@plurnk/plurnk-service 1.0.5 → 1.0.7

package/dist/core/Engine.js

@@ -2,14 +2,13 @@ import { PlurnkParser, PlurnkParseError } from "@plurnk/plurnk-grammar";
 import { Mimetypes, emptyRegistry } from "@plurnk/plurnk-mimetypes";
 import EntryCrud from "../schemes/_entry-crud.js";
 import EntryManifest from "../schemes/_entry-manifest.js";
-import { markTerminal } from "../schemes/Run.js";
+import { markTerminal } from "../schemes/Worker.js";
 import GitMembership from "./git-membership.js";
 import GitState from "./git-state.js";
-import SessionSettings from "./session-settings.js";
+import WorkspaceSettings from "./workspace-settings.js";
 import { editedSpan } from "../content/index.js";
 import { promptPathname } from "./plurnk-uri.js";
 import { rulerCount } from "./token-ruler.js";
-import SearchPrefetch from "./search-prefetch.js";
 import SearchGate from "./search-gate.js";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
@@ -27,12 +26,11 @@ import PacketBuilder from "./PacketBuilder.js";
 import ProposalLifecycle from "./ProposalLifecycle.js";
 import Dispatcher from "./Dispatcher.js";
 const DEFAULT_MAX_STRIKES = 3;
-const DEFAULT_MAX_COMMANDS = 99;
-// The foisted prompt EDIT/READ target — run-qualified storage (§prompt-auto-read, #382 fault-1)
+// The foisted prompt EDIT/READ target — worker-qualified storage (§prompt-auto-read, #382 fault-1)
 // rendered in the plurnk:// authority form (hostname carries the namespace, plurnk-uri folds it
 // back into the storage key on dispatch).
-const promptTarget = (runId, loopSeq, turnSeq) => {
-    const storage = promptPathname(runId, loopSeq, turnSeq);
+const promptTarget = (workerId, loopSeq, turnSeq) => {
+    const storage = promptPathname(workerId, loopSeq, turnSeq);
     return {
         kind: "url", raw: `plurnk://${storage.slice(1)}`,
         scheme: "plurnk", username: null, password: null,
@@ -49,13 +47,17 @@ const readMaxStrikes = () => {
         return DEFAULT_MAX_STRIKES;
     return n;
 };
+// Per-emission op ceiling — OFF by default. `-1` (or unset/non-positive) = no cap: every
+// generated op dispatches. Runaway degeneration is a sampler concern (repetition penalty),
+// not grounds to drop already-generated work. A positive value is an operator ceiling a
+// workspace's maxCommands may tighten (min wins), never widen (#232).
 const readMaxCommands = () => {
     const raw = process.env.PLURNK_SERVICE_MAX_COMMANDS;
     if (raw === undefined || raw.length === 0)
-        return DEFAULT_MAX_COMMANDS;
+        return Number.POSITIVE_INFINITY;
     const n = Number.parseInt(raw, 10);
     if (!Number.isFinite(n) || n < 1)
-        return DEFAULT_MAX_COMMANDS;
+        return Number.POSITIVE_INFINITY;
     return n;
 };
 // PLURNK_SERVICE_FILES_ITEMS — the turn-0 manifest preview. null = off (no foist);
@@ -115,7 +117,7 @@ export default class Engine {
     // marker's seconds; -1 = indefinite), consumed by the daemon's drain park-exit to schedule
     // the deadline wake. In-memory: a daemon restart drops pending deadlines (documented).
     parkDeadlines = new Map();
-    // §join-blocking-collect (#354) — loops whose turn issued a READ(run://running-child): the
+    // §join-blocking-collect (#354) — loops whose turn issued a READ(worker://running-child): the
     // blocking join. The dispatcher arms this on the READ; the turn's bare SEND[102] parks on it
     // (indefinite) instead of continuing, and any SEND clears it. Twin of parkDeadlines.
     joinTargets = new Set();
@@ -128,7 +130,6 @@ export default class Engine {
     // fitting turn (the model curated; a LATER overflow earns a fresh recovery) and at loop cleanup.
     #hardOverflowRecovery = new Set();
     #packets;
-    searchPrefetch;
     searchGate = new SearchGate();
     #proposals;
     #dispatcher;
@@ -142,11 +143,11 @@ export default class Engine {
     // (the steer's own advice is to wait; in-memory, fail-open on restart).
     #retrievalRefusalGrace = new Set();
     // §derivation-off-hot-path — the background derivation chain: the per-turn pump and the
-    // session warm ride it instead of the turn (a 2-CPU container CPU-embedding a 335-entry
+    // workspace warm ride it instead of the turn (a 2-CPU container CPU-embedding a 335-entry
     // ingest starved every loop for ~28min, #316). Serialized (never two pumps interleaved),
     // drained at daemon stop (never racing db close), failures logged (never swallowed).
     // A turn never waits on an embedding; a ~query warms its own candidate slice inline
-    // (§semantic-cold-query-full-fidelity), so cold sessions still get full-fidelity search.
+    // (§semantic-cold-query-full-fidelity), so cold workspaces still get full-fidelity search.
     #derivationChain = Promise.resolve();
     #queueDerivation(job) {
         const run = this.#derivationChain.then(job).catch((err) => {
@@ -160,14 +161,15 @@ export default class Engine {
         await this.#derivationChain;
     }
     #streamEventNotify;
-    #wakeRunNotify;
+    #wakeWorkerNotify;
     // Cached plurnk GBNF — read once on the first constrained generate (#189).
     #gbnfCache = new Map(); // variant name -> GBNF text (per-alias selection, #353)
-    constructor({ db, schemes, mimetypes, streamEventNotify, wakeRunNotify, injectRun, cancelRun, telemetryEventNotify, tokenize }) {
+    #railAnnounced = new Set(); // #488 — one rail-state line per alias, positive drill-visible signal
+    constructor({ db, schemes, mimetypes, streamEventNotify, wakeWorkerNotify, injectWorker, cancelWorker, telemetryEventNotify, tokenize }) {
         this.#db = db;
         this.#schemes = schemes;
         this.#streamEventNotify = streamEventNotify;
-        this.#wakeRunNotify = wakeRunNotify;
+        this.#wakeWorkerNotify = wakeWorkerNotify;
         // Default to empty discovery — standalone Engine construction (in
         // tests) gets no handlers, and content flows through the framework's
         // raw-content fitContent fallback. Daemon-managed Engine receives a
@@ -184,12 +186,9 @@ export default class Engine {
         this.#telemetry = new TelemetryChannel({ db, notify: telemetryEventNotify });
         this.#strikes = new StrikeRail();
         this.#packets = new PacketBuilder({ db, schemes, telemetry: this.#telemetry, executors });
-        // §search-prefetch — the web-member sync pass; the daemon's wake handler drives it,
-        // the hold loop below honors it (holds() = a pass in flight for the run).
