cgroup.go
@@ -14,9 +14,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateomcgroup delegates the worker pod's cgroup to the worker so each
+// Package cgroup delegates the worker pod's cgroup to the worker so each
 // actor can get a leaf of its own.
-package ateomcgroup
+package cgroup
 
 import (
 	"context"
diff --git a/internal/ateomcgroup/ateomcgroup_test.go b/internal/ateworker/cgroup/cgroup_test.go
similarity index 98%
rename from internal/ateomcgroup/ateomcgroup_test.go
rename to internal/ateworker/cgroup/cgroup_test.go
index bb0b194259..a5fbb791bc 100644
--- a/internal/ateomcgroup/ateomcgroup_test.go
+++ b/internal/ateworker/cgroup/cgroup_test.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomcgroup
+package cgroup
 
 import "testing"
 
diff --git a/internal/ateomphaselog/phaselog.go b/internal/ateworker/phaselog/phaselog.go
similarity index 97%
rename from internal/ateomphaselog/phaselog.go
rename to internal/ateworker/phaselog/phaselog.go
index 9d38c80197..85fe959047 100644
--- a/internal/ateomphaselog/phaselog.go
+++ b/internal/ateworker/phaselog/phaselog.go
@@ -12,12 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateomphaselog renders the per-actor "timing breakdown" log record an
+// Package phaselog renders the per-actor "timing breakdown" log record an
 // worker emits for each checkpoint and restore. Every worker binary times its
 // own phases, which are implementation details of that runtime; this package
 // holds the shape they share so the records of all workers carry the same
 // identity, fidelity and key layout, and atelet's own record joins to any of them.
-package ateomphaselog
+package phaselog
 
 import (
 	"context"
diff --git a/internal/ateomphaselog/phaselog_test.go b/internal/ateworker/phaselog/phaselog_test.go
similarity index 99%
rename from internal/ateomphaselog/phaselog_test.go
rename to internal/ateworker/phaselog/phaselog_test.go
index 5b8a8b4433..157fb821bd 100644
--- a/internal/ateomphaselog/phaselog_test.go
+++ b/internal/ateworker/phaselog/phaselog_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomphaselog
+package phaselog
 
 import (
 	"bytes"
diff --git a/internal/ateominit/ateominit.go b/internal/ateworker/pid1/pid1.go
similarity index 91%
rename from internal/ateominit/ateominit.go
rename to internal/ateworker/pid1/pid1.go
index 9ed17dd49d..606ac775a2 100644
--- a/internal/ateominit/ateominit.go
+++ b/internal/ateworker/pid1/pid1.go
@@ -14,13 +14,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateominit runs a minimal init as PID 1 so worker doesn't have to.
+// Package pid1 runs a minimal init as PID 1 so worker doesn't have to.
 //
 // PID 1 inherits every orphan (e.g. the runsc sandbox once `runsc create`
 // exits) and must reap them with wait4(-1), which races os/exec for the exit
 // status of worker's own subprocesses. The init re-executes the binary as its
 // only child, reaps everything, and exits with the child's status.
-package ateominit
+package pid1
 
 import (
 	"fmt"
@@ -43,7 +43,7 @@ func RunIfPID1() {
 	}
 	exe, err := os.Executable()
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "ateominit: finding the executable: %v\n", err)
+		fmt.Fprintf(os.Stderr, "pid1: finding the executable: %v\n", err)
 		os.Exit(1)
 	}
 	os.Exit(supervise(exe, os.Args))
@@ -54,7 +54,7 @@ func RunIfPID1() {
 func supervise(path string, argv []string) int {
 	// A no-op as PID 1, but it lets tests run this as an ordinary process.
 	if err := unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, 1, 0, 0, 0); err != nil {
-		fmt.Fprintf(os.Stderr, "ateominit: setting child subreaper: %v\n", err)
+		fmt.Fprintf(os.Stderr, "pid1: setting child subreaper: %v\n", err)
 		return 1
 	}
 