-        this.searchPrefetch = new SearchPrefetch({ db: this.#db, schemes: this.#schemes, tokenize: this.#tokenize });
         this.#proposals = new ProposalLifecycle({
             db, schemes, telemetry: this.#telemetry,
-            streamEventNotify, wakeRunNotify,
+            streamEventNotify, wakeWorkerNotify,
             tokenize: this.#tokenize, mimetypes: this.#mimetypes, executors, loopSignal,
         });
         this.#dispatcher = new Dispatcher({ searchGate: this.searchGate,
@@ -197,7 +196,7 @@ export default class Engine {
             tokenize: this.#tokenize,
             telemetry: this.#telemetry, proposals: this.#proposals,
             executors, loopSignal,
-            streamEventNotify, wakeRunNotify, injectRun, cancelRun,
+            streamEventNotify, wakeWorkerNotify, injectWorker, cancelWorker,
             parkDeadlines: this.parkDeadlines,
             joinTargets: this.joinTargets,
         });
@@ -238,18 +237,36 @@ export default class Engine {
         // that constrain sampling (llama-server, response_format backends); a cloud model that IGNORES the grammar
         // gets a filter-mode divergence event every turn for nothing. So the bare default is OFF
         // and the GBNF-capable aliases opt IN via a PLURNK_PROVIDERS_GBNF_<alias> suffix.
-        const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
+        // #488 — the rail must be VERIFIABLE, never silently off. Two guards:
+        // (1) the alias fallback is only trusted when NO per-alias GBNF opt-ins exist: an
+        //     unregistered provider in a process that configured suffixed rails could fall back
+        //     to a DIFFERENT active alias, miss the suffix, and run unconstrained — the silent
+        //     severance class run78 demonstrated (free decode, fabricated logs, CLEAN telemetry).
+        // (2) every resolution states itself ONCE on stderr — "grammar rail: <alias> → <variant>/OFF" —
+        //     so any drill capture positively shows rail state; absence of the line is greppable.
+        const registered = ProviderInstantiate.aliasOf(provider);
+        const fallback = registered === undefined ? resolveActiveAlias(process.env)?.alias : undefined;
+        if (registered === undefined && fallback === undefined && Object.keys(process.env).some((k) => k.startsWith("PLURNK_PROVIDERS_GBNF_"))) {
+            throw new Error("grammar rail: provider has no registered alias and no active alias resolves, while per-alias PLURNK_PROVIDERS_GBNF_* rails are configured — refusing to run unconstrained (#488).");
+        }
+        const alias = registered ?? fallback ?? "";
         const variant = scopeEnvToAlias(process.env, alias, ["PLURNK_PROVIDERS_GBNF"]).PLURNK_PROVIDERS_GBNF;
-        if (variant === undefined || variant === "" || variant === "0")
+        if (variant === undefined || variant === "" || variant === "0") {
+            if (!this.#railAnnounced.has(alias)) {
+                this.#railAnnounced.add(alias);
+                process.stderr.write(`plurnk-engine: grammar rail: ${alias || "(bare)"} → OFF (no PLURNK_PROVIDERS_GBNF for this alias)\n`);
+            }
             return undefined;
+        }
         const hit = this.#gbnfCache.get(variant);
         if (hit !== undefined)
             return hit;
         const path = variant.startsWith("/") || variant.startsWith(".")
             ? variant
             : fileURLToPath(import.meta.resolve(`@plurnk/plurnk-grammar/${variant}`));
-        const text = await readFile(path, "utf8");
+        const text = await readFile(path, "utf8"); // unresolvable/unreadable throws — a configured rail never silently degrades
         this.#gbnfCache.set(variant, text);
+        process.stderr.write(`plurnk-engine: grammar rail: ${alias || "(bare)"} → ${variant} (${text.length} chars)\n`);
         return text;
     }
     // Per-loop usage totals (#197): SUM the loop's turns (usage is stored per
@@ -272,7 +289,7 @@ export default class Engine {
             // summed promptTokens above, which overcounts a context that grows across turns.
             contextTokens: row?.context ?? 0,
             // #274 — the last turn's model window (denominator); null when the provider reports none.
-            contextSize: row?.context_size ?? null,
+            promptBudget: row?.context_size ?? null,
             // #252 — the latest turn's opaque provider blob, parsed for the wire. Empty {} when the
             // provider returned no meta. The service forwards it; it never reads a field within.
             meta: JSON.parse(row?.meta ?? "{}"),
@@ -298,7 +315,7 @@ export default class Engine {
         }
         return { line, column };
     }
-    async runLoop({ provider, messages, requirements = "", sessionId, runId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
+    async runLoop({ provider, messages, requirements = "", workspaceId, workerId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
         const turnIds = [];
         const suddenDeathThreshold = maxTurns - maxStrikes;
         // Per-loop AbortController for scheme-side cancellation propagation.
@@ -352,7 +369,7 @@ export default class Engine {
             if (row.status === 100) {
                 // NOT a terminal — a wake re-queued this loop while its own live drain was
                 // between turns (a child concluded in the gap between our 202 write and this
-                // check, §run-lifecycle-wake-requeue-not-terminal). The wake's intent is KEEP
+                // check, §worker-lifecycle-wake-requeue-not-terminal). The wake's intent is KEEP
                 // RUNNING: re-claim atomically and continue — the injected prompt is already
                 // this loop's next turn. Returning it as "external" broadcast a QUEUED loop
                 // as loop/terminated {finalStatus: 100} — the delegation-flags flake.
@@ -390,19 +407,19 @@ export default class Engine {
             const holdCapMs = Number(process.env.PLURNK_SERVICE_EXEC_HOLD_MS ?? "300000");
             if (holdSet.size > 0 && holdCapMs > 0 && execHandler?.hasActiveHoldSpawns !== undefined) {
                 const holdStart = Date.now();
-                while ((execHandler.hasActiveHoldSpawns(runId, holdSet) || this.searchPrefetch.holds(runId)) && Date.now() - holdStart < holdCapMs) {
+                while (execHandler.hasActiveHoldSpawns(workerId, holdSet) && Date.now() - holdStart < holdCapMs) {
                     await delay(150, undefined, { signal });
                 }
             }
             const execWaitMs = Number(process.env.PLURNK_SERVICE_EXEC_WAIT_MS ?? "0");
             if (execWaitMs > 0) {
-                if (execHandler?.hasActiveSpawns?.(runId) === true)
+                if (execHandler?.hasActiveSpawns?.(workerId) === true)
                     await delay(execWaitMs, undefined, { signal });
             }
             let turn;
             try {
                 turn = await this.runTurn({
-                    provider, messages, requirements, sessionId, runId, loopId, origin, signal, onDispatch,
+                    provider, messages, requirements, workspaceId, workerId, loopId, origin, signal, onDispatch,
                     turnNumber: turnIds.length + 1, maxTurns,
                 });
             }
@@ -449,7 +466,7 @@ export default class Engine {
             }
         }
     }
-    async runTurn({ provider, messages, requirements = "", sessionId, runId, loopId, origin = "model", signal, onDispatch, turnNumber = 1, maxTurns = 50, }) {
+    async runTurn({ provider, messages, requirements = "", workspaceId, workerId, loopId, origin = "model", signal, onDispatch, turnNumber = 1, maxTurns = 50, }) {
         // === Turn-as-container model ===
         //
         // Turn rows are created at runTurn OPEN (status=102, placeholder
@@ -462,8 +479,8 @@ export default class Engine {
         // writes consume low indices; model ops continue from there.
         const seqRow = await this.#db.engine_next_turn_sequence.get({ loop_id: loopId });
         const seq = seqRow.next;
-        // #269 — loops.sequence is the loop's ordinal WITHIN the run. Turn-0 foists that belong to the
-        // RUN (manifest preview, AGENTS, operator docs) gate on the run's FIRST loop, not every loop's
+        // #269 — loops.sequence is the loop's ordinal WITHIN the worker. Turn-0 foists that belong to the
+        // RUN (manifest preview, AGENTS, operator docs) gate on the worker's FIRST loop, not every loop's
         // first turn; per-loop foists (the prompt, @file) still fire each loop. Read once, turn-1 only.
         const loopRow = seq === 1
             ? await this.#db.engine_get_loop_prompt.get({ loop_id: loopId })
@@ -487,7 +504,7 @@ export default class Engine {
         // from sequence=2 onward on prompt-foisted turns; 1 onward
         // otherwise.
         let nextActionIndex = 1;
-        // §model-entry — the run's first turn opens with the model's own turn-0, mirrored OPEN: a
+        // §model-entry — the worker's first turn opens with the model's own turn-0, mirrored OPEN: a
         // worked turn PLAN → the environment FINDs the foist ACTUALLY dispatches → SEND[102]. Built
         // from the real ops below (not a static print — we lean into the genuine echo paradigm) and
         // written at sequence 1, so it reads first as the emission with the foisted results following.