@@ -68,7 +68,7 @@ func supervise(path string, argv []string) int {
 		Files: []*os.File{os.Stdin, os.Stdout, os.Stderr},
 	})
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "ateominit: starting %s: %v\n", path, err)
+		fmt.Fprintf(os.Stderr, "pid1: starting %s: %v\n", path, err)
 		return 1
 	}
 
diff --git a/internal/ateominit/ateominit_test.go b/internal/ateworker/pid1/pid1_test.go
similarity index 99%
rename from internal/ateominit/ateominit_test.go
rename to internal/ateworker/pid1/pid1_test.go
index 9cca5983f2..8721df9631 100644
--- a/internal/ateominit/ateominit_test.go
+++ b/internal/ateworker/pid1/pid1_test.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateominit
+package pid1
 
 import (
 	"os"
diff --git a/internal/ateom/register.go b/internal/ateworker/register/register.go
similarity index 93%
rename from internal/ateom/register.go
rename to internal/ateworker/register/register.go
index 7b73ecd41f..3eb8cd0a7f 100644
--- a/internal/ateom/register.go
+++ b/internal/ateworker/register/register.go
@@ -12,10 +12,10 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateom registers a worker with the control plane through the
+// Package register registers a worker with the control plane through the
 // node-local atelet, reporting its compute capacity and the sandbox runtime
 // its actors start under.
-package ateom
+package register
 
 import (
 	"context"
@@ -32,19 +32,12 @@ import (
 	"github.com/agent-substrate/substrate/internal/ateletdial"
 	"github.com/agent-substrate/substrate/internal/hardware"
 	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/internal/workercapacity"
 	"k8s.io/apimachinery/pkg/api/resource"
 
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 )
 
-// Files the atecontroller projects into the worker container from the downward
-// API, in milli-cores and bytes.
-const (
-	CapacityMountPath = "/run/worker-capacity"
-	CPULimitFile      = "cpu_milli"
-	MemoryLimitFile   = "memory_bytes"
-)
-
 const (
 	reportTimeout        = 10 * time.Second
 	initialReportBackoff = 500 * time.Millisecond
@@ -62,15 +55,15 @@ const (
 // in-place Pod vertical scaling (IPPR); capacity is read once at startup.
 // NOTE: Please do not implement this yet. IPPR needs more general consideration.
 func FromFiles(actors int) *ateletpb.WorkerResources {
-	return fromDir(CapacityMountPath, actors)
+	return fromDir(workercapacity.MountPath, actors)
 }
 
 func fromDir(dir string, actors int) *ateletpb.WorkerResources {
 	return &ateletpb.WorkerResources{
 		Actors: int32(actors),
 		Resources: cpuMemory(
-			readLimit(filepath.Join(dir, CPULimitFile)),
-			readLimit(filepath.Join(dir, MemoryLimitFile)),
+			readLimit(filepath.Join(dir, workercapacity.CPULimitFile)),
+			readLimit(filepath.Join(dir, workercapacity.MemoryLimitFile)),
 		),
 	}
 }
diff --git a/internal/ateom/register_test.go b/internal/ateworker/register/register_test.go
similarity index 94%
rename from internal/ateom/register_test.go
rename to internal/ateworker/register/register_test.go
index 119193c9d0..43cb2690f8 100644
--- a/internal/ateom/register_test.go
+++ b/internal/ateworker/register/register_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateom
+package register
 
 import (
 	"context"
@@ -28,6 +28,7 @@ import (
 
 	"github.com/agent-substrate/substrate/internal/hardware"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
+	"github.com/agent-substrate/substrate/internal/workercapacity"
 )
 
 // testActors stands in for the worker's own ceiling, which is a flag in
@@ -49,10 +50,10 @@ func TestFromFiles(t *testing.T) {
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			dir := t.TempDir()
-			if err := os.WriteFile(filepath.Join(dir, CPULimitFile), []byte(tc.cpu), 0o600); err != nil {
+			if err := os.WriteFile(filepath.Join(dir, workercapacity.CPULimitFile), []byte(tc.cpu), 0o600); err != nil {
 				t.Fatalf("writing CPU limit: %v", err)
 			}
-			if err := os.WriteFile(filepath.Join(dir, MemoryLimitFile), []byte(tc.memory), 0o600); err != nil {
+			if err := os.WriteFile(filepath.Join(dir, workercapacity.MemoryLimitFile), []byte(tc.memory), 0o600); err != nil {
 				t.Fatalf("writing memory limit: %v", err)
 			}
 
diff --git a/internal/ateomsuspend/ateomsuspend.go b/internal/ateworker/suspend/suspend.go
similarity index 98%
rename from internal/ateomsuspend/ateomsuspend.go
rename to internal/ateworker/suspend/suspend.go
index e50a072938..f40bfd5960 100644
--- a/internal/ateomsuspend/ateomsuspend.go
+++ b/internal/ateworker/suspend/suspend.go
@@ -12,14 +12,14 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateomsuspend asks the control plane, through the node-local atelet,
+// Package suspend asks the control plane, through the node-local atelet,
 // to suspend an actor a worker hosts.
 //
 // This is the upward half of a suspend: the request travels worker -> atelet ->
 // ateapi, and the suspend the control plane decides to run travels back down
 // the ordinary path as a Checkpoint into the worker that asked. A caller must
 // therefore hold no lock that Checkpoint needs while a request is in flight.
-package ateomsuspend
+package suspend
 