@@ -496,15 +513,15 @@ export default class Engine {
             if (runFirstLoop)
                 nextActionIndex = 2; // reserve sequence 1 for the turn-0 echo
             // Operator doc READs (PLURNK_SERVICE_MD_<ALIAS>, §actor-boundary-doc-injection). The docs were materialized
-            // as plurnk:///<entry> entries by the plurnk run (loop_run, via the
+            // as plurnk:///<entry> entries by the plurnk worker (loop_run, via the
             // §actor-boundary keystone); foist a READ of each into THIS turn-0 so the model
             // reads them inline. It sees only the READ — the materializing EDIT
-            // lives in the plurnk run's log, never the model's.
-            // #231 — env docs (PLURNK_SERVICE_MD_*) UNION the session's client docs; foist a READ of
+            // lives in the plurnk worker's log, never the model's.
+            // #231 — env docs (PLURNK_SERVICE_MD_*) UNION the workspace's client docs; foist a READ of
             // each materialized plurnk:///<alias>.md (loop_run materialized the same set).
-            const { mdDocs } = await SessionSettings.read(this.#db, sessionId);
-            // #269 — operator docs are run-once; foist them only on the run's first loop.
-            for (const doc of runFirstLoop ? await SessionSettings.resolveDocs(mdDocs) : []) {
+            const { mdDocs } = await WorkspaceSettings.read(this.#db, workspaceId);
+            // #269 — operator docs are run-once; foist them only on the worker's first loop.
+            for (const doc of runFirstLoop ? await WorkspaceSettings.resolveDocs(mdDocs) : []) {
                 const docTarget = {
                     kind: "url", raw: `plurnk:///${doc.entryName}`, scheme: "plurnk",
                     username: null, password: null, hostname: null, port: null,
@@ -515,7 +532,7 @@ export default class Engine {
                     lineMarker: null, body: null, position: { line: 1, column: 1 },
                 };
                 await this.dispatch({
-                    statement: docRead, sessionId, runId, loopId, turnId,
+                    statement: docRead, workspaceId, workerId, loopId, turnId,
                     sequence: nextActionIndex, origin: "plurnk", onDispatch,
                 });
                 nextActionIndex++;
@@ -523,7 +540,7 @@ export default class Engine {
             const promptRow = loopRow; // #269 — already read above (per-loop; fires every loop's turn 1)
             if (promptRow !== undefined && typeof promptRow.prompt === "string" && promptRow.prompt.length > 0) {
                 const promptLoopSeq = promptRow.sequence; // the loop's PER-RUN sequence — model-facing, matching log coordinates (owner: the db id read as prompt/2/1)
-                const promptPath = promptTarget(runId, promptLoopSeq, seq);
+                const promptPath = promptTarget(workerId, promptLoopSeq, seq);
                 const promptStmt = {
                     op: "EDIT", suffix: "", signal: null,
                     target: promptPath, lineMarker: null,
@@ -531,7 +548,7 @@ export default class Engine {
                 };
                 let promptLogId;
                 await this.dispatch({
-                    statement: promptStmt, sessionId, runId, loopId, turnId,
+                    statement: promptStmt, workspaceId, workerId, loopId, turnId,
                     sequence: nextActionIndex, origin: "plurnk",
                     onDispatch: (id) => { promptLogId = id; onDispatch?.(id); },
                 });
@@ -545,14 +562,19 @@ export default class Engine {
                 // when it runs fewer than 12 (whole-read form doubles as teaching). Prior prompts
                 // stay listed by path in the system packet's User Prompts section — reachable,
                 // never silently lost.
+                // §arrival-law (#499) — the preview bound is the knob (was a hardcoded 12). The
+                // line-slice is an EFFICIENCY (do not materialize hundreds of lines into rx); the
+                // RENDER is the law — packet-wire's arrival preview cuts the char dimension there,
+                // which a line marker structurally cannot (a 1-line slice of a 1-line bomb is 416).
+                const previewLines = Number(process.env.PLURNK_SERVICE_ARRIVAL_PREVIEW_LINES ?? "16");
                 const promptLineCount = promptRow.prompt.split("\n").length;
                 const promptRead = {
                     op: "READ", suffix: "", signal: null, target: promptPath,
-                    lineMarker: { marks: promptLineCount >= 12 ? [1, 12] : [1, -1] },
+                    lineMarker: { marks: promptLineCount >= previewLines ? [1, previewLines] : [1, -1] },
                     body: null, position: { line: 1, column: 1 },
                 };
                 await this.dispatch({
-                    statement: promptRead, sessionId, runId, loopId, turnId,
+                    statement: promptRead, workspaceId, workerId, loopId, turnId,
                     sequence: nextActionIndex, origin: "plurnk", onDispatch,
                 });
                 nextActionIndex++;
@@ -564,18 +586,18 @@ export default class Engine {
         if (seq > 1) {
             const loopSeqRow = await this.#db.engine_loop_sequence.get({ loop_id: loopId });
             const loopSeq = loopSeqRow?.sequence ?? loopId;
-            const injected = await this.#db.drain_get_all_prompt_bodies_for_loop.all({ pattern: promptPathname(runId, loopSeq, seq) });
+            const injected = await this.#db.drain_get_all_prompt_bodies_for_loop.all({ pattern: promptPathname(workerId, loopSeq, seq) });
             const injectedRow = injected.find((r) => typeof r.content === "string" && r.content.length > 0);
             if (injectedRow !== undefined) {
                 const lineCount = injectedRow.content.split("\n").length;
-                const injTarget = promptTarget(runId, loopSeq, seq);
+                const injTarget = promptTarget(workerId, loopSeq, seq);
                 const injRead = {
                     op: "READ", suffix: "", signal: null, target: injTarget,
                     lineMarker: { marks: lineCount >= 12 ? [1, 12] : [1, -1] },
                     body: null, position: { line: 1, column: 1 },
                 };
                 await this.dispatch({
-                    statement: injRead, sessionId, runId, loopId, turnId,
+                    statement: injRead, workspaceId, workerId, loopId, turnId,
                     sequence: nextActionIndex, origin: "plurnk", onDispatch,
                 });
                 nextActionIndex++;
@@ -585,46 +607,46 @@ export default class Engine {
         // every entry's deep channels (symbols/refs/embeddings/FTS, deep_hash-gated) so the
         // catalog and FIND read current data. NOT an action: no log entry, no sequence slot,
         // not dispatched. There is no plurnk:///manifest.json entry — the catalog is served
-        // on demand by FIND(scheme:///**), foisted into the run's first turn below.
+        // on demand by FIND(scheme:///**), foisted into the worker's first turn below.
         // #312 — the turn's token gauge: the ACTIVE provider's tokenizer identity + exact counter
         // (mimetypes seam; provider upper bound surfaced as tokenizer_unavailable when inexact).
         // Threaded per turn — never engine state — so concurrent loops on different providers
         // each read their own honest numbers.
         const systemCtx = {
-            db: this.#db, sessionId, runId, loopId, turnId,
+            db: this.#db, workspaceId, workerId, loopId, turnId,
             writer: "plurnk",
             signal: this.#loopAborts.get(loopId)?.signal,
             streamEventNotify: this.#streamEventNotify,
-            wakeRunNotify: this.#wakeRunNotify,
+            wakeWorkerNotify: this.#wakeWorkerNotify,
             tokenize: this.#tokenize,
             mimetypes: this.#mimetypes,
             defaultChannelFor: (s) => this.#schemes.defaultChannelFor(s),
-            pushTelemetry: (event) => this.#telemetry.push(sessionId, loopId, event),
+            pushTelemetry: (event) => this.#telemetry.push(workspaceId, loopId, event),
         };
         // SPEC §membership D4/D5 — git-ls-files workspace membership, resolved at
         // prompt-composition (EMI is eager + exhaustive — git is the only bound). When the
-        // session's project_root is a git working tree, tracked files are
+        // workspace's project_root is a git working tree, tracked files are
         // members without a client `add`; active members are materialized
         // (disk → body channel) so they appear in the catalog. No-ops
-        // on headless / non-git sessions. Runs BEFORE the derivation pump so
+        // on headless / non-git workspaces. Runs BEFORE the derivation pump so
         // this turn's packet reflects them.
         const fsDivergences = await GitMembership.indexGitMembership(systemCtx);
-        await this.#logFsFictions(sessionId, fsDivergences);
+        await this.#logFsFictions(workspaceId, fsDivergences);
         this.#queueDerivation(() => EntryManifest.maintainDerivations(systemCtx)); // §derivation-off-hot-path — the turn proceeds; ~queries warm their own slice
         // Turn-0 catalog preview (PLURNK_SERVICE_FILES_ITEMS, §actor-boundary-catalog-preview):
-        // one FIND(scheme:///**) per scheme that holds entries, foisted into the run's first
+        // one FIND(scheme:///**) per scheme that holds entries, foisted into the worker's first
         // model turn so it opens with its catalog (the per-scheme arrays that replaced the
         // single manifest.json). -1 → each scheme's whole catalog; N → its first N rows
         // (clamped to the scheme's count so FIND's strict <L> never 416s); off by default.
         if (seq === 1) {
-            // #231 — a session's client-chosen filesItems REPLACES the env default outright.
-            const { filesItems: sessionMI } = await SessionSettings.read(this.#db, sessionId);
-            const filesItems = sessionMI !== null ? normalizeFilesItems(sessionMI) : readFilesItems();
+            // #231 — a workspace's client-chosen filesItems REPLACES the env default outright.
+            const { filesItems: workspaceMI } = await WorkspaceSettings.read(this.#db, workspaceId);
+            const filesItems = workspaceMI !== null ? normalizeFilesItems(workspaceMI) : readFilesItems();
             if (filesItems !== null && runFirstLoop) { // #269 — catalog preview is run-once
-                // engine_scheme_catalog_summary is the scheme source: session-scoped, ordered,
+                // engine_scheme_catalog_summary is the scheme source: workspace-scoped, ordered,
                 // one row per scheme that has entries (scheme=null → file). log:// is absent —
                 // it lives in log_entries, not the catalog (present-mode, the # Log section).
-                const catalogSchemes = await this.#db.engine_scheme_catalog_summary.all({ session_id: sessionId });
+                const catalogSchemes = await this.#db.engine_scheme_catalog_summary.all({ workspace_id: workspaceId });
                 // known:/// + unknown:/// + file ALWAYS foist, even at zero entries — else the
                 // model burns a turn running the FIND itself, assuming the catalog is merely
                 // being withheld. An empty FIND(**) is orienting, not noise (owner): it tells
@@ -666,7 +688,7 @@ export default class Engine {
                         position: { line: 1, column: 1 },
                     };
                     await this.dispatch({
-                        statement: catalogFind, sessionId, runId, loopId, turnId,
+                        statement: catalogFind, workspaceId, workerId, loopId, turnId,
                         sequence: nextActionIndex, origin: "plurnk", onDispatch,
                     });
                     nextActionIndex++;
@@ -674,21 +696,21 @@ export default class Engine {
                     // own survey, mirrored OPEN). The <L> cap rides as `<1,N>`, exactly as the model would type it.
                     turnZeroMoves.push(`<<FIND(${isPlurnk ? "plurnk://docs/**" : isFile ? "**" : `${schemeName}:///**`})${cap === null ? "" : `<1,${cap}>`}::FIND`);
                 }
-                // §run-scheme — Manifest(run) = session-scope ∪ THIS run's run-scope. Foist the
-                // building run's OWN scratch (run://self/**, uncapped — a run needs the full view to
+                // §worker-scheme — Manifest(run) = workspace-scope ∪ THIS worker's worker-scope. Foist the
+                // building worker's OWN scratch (worker://self/**, uncapped — a worker needs the full view to
                 // manage its private workspace) so it's catalogued in ITS perspective alone; other
-                // runs reach it only via explicit FIND(run://<name>/**). A run with no scratch foists nothing.
-                const selfRun = await this.#db.run_name_by_id.get({ run_id: runId });
-                const scratch = selfRun === undefined ? 0 : (await this.#db.engine_run_scratch_count.get({ session_id: sessionId, owner_prefix: `/${selfRun.name}/*` }))?.entries ?? 0;
+                // runs reach it only via explicit FIND(worker://<name>/**). A worker with no scratch foists nothing.
+                const selfWorker = await this.#db.worker_name_by_id.get({ worker_id: workerId });
+                const scratch = selfWorker === undefined ? 0 : (await this.#db.engine_worker_scratch_count.get({ workspace_id: workspaceId, owner_prefix: `/${selfWorker.name}/*` }))?.entries ?? 0;
                 if (scratch > 0) {
                     const runFind = {
                         op: "FIND", suffix: "", signal: null,
-                        target: { kind: "url", raw: "run://self/**", scheme: "run", username: null, password: null, hostname: "self", port: null, pathname: "/**", params: {}, fragment: null },
+                        target: { kind: "url", raw: "worker://self/**", scheme: "worker", username: null, password: null, hostname: "self", port: null, pathname: "/**", params: {}, fragment: null },
                         body: null, lineMarker: null, position: { line: 1, column: 1 },
                     };
-                    await this.dispatch({ statement: runFind, sessionId, runId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
+                    await this.dispatch({ statement: runFind, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
                     nextActionIndex++;
-                    turnZeroMoves.push("<<FIND(run://self/**)::FIND"); // §model-entry — the run-scope survey, into the turn-0 echo
+                    turnZeroMoves.push("<<FIND(worker://self/**)::FIND"); // §model-entry — the worker-scope survey, into the turn-0 echo
                 }
             }
             // #260 — foist a turn-0 READ of each client-passed @file path so its content sits in front
@@ -707,7 +729,7 @@ export default class Engine {
                     body: null, position: { line: 1, column: 1 },
                 };
                 await this.dispatch({
-                    statement: fileRead, sessionId, runId, loopId, turnId,
+                    statement: fileRead, workspaceId, workerId, loopId, turnId,
                     sequence: nextActionIndex, origin: "plurnk", onDispatch,
                 });
                 nextActionIndex++;
@@ -718,34 +740,34 @@ export default class Engine {
             // so the grammar can stay thin. Subsequent turns mirror the model's real output, folded.