 import (
 	"context"
diff --git a/internal/ateomsuspend/ateomsuspend_test.go b/internal/ateworker/suspend/suspend_test.go
similarity index 99%
rename from internal/ateomsuspend/ateomsuspend_test.go
rename to internal/ateworker/suspend/suspend_test.go
index a63670e541..9e5b9a7fbf 100644
--- a/internal/ateomsuspend/ateomsuspend_test.go
+++ b/internal/ateworker/suspend/suspend_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomsuspend
+package suspend
 
 import (
 	"context"
diff --git a/internal/ateomtunnel/egresspolicy.go b/internal/ateworker/tunnel/egresspolicy.go
similarity index 98%
rename from internal/ateomtunnel/egresspolicy.go
rename to internal/ateworker/tunnel/egresspolicy.go
index 66f4a1f907..0e5ff7e898 100644
--- a/internal/ateomtunnel/egresspolicy.go
+++ b/internal/ateworker/tunnel/egresspolicy.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomtunnel
+package tunnel
 
 import (
 	"context"
@@ -27,7 +27,7 @@ import (
 
 	"github.com/agent-substrate/substrate/internal/ateattr"
 	"github.com/agent-substrate/substrate/internal/ateletdial"
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns"
 	"github.com/agent-substrate/substrate/internal/nodepath"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 	"github.com/agent-substrate/substrate/internal/resources"
diff --git a/internal/ateomtunnel/egresspolicy_test.go b/internal/ateworker/tunnel/egresspolicy_test.go
similarity index 99%
rename from internal/ateomtunnel/egresspolicy_test.go
rename to internal/ateworker/tunnel/egresspolicy_test.go
index a9e28bbea5..33b832989f 100644
--- a/internal/ateomtunnel/egresspolicy_test.go
+++ b/internal/ateworker/tunnel/egresspolicy_test.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomtunnel
+package tunnel
 
 import (
 	"context"
@@ -460,7 +460,7 @@ func serveAtelet(t *testing.T, ca testCA, ateletID string) *fakeAtelet {
 
 	// t.TempDir() embeds the test name, which can overrun the unix socket
 	// path limit, so the socket gets its own short directory.
-	socketDir, err := os.MkdirTemp("", "ateomtunnel")
+	socketDir, err := os.MkdirTemp("", "tunnel")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/ateomtunnel/ateomtunnel.go b/internal/ateworker/tunnel/tunnel.go
similarity index 98%
rename from internal/ateomtunnel/ateomtunnel.go
rename to internal/ateworker/tunnel/tunnel.go
index 5ee9fde6c3..ecb2ceb617 100644
--- a/internal/ateomtunnel/ateomtunnel.go
+++ b/internal/ateworker/tunnel/tunnel.go
@@ -14,10 +14,10 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateomtunnel wires atunnel into a worker: its flags, listeners, DNS
+// Package tunnel wires atunnel into a worker: its flags, listeners, DNS
 // relay, and per-actor ingress and egress. Both workers build their tunnel here
 // so they cannot drift.
-package ateomtunnel
+package tunnel
 
 import (
 	"context"
@@ -30,7 +30,7 @@ import (
 	"time"
 
 	"github.com/agent-substrate/substrate/internal/ateletdial"
-	"github.com/agent-substrate/substrate/internal/ateomnet/dns"
+	"github.com/agent-substrate/substrate/internal/ateworker/actornet/dns"
 	"github.com/agent-substrate/substrate/internal/atunnel"
 	"github.com/agent-substrate/substrate/internal/egresspolicy"
 	"github.com/agent-substrate/substrate/internal/installdefaults"
diff --git a/internal/ateomtunnel/ateomtunnel_test.go b/internal/ateworker/tunnel/tunnel_test.go
similarity index 99%
rename from internal/ateomtunnel/ateomtunnel_test.go
rename to internal/ateworker/tunnel/tunnel_test.go
index 24704e76ec..4fbbe75f65 100644
--- a/internal/ateomtunnel/ateomtunnel_test.go
+++ b/internal/ateworker/tunnel/tunnel_test.go
@@ -14,7 +14,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomtunnel
+package tunnel
 
 import (
 	"context"
diff --git a/internal/atunnel/original_dst_linux_test.go b/internal/atunnel/original_dst_linux_test.go
index 7e6c24eac8..1e71bc95f4 100644
--- a/internal/atunnel/original_dst_linux_test.go
+++ b/internal/atunnel/original_dst_linux_test.go
@@ -33,7 +33,7 @@ import (
 	"github.com/vishvananda/netlink"
 	"golang.org/x/sys/unix"
 