             if (runFirstLoop) {
                 const emission = ["<<PLAN:Initialize:PLAN", ...turnZeroMoves, "<<SEND[102]:Initialized:SEND"].join("\n");
-                await this.#dispatcher.writeModelEntry({ verbatim: emission, runId, loopId, turnId, sequence: 1, folded: false, origin: "plurnk" });
+                await this.#dispatcher.writeModelEntry({ verbatim: emission, workerId, loopId, turnId, sequence: 1, folded: false, origin: "plurnk" });
             }
         }
-        // §env-delta — pre-seed the run's ambient observations (what changed since
+        // §env-delta — pre-seed the worker's ambient observations (what changed since
         // it last looked) as foisted rows before the packet composes; advance the action index
         // past them so model ops continue after. Two instances of one machine: env-delta (sibling
         // edits · timestamp cursor · always folded) and exec streams (channel bytes · byte cursor ·
         // terminal delta opens). §env-delta §exec-stream
-        // §exec-poll — EXEC `<0>` is turn-scoped: reap the run's open turn-scoped streams (necessarily
+        // §exec-poll — EXEC `<0>` is turn-scoped: reap the worker's open turn-scoped streams (necessarily
         // from a prior turn — this runs before the turn's own spawns) so a `<0>` never survives into
         // the subsequent turn. The terminal output then surfaces born-OPEN via the stream-delta path.
-        await this.#reapTurnScopedStreams(runId);
-        nextActionIndex += await this.#materializeEnvironmentDeltas({ sessionId, runId, loopId, turnId, fromSequence: nextActionIndex });
-        nextActionIndex += await this.#materializeStreamDeltas({ runId, loopId, turnId, fromSequence: nextActionIndex });
+        await this.#reapTurnScopedStreams(workerId);
+        nextActionIndex += await this.#materializeEnvironmentDeltas({ workspaceId, workerId, loopId, turnId, fromSequence: nextActionIndex });
+        nextActionIndex += await this.#materializeStreamDeltas({ workerId, loopId, turnId, fromSequence: nextActionIndex });
         // SPEC §telemetry — git working-tree state for the telemetry section, read once
         // (a service-side `git status` shell-out) and threaded into the budget
         // rebuild too so it isn't re-shelled on overflow.
-        const gitStatus = await GitState.status(this.#db, sessionId, this.#loopAborts.get(loopId)?.signal);
+        const gitStatus = await GitState.status(this.#db, workspaceId, this.#loopAborts.get(loopId)?.signal);
         // Build the spec'd packet (Packet.json) request half. The log build
-        // queries log_entries scoped to the run — the prompt entry just
+        // queries log_entries scoped to the worker — the prompt entry just
         // written (if turn 1) is part of that query result.
         let requestPacket = await this.#packets.buildRequestPacket({
-            initialMessages: messages, requirements, sessionId, runId, loopId,
+            initialMessages: messages, requirements, workspaceId, workerId, loopId,
             currentTurnSeq: seq, provider, gitStatus,
         });
         // SPEC §grinder — budget grinder, pre-LLM: reclaim window on actual overflow.
         const enforced = await this.#packets.enforceBudget({
-            packet: requestPacket, provider, runId, loopId, turnId,
+            packet: requestPacket, provider, workerId, loopId, turnId,
             // The overflow error row is minted at the turn's running sequence (nextActionIndex), pre-generate;
             // runTurn advances the counter past it below so the post-generate dispatch rows never collide.
             mintSequence: nextActionIndex,
@@ -753,7 +775,7 @@ export default class Engine {
             // overflow row just minted surfaces THIS turn (§grinder-overflow-error-row). Safe: the
             // ephemeral buffer is empty pre-generate (events drain on the next turn's build).
             rebuild: () => this.#packets.buildRequestPacket({
-                initialMessages: messages, requirements, sessionId, runId, loopId,
+                initialMessages: messages, requirements, workspaceId, workerId, loopId,
                 currentTurnSeq: seq, provider, gitStatus,
             }),
         });
@@ -771,13 +793,13 @@ export default class Engine {
             // overflow terminates 413 — death only after the model was told. Physically
             // unsendable (over the provider's real window too) → 413 immediately; physics
             // doesn't negotiate. The pointer stays at 100% of budget — a margin would mask it.
-            const physicallySendable = provider.contextSize === null
+            const physicallySendable = provider.contextWindow === null
                 ? true
-                : this.#packets.exactPacketTokens(requestPacket, provider) <= provider.contextSize - this.#packets.decodeBudget(provider);
+                : this.#packets.exactPacketTokens(requestPacket, provider) <= provider.contextWindow - (this.#packets.maxTokensFor(provider) ?? 0);
             if (physicallySendable && !this.#hardOverflowRecovery.has(loopId)) {
                 this.#hardOverflowRecovery.add(loopId);
                 await this.#db.engine_insert_log_entry.get({
-                    run_id: runId, loop_id: loopId, turn_id: turnId, sequence: nextActionIndex++,
+                    worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: nextActionIndex++,
                     origin: "model", source: "engine", op: "error", suffix: "", signal: null,
                     scheme: null, username: null, password: null, hostname: null, port: null,
                     pathname: null, params: null, fragment: null, lineMarker: null,
@@ -790,7 +812,7 @@ export default class Engine {
                 // errors sections (the same re-derive contract the soft grind uses).
                 nextActionIndex += 1;
                 requestPacket = await this.#packets.buildRequestPacket({
-                    initialMessages: messages, requirements, sessionId, runId, loopId,
+                    initialMessages: messages, requirements, workspaceId, workerId, loopId,
                     currentTurnSeq: seq, provider, gitStatus,
                 });
             }
@@ -801,7 +823,7 @@ export default class Engine {
                 await this.#db.engine_close_turn.run({
                     id: turnId, status: 413, packet: JSON.stringify(hardPacket),
                     usage_prompt: 0, usage_completion: 0, usage_reasoning: 0, usage_cached: 0, usage_cost_pico: 0,
-                    usage_context_size: this.#packets.promptBudgetFor(provider), // #274 — the PROMPT BUDGET (window − reserves), even on a hard-413 turn: the gauge denominator the packet actually lives under
+                    usage_prompt_budget: this.#packets.promptBudgetFor(provider), // #274 — the PROMPT BUDGET (window − reserves), even on a hard-413 turn: the gauge denominator the packet actually lives under
                     finish_reason: "budget_hard_stop", model: provider.model, meta: "{}",
                 });
                 return { turnId, status: 413, statuses: [], fingerprint: "", budgetStruck: enforced.struck, budgetHardStop: true, steerStruck: false };
@@ -817,7 +839,7 @@ export default class Engine {
         // the input under the ceiling); the model's decode — reasoning + emission — is
         // out of band, owned by the provider's own context window. Deriving a maxTokens
         // from our budget conflated the two and guillotined a reasoning model's
-        // out-of-band thinking as the packet filled (`ceiling - packet` → near-zero
+        // out-of-band reasoning as the packet filled (`ceiling - packet` → near-zero
         // decode → finish=length mid-reasoning → no emission → strike spiral). The
         // provider enforces its physical wall on its own.
         let response;
@@ -827,8 +849,8 @@ export default class Engine {
         // #249 — tag the loop (the activity) with its active plugins' attribution tags, write-once.
         if (attributions.length > 0)
             await this.#db.engine_tag_loop_attributions.run({ loop_id: loopId, attributions: JSON.stringify(attributions) });
-        // #249 — session-stable frontend id, forwarded as Plurnk-Client by the plurnk provider only.