-	"github.com/agent-substrate/substrate/internal/ateomnet/netns"
+	"github.com/agent-substrate/substrate/internal/netns"
 	"github.com/agent-substrate/substrate/internal/roottest"
 )
 
diff --git a/internal/ateomnet/netns/dial.go b/internal/netns/dial.go
similarity index 100%
rename from internal/ateomnet/netns/dial.go
rename to internal/netns/dial.go
diff --git a/internal/ateomnet/netns/dial_linux_test.go b/internal/netns/dial_linux_test.go
similarity index 100%
rename from internal/ateomnet/netns/dial_linux_test.go
rename to internal/netns/dial_linux_test.go
diff --git a/internal/ateomnet/netns/doc.go b/internal/netns/doc.go
similarity index 100%
rename from internal/ateomnet/netns/doc.go
rename to internal/netns/doc.go
diff --git a/internal/ateomnet/netns/netns.go b/internal/netns/netns.go
similarity index 100%
rename from internal/ateomnet/netns/netns.go
rename to internal/netns/netns.go
diff --git a/internal/ateomnet/netns/netns_linux_test.go b/internal/netns/netns_linux_test.go
similarity index 96%
rename from internal/ateomnet/netns/netns_linux_test.go
rename to internal/netns/netns_linux_test.go
index fdff891847..a2a38b5321 100644
--- a/internal/ateomnet/netns/netns_linux_test.go
+++ b/internal/netns/netns_linux_test.go
@@ -46,8 +46,8 @@ func TestNamedNetNSRejectsInvalidNames(t *testing.T) {
 
 func TestRemoveNamedDoesNotFollowSymlinks(t *testing.T) {
 	roottest.Require(t, "creates network namespaces")
-	const targetName = "ateomnet-symlink-target-test"
-	const linkName = "ateomnet-symlink-test"
+	const targetName = "actornet-symlink-target-test"
+	const linkName = "actornet-symlink-test"
 	targetPath := "/run/netns/" + targetName
 	linkPath := "/run/netns/" + linkName
 	target, err := CreateNamed(targetName)
@@ -83,7 +83,7 @@ func TestCreateNamedReplacesALeftover(t *testing.T) {
 	roottest.Require(t, "creates network namespaces")
 	for _, state := range []string{"mounted", "unmounted"} {
 		t.Run(state, func(t *testing.T) {
-			name := "ateomnet-leftover-test-" + state
+			name := "actornet-leftover-test-" + state
 			path := "/run/netns/" + name
 			t.Cleanup(func() { _ = RemoveNamed(name) })
 
diff --git a/internal/ateomnet/netns/sysctl.go b/internal/netns/sysctl.go
similarity index 100%
rename from internal/ateomnet/netns/sysctl.go
rename to internal/netns/sysctl.go
diff --git a/internal/ateomnet/netns/sysctl_linux_test.go b/internal/netns/sysctl_linux_test.go
similarity index 100%
rename from internal/ateomnet/netns/sysctl_linux_test.go
rename to internal/netns/sysctl_linux_test.go
diff --git a/internal/workercapacity/workercapacity.go b/internal/workercapacity/workercapacity.go
new file mode 100644
index 0000000000..8ebab0d1bd
--- /dev/null
+++ b/internal/workercapacity/workercapacity.go
@@ -0,0 +1,23 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package workercapacity names the files the atecontroller projects into the
+// worker container from the downward API, in milli-cores and bytes.
+package workercapacity
+
+const (
+	MountPath       = "/run/worker-capacity"
+	CPULimitFile    = "cpu_milli"
+	MemoryLimitFile = "memory_bytes"
+)
diff --git a/internal/ateomstats/activation.go b/internal/workerstats/activation.go
similarity index 99%
rename from internal/ateomstats/activation.go
rename to internal/workerstats/activation.go
index c7b19ca5f6..f91e4a552f 100644
--- a/internal/ateomstats/activation.go
+++ b/internal/workerstats/activation.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomstats
+package workerstats
 
 import (
 	"context"
diff --git a/internal/ateomstats/activation_test.go b/internal/workerstats/activation_test.go
similarity index 99%
rename from internal/ateomstats/activation_test.go
rename to internal/workerstats/activation_test.go
index 8c4b5e80e5..3a9366cb48 100644
--- a/internal/ateomstats/activation_test.go
+++ b/internal/workerstats/activation_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomstats
+package workerstats
 
 import (
 	"context"
diff --git a/internal/ateomstats/actorattribution.go b/internal/workerstats/actorattribution.go
similarity index 95%
rename from internal/ateomstats/actorattribution.go
rename to internal/workerstats/actorattribution.go
index 2ef7d2e722..332ec026c6 100644
--- a/internal/ateomstats/actorattribution.go
+++ b/internal/workerstats/actorattribution.go
@@ -12,13 +12,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateomstats holds the usage telemetry both worker runtimes share: the
+// Package workerstats holds the usage telemetry both worker runtimes share: the
 // attribution a worker retains for each actor, the per-activation state behind
 // every sample, the sampler, and the ate.actor.usage_sampled records. The
 // per-runtime measurement reads live with their runtimes (the cgroup read is
 // only meaningful inside the gVisor worker's cgroup namespace, the guest-agent
 // read only over the micro-VM's vsock).
-package ateomstats
+package workerstats
 
 import (
 	"github.com/agent-substrate/substrate/internal/proto/ateworkerpb"
diff --git a/internal/ateomstats/actorattribution_test.go b/internal/workerstats/actorattribution_test.go
similarity index 99%
rename from internal/ateomstats/actorattribution_test.go
rename to internal/workerstats/actorattribution_test.go
index a62096792c..51163f9bf4 100644
--- a/internal/ateomstats/actorattribution_test.go
+++ b/internal/workerstats/actorattribution_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomstats
+package workerstats
 
 import (
 	"testing"
diff --git a/internal/ateomstats/usage.go b/internal/workerstats/usage.go
similarity index 99%
rename from internal/ateomstats/usage.go
rename to internal/workerstats/usage.go
index 324942ef67..7f20843aff 100644
--- a/internal/ateomstats/usage.go
+++ b/internal/workerstats/usage.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomstats
+package workerstats
 
 import (
 	"context"
diff --git a/internal/ateomstats/usage_test.go b/internal/workerstats/usage_test.go
similarity index 99%
rename from internal/ateomstats/usage_test.go
rename to internal/workerstats/usage_test.go
index 15cc9d381b..41aad1f8a3 100644
--- a/internal/ateomstats/usage_test.go
+++ b/internal/workerstats/usage_test.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package ateomstats
+package workerstats
 
 import (
 	"context"
diff --git a/internal/ateomstats/ateomstatstest/ateomstatstest.go b/internal/workerstats/workerstatstest/workerstatstest.go
similarity index 86%
rename from internal/ateomstats/ateomstatstest/ateomstatstest.go
rename to internal/workerstats/workerstatstest/workerstatstest.go
index a9e30d7ae8..55d4d3940d 100644
--- a/internal/ateomstats/ateomstatstest/ateomstatstest.go
+++ b/internal/workerstats/workerstatstest/workerstatstest.go
@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package ateomstatstest records the usage records a worker writes, for tests.
-package ateomstatstest
+// Package workerstatstest records the usage records a worker writes, for tests.
+package workerstatstest
 
 import (
 	"context"
@@ -21,7 +21,7 @@ import (
 	"sync"
 
 	"github.com/agent-substrate/substrate/internal/ateattr"
-	"github.com/agent-substrate/substrate/internal/ateomstats"
+	"github.com/agent-substrate/substrate/internal/workerstats"
 )
 
 // Recorder is a stdout handler that keeps the kind and source of each record.
@@ -32,9 +32,9 @@ type Recorder struct {
 }
 
 // NewEmitter returns an emitter that writes every record to a new Recorder.
-func NewEmitter() (*ateomstats.UsageEmitter, *Recorder) {
+func NewEmitter() (*workerstats.UsageEmitter, *Recorder) {
 	rec := &Recorder{}
-	return ateomstats.NewUsageEmitter(nil, rec, ateomstats.Pool{}), rec
+	return workerstats.NewUsageEmitter(nil, rec, workerstats.Pool{}), rec
 }
 
 // Kinds is the ate.stats.kind of each record, in order.