-        const { client } = await SessionSettings.read(this.#db, sessionId);
+        // #249 — workspace-stable frontend id, forwarded as Plurnk-Client by the plurnk provider only.
+        const { client } = await WorkspaceSettings.read(this.#db, workspaceId);
         try {
             // §turn-lifecycle (#301) — the provider call is the long, opaque window (submit → first
             // committed op is provider latency + a full first-turn generation, ~70s local): a static
@@ -837,13 +859,19 @@ export default class Engine {
             // ops are about to land. Base telemetry/event channel (the embed_progress precedent, §tokenomics
             // clients already render it unconditionally); the abort guard keeps a cancelled loop silent.
             if (!signal?.aborted)
-                this.#telemetry.push(sessionId, loopId, { source: "engine:turn", kind: "turn_awaiting_model", level: "info", message: "awaiting model response" });
+                this.#telemetry.push(workspaceId, loopId, { source: "engine:turn", kind: "turn_awaiting_model", level: "info", message: "awaiting model response" });
             // generate rides the LOOP signal (already chained from the caller's), so a loop-level
             // abort — the §operator-config-loop-timeout wall — cancels a stuck provider call, not
             // just the schemes. Bare runTurn (no runLoop) has no loop entry → the caller's signal.
-            response = await provider.generate({ messages: modelMessages, runId: String(runId), signal: this.#loopAborts.get(loopId)?.signal ?? signal, grammar: await this.#grammarConstraint(provider), maxTokens: this.#packets.decodeBudget(provider), strikes: this.#strikes.streak(loopId), attributions: attributions.length > 0 ? attributions : undefined, client: client ?? undefined }); // strikes: first-party routing signal, 0 sent explicitly (#313) // §provider-surface-generate §provider-guarantees-single-call §provider-guarantees-signal-wired §attribution-plurnk-namespace-reserved §client-telemetry
+            // #391 — the turn COORDINATE (workspace + loop-seq/turn-seq of the turn being generated)
+            // rides as first-party metadata (Plurnk-Workspace-Id/Loop/Turn) so the endpoint flywheel keys
+            // on an AUTHORITATIVE hierarchy, not a scraped context-log approximation. The daemon owns
+            // the value; providers stamps the header (same split as Run-Id, #26). loopSeq (the 1-based
+            // coordinate, not the DB id) resolves the same way the prompt-slot path does (§log coords).
+            const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
+            response = await provider.generate({ messages: modelMessages, workerId: String(workerId), signal: this.#loopAborts.get(loopId)?.signal ?? signal, grammar: await this.#grammarConstraint(provider), maxTokens: this.#packets.maxTokensFor(provider) ?? undefined, strikes: this.#strikes.streak(loopId), attributions: attributions.length > 0 ? attributions : undefined, client: client ?? undefined, workspaceId: String(workspaceId), loop: loopSeq, turn: seq }); // strikes: first-party routing signal, 0 sent explicitly (#313) // §provider-surface-generate §provider-guarantees-single-call §provider-guarantees-signal-wired §attribution-plurnk-namespace-reserved §client-telemetry
             if (!signal?.aborted)
-                this.#telemetry.push(sessionId, loopId, { source: "engine:turn", kind: "turn_generated", level: "info", message: "parsing model response" });
+                this.#telemetry.push(workspaceId, loopId, { source: "engine:turn", kind: "turn_generated", level: "info", message: "parsing model response" });
         }
         catch (err) {
             // §turn-never-blank — a ProviderError is an INFRASTRUCTURE failure (auth, network
@@ -857,7 +885,7 @@ export default class Engine {
             // adjudication into a model-behavior 422 — a state the system otherwise forbids,
             // a record that lied, and days of forensics pointed at the wrong suspect.
             if (err instanceof ProviderError) {
-                this.#telemetry.push(sessionId, loopId, { source: "provider", kind: err.kind, message: err.message, level: "error" });
+                this.#telemetry.push(workspaceId, loopId, { source: "provider", kind: err.kind, message: err.message, level: "error" });
             }
             throw err;
         }
@@ -893,7 +921,7 @@ export default class Engine {
             const located = typeof event.position === "number"
                 ? this.#offsetToLineColumn(packetAssistant.content, event.position)
                 : null;
-            this.#telemetry.push(sessionId, loopId, {
+            this.#telemetry.push(workspaceId, loopId, {
                 source: event.source,
                 kind: event.kind,
                 message: event.message ?? "",
@@ -931,8 +959,14 @@ export default class Engine {
             : realOpsCount === 0 ? TURN_STATUS_NO_OPS : TURN_STATUS_IMPLICIT_CONTINUE;
         // Idle turn: an implicit-continue (102) that did no WORK — its ops are only PLAN/SEND, no mid op.
         // The model continued with nothing to do. (Skipped when premature already steered this turn.)
+        // #467 (owner criterion) — a turn whose op ATTEMPTS died at the parser is a FAILED-RETRIEVAL
+        // turn, not an idle one: the model performed an op; the op died. The root parse-400 speaks
+        // alone; stacking the idle-409 on it calls the turn something it factually wasn't (run65's
+        // one malformed FIND minted two error rows for one accident). A dispatched-but-failed op is
+        // already a mid op, so only the parse-emptied class needs the deference. GBNF makes the
+        // emitted-idle shape unemittable (grammar SPEC, no-idle-102); this 409 stays the truly-idle backstop.
         const midOpsCount = packetAssistant.ops.filter((op) => op.op !== "PLAN" && op.op !== "SEND").length;
-        if (!steerStruck && turnStatus === TURN_STATUS_IMPLICIT_CONTINUE && midOpsCount === 0) {
+        if (!steerStruck && turnStatus === TURN_STATUS_IMPLICIT_CONTINUE && midOpsCount === 0 && parseErrors.length === 0) {
             // One grace turn after a retrieval-only 409 (admins specimen): the refusal steer says
             // "continuing in order to receive results" — a model that obediently waits one bare
             // [102] turn is following OUR advice, and the idle rail was executing it for that.
@@ -960,7 +994,7 @@ export default class Engine {
             usage_reasoning: usage.reasoning,
             usage_cached: usage.cached,
             usage_cost_pico: provider.costFor(usage), // §provider-surface-costfor
-            usage_context_size: this.#packets.promptBudgetFor(provider), // #274 — the PROMPT BUDGET (window − reserves): the raw n_ctx overstated usable room by the reserve total
+            usage_prompt_budget: this.#packets.promptBudgetFor(provider), // #274 — the PROMPT BUDGET (window − reserves): the raw n_ctx overstated usable room by the reserve total
             finish_reason: finishReason,
             model,
             // #252 — opaque provider→client metadata passthrough (e.g. balancePico the
@@ -970,15 +1004,13 @@ export default class Engine {
         // Dispatch model ops starting at nextActionIndex (continues the
         // turn's running counter after any pre-model writes).
         //
-        // Max-commands cap: a single emission with more than `maxCommands`
-        // ops is the runaway-loop fingerprint observed in pathological cases
-        // (html-attrs demo: 635 ops in one turn). Cap dispatches at the
-        // configured limit; overflow ops are dropped without per-op log
-        // entries (avoids bloating forensics with hundreds of identical refusals)
-        // and the model gets a single telemetry signal next packet so it knows
-        // its emission was truncated.
-        // #232 — a session's maxCommands is a tighten-only ceiling: min() the env ceiling.
-        const maxCommands = Math.min(readMaxCommands(), (await SessionSettings.read(this.#db, sessionId)).maxCommands ?? Number.POSITIVE_INFINITY);
+        // Max-commands ceiling: OFF by default (unlimited) — every generated op dispatches.
+        // A degenerate op-loop is a sampler failure guarded at generation, not by dropping
+        // already-generated work post-hoc. The ceiling is an OPT-IN operator/client bound:
+        // when set, overflow ops drop without per-op log entries (no forensics flood) and the
+        // model gets one telemetry signal next packet.
+        // #232 — a workspace's maxCommands is a tighten-only ceiling: min() the env ceiling.
+        const maxCommands = Math.min(readMaxCommands(), (await WorkspaceSettings.read(this.#db, workspaceId)).maxCommands ?? Number.POSITIVE_INFINITY);
         // PLAN (reasoning) and a terminal SEND (signal ≥ 200, the conclusion) are not
         // actions — they always dispatch and never count against the cap. maxCommands
         // bounds real actions only; maxCommands:0 still admits a plan and a conclusion
@@ -995,7 +1027,7 @@ export default class Engine {
         let rowSeq = nextActionIndex;
         for (const statement of opsToDispatch) {
             const result = await this.dispatch({
-                statement, sessionId, runId, loopId, turnId,
+                statement, workspaceId, workerId, loopId, turnId,
                 sequence: rowSeq,
                 origin, onDispatch,
                 // §send-200-failed-ops — parse errors mint as rows AFTER this loop; the terminal
@@ -1036,25 +1068,33 @@ export default class Engine {
         if (droppedCount > 0)
             pendingEngineErrors.push("max_commands_exceeded");
         for (const kind of pendingEngineErrors)
-            await this.#telemetry.mintEngineError(kind, { runId, loopId, turnId, sequence: errSeq++ });
+            await this.#telemetry.mintEngineError(kind, { workerId, loopId, turnId, sequence: errSeq++ });
         // §log-row-self-explains (Q2, owner-clarified) — a model-op failure is the MODEL'S OWN op
         // result: the op row carries its failure message on its meta line (packet-wire), and the
         // errors section points at the row. No separate minted item (the retired action_failure
         // mint dressed op results as source:"engine" faults — the jumbo model chased a phantom
         // "engine run 400 error" off a message-less item). Genuine engine-internal faults CRASH
         // (fail-hard, §turn-never-blank) and never mint model-facing rows.
-        // §tokenomics-output-truncated (#351) — packet honesty at the completion cap: a
-        // finish=length turn was GUILLOTINED mid-emission, and its parse errors are truncation
-        // ARTIFACTS. This one MINTS (actionless — no op row exists to self-explain): the cause
-        // must lead the artifact rows it explains, or the model fixes syntax forever.
-        if (finishReason === "length" && (parseErrors?.length ?? 0) > 0) {
+        // §tokenomics-output-truncated — packet honesty at the completion cap: a finish=length turn was
+        // GUILLOTINED at the decode pool, and this actionless row MINTS to LEAD the artifact rows it
+        // explains (the cause must lead, or the model fixes syntax forever). Two shapes, honestly
+        // distinguished: content cut MID-OP (a valid prefix dispatched; the parse errors are the
+        // severed tail) vs the pool consumed with NOTHING emitted (reasoning ran away — the parse
+        // 'must begin with PLAN' is an artifact of the empty emission, not a malformed turn). The parse
+        // rows below STAY (the record never hides); the 413 leads and frames them for what they are.
+        const truncatedEmpty = finishReason === "length" && packetAssistant.content.trim().length === 0;
+        if (finishReason === "length" && (truncatedEmpty || (parseErrors?.length ?? 0) > 0)) {
+            const cap = this.#packets.maxTokensFor(provider);
+            const message = truncatedEmpty
+                ? `output truncated at the completion cap (${cap} tokens): nothing was emitted before the pool was consumed — the parse error below is an artifact of the empty emission, not a malformed turn`
+                : `output truncated at the completion cap (${cap} tokens): the emission was cut mid-op — the parse errors below are truncation artifacts`;
             await this.#db.engine_insert_log_entry.get({
-                run_id: runId, loop_id: loopId, turn_id: turnId, sequence: errSeq++,
+                worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: errSeq++,
                 origin: "model", source: "engine", op: "error", suffix: "", signal: null,
                 scheme: null, username: null, password: null, hostname: null, port: null,
                 pathname: null, params: null, fragment: null, lineMarker: null,
                 tx: "", mimetype_tx: "text/plain",
-                rx: JSON.stringify({ status: 413, kind: "output_truncated", message: `output truncated at the completion cap (${this.#packets.decodeBudget(provider)} tokens) mid-emission — the parse errors below are truncation artifacts; emit fewer ops per turn and continue` }),
+                rx: JSON.stringify({ status: 413, kind: "output_truncated", message }),
                 mimetype_rx: "application/json", status_rx: 413, tokens: 0, state: "failed", outcome: "output_truncated",
                 attrs: "{}",
             });
@@ -1063,7 +1103,7 @@ export default class Engine {
         // resolved against the model's folded mirror row (§model-entry) — origin 'model', not engine.
         for (const { message, line, column, source } of parseErrors ?? []) {
             await this.#db.engine_insert_log_entry.get({
-                run_id: runId, loop_id: loopId, turn_id: turnId, sequence: errSeq++,
+                worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: errSeq++,
                 origin: "model", source: "grammar", op: "error", suffix: "", signal: null,
                 scheme: null, username: null, password: null, hostname: null, port: null,
                 pathname: null, params: null, fragment: null, lineMarker: null,
@@ -1084,8 +1124,9 @@ export default class Engine {
         // else does: the model that cares READs the folded row at the lines it wants — and can
         // introspect any prior emission of its own the same way. Empty emissions (a struck/
         // silent turn) write nothing — no prior output to mirror.
-        if (packetAssistant.content.trim().length > 0) {
-            await this.#dispatcher.writeModelEntry({ verbatim: packetAssistant.content, runId, loopId, turnId, sequence: errSeq++, folded: true });
+        const sealed = response.assistant.reasoningEncrypted;
+        if (packetAssistant.content.trim().length > 0 || (sealed !== undefined && sealed.length > 0)) {
+            await this.#dispatcher.writeModelEntry({ verbatim: packetAssistant.content, workerId, loopId, turnId, sequence: errSeq++, folded: true, ...(sealed !== undefined && sealed.length > 0 ? { reasoningEncrypted: sealed } : {}) });
         }
         // Zero ops is NOT an error to report — the model knows it emitted
         // nothing. Strike accounting (engine-internal) treats it as a
@@ -1159,40 +1200,40 @@ export default class Engine {
     }
     // #note12 — the daughter-provided reference docs (schemes' + execs' `documentation`),
     // materialized at plurnk:///docs/<name>.md by loop_run (like operator docs).
-    docEntries(sessionId) {
-        return this.#packets.docEntries(sessionId);
+    docEntries(workspaceId) {
+        return this.#packets.docEntries(workspaceId);
     }
     // §env-delta (§actor-boundary-no-mutex: runs share without locks; a conflict surfaces as a delta, never prevented) — at pre-turn build, surface what changed in the shared world since this
-    // run last looked. No per-run snapshot (§machine-processes "a run is its log"): every
+    // run last looked. No per-worker snapshot (§machine-processes "a worker is its log"): every
     // edit is already a span-carrying log row, so PULL other actors' EDITs on shared
-    // entries since this run's prior turn — real cross-run edits and the plurnk run's
+    // entries since this worker's prior turn — real cross-worker edits and the plurnk worker's
     // fs-sync fictions — and materialize each as a FOLDED delta reusing the row's span +
     // cause. Returns the count so the caller advances nextActionIndex past the deltas.
     async #materializeEnvironmentDeltas(args) {
-        const { sessionId, runId, loopId, turnId, fromSequence } = args;
-        const boundary = await this.#db.engine_run_prior_turn_time.get({ run_id: runId, turn_id: turnId });
+        const { workspaceId, workerId, loopId, turnId, fromSequence } = args;
+        const boundary = await this.#db.engine_worker_prior_turn_time.get({ worker_id: workerId, turn_id: turnId });
         const since = boundary?.since ?? null;
         if (since === null)
             return 0; // first turn — nothing prior; the model reads current state fresh
-        const rows = await this.#db.engine_pull_env_deltas.all({ session_id: sessionId, run_id: runId, since });
+        const rows = await this.#db.engine_pull_env_deltas.all({ workspace_id: workspaceId, worker_id: workerId, since });
         let written = 0;
         for (const r of rows) {
-            // source: the originating run (a real cross-run edit) or 'file' (an fs fiction);
+            // source: the originating run (a real cross-worker edit) or 'file' (an fs fiction);
             // rx reuses the originating row's result span — the edit as it looked then.
             await this.#db.engine_insert_env_delta.run({
-                run_id: runId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
-                source: r.source ?? String(r.run_id), scheme: r.scheme, pathname: r.pathname, rx: r.rx,
+                worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
+                source: r.source ?? String(r.worker_id), scheme: r.scheme, pathname: r.pathname, rx: r.rx,
             });
             written++;
         }
-        // §run-scheme — loop-terminations: a sibling's loop reaching terminal surfaces the
+        // §worker-scheme — loop-terminations: a sibling's loop reaching terminal surfaces the
         // same way an entry-change does, carrying its deliverable (the SEND body) or the
         // abandonment reason. Folded, attributed to the terminated run.
-        const terms = await this.#db.engine_pull_loop_terminations.all({ session_id: sessionId, run_id: runId, since });
+        const terms = await this.#db.engine_pull_loop_terminations.all({ workspace_id: workspaceId, worker_id: workerId, since });
         for (const t of terms) {
             await this.#db.engine_insert_loop_termination_delta.run({
-                run_id: runId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
-                source: String(t.run_id), pathname: `/${t.run_name}`,
+                worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
+                source: String(t.worker_id), pathname: `/${t.worker_name}`,
                 rx: markTerminal(t.terminated_by, t.terminal_message) ?? `loop "${t.prompt}" ended (${t.status})`,
                 status: t.status,
             });
@@ -1200,13 +1241,13 @@ export default class Engine {
         }
         return written;
     }
-    // §exec-poll — EXEC `<0>` is turn-scoped: abort the run's open turn-scoped streams via their
+    // §exec-poll — EXEC `<0>` is turn-scoped: abort the worker's open turn-scoped streams via their
     // owning scheme (the same registry-routed abort the total reap uses). Called at each pre-turn
     // before the turn's own spawns, so every open turn-scoped sub here is from a prior turn — it
     // never survives into the subsequent turn. Fire-and-forget: the spawn finalizes async and its
     // terminal output surfaces born-OPEN through the stream-delta path (§exec-stream).
-    async #reapTurnScopedStreams(runId) {
-        const open = await this.#db.find_open_turn_scoped_subscriptions_for_run.all({ run_id: runId });
+    async #reapTurnScopedStreams(workerId) {
+        const open = await this.#db.find_open_turn_scoped_subscriptions_for_worker.all({ worker_id: workerId });
         for (const { id, scheme } of open) {
             const handler = this.#schemes.get(scheme);
             handler?.abortSubscription?.(id);
@@ -1218,12 +1259,12 @@ export default class Engine {
     // streamEnd recorded on the channel's prior delta — no exec-specific surfacing, just the
     // env-observe loop with a byte cursor where env-delta uses a timestamp. §exec-stream
     async #materializeStreamDeltas(args) {
-        const { runId, loopId, turnId, fromSequence } = args;
-        const channels = await this.#db.engine_run_stream_channels.all({ run_id: runId });
+        const { workerId, loopId, turnId, fromSequence } = args;
+        const channels = await this.#db.engine_worker_stream_channels.all({ worker_id: workerId });
         let written = 0;
         for (const ch of channels) {
             const prior = await this.#db.engine_stream_cursor.get({
-                run_id: runId, scheme: ch.runtime, pathname: ch.coord, fragment: ch.channel,
+                worker_id: workerId, scheme: ch.runtime, pathname: ch.coord, fragment: ch.channel,
             });
             const priorAttrs = prior !== undefined ? JSON.parse(prior.attrs) : {};
             const cursor = priorAttrs.streamEnd ?? 0;
@@ -1237,7 +1278,7 @@ export default class Engine {
                 // pointer to the already-delivered bytes, never a re-send (§tokenomics-fetch-fits-free).
                 if (closed && priorAttrs.terminal !== true && cursor > 0) {
                     await this.#db.engine_insert_stream_delta.run({
-                        run_id: runId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
+                        worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
                         scheme: ch.runtime, pathname: ch.coord, fragment: ch.channel,
                         rx: JSON.stringify({ status: ch.close_status ?? 200, content: `[ stream closed (${ch.close_status ?? 200}) — full output already delivered above; READ ${ch.runtime}://${ch.coord}#${ch.channel} to revisit ]`, mimetype: "text/stream" }),
                         attrs: JSON.stringify({ streamEnd: ch.content.length, terminal: true }),
@@ -1251,7 +1292,7 @@ export default class Engine {
             // into one sequence (lines N..M, then M+1..), not N independent "1:" restarts. §exec-stream
             const startLine = (ch.content.slice(0, cursor).match(/\n/g)?.length ?? 0) + 1;
             await this.#db.engine_insert_stream_delta.run({
-                run_id: runId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
+                worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
                 scheme: ch.runtime, pathname: ch.coord, fragment: ch.channel,
                 rx: JSON.stringify({ status: 200, content: ch.content.slice(cursor), mimetype: "text/stream", startLine }),
                 attrs: JSON.stringify({ streamEnd: ch.content.length, terminal: closed }),
@@ -1262,20 +1303,20 @@ export default class Engine {
         return written;
     }
     // §env-delta — the filesystem as an actor. Ambient disk divergences detected at
-    // pre-turn (git membership re-read) are logged as the plurnk run's source=file EDIT
+    // pre-turn (git membership re-read) are logged as the plurnk worker's source=file EDIT
     // "fictions": no op happened, but EDIT is the only grammar the model has for "your
     // world changed," so the fiction keeps its perspective aligned with what its tooling
-    // would show. The fiction lives in the plurnk run's log; every other run pulls it
+    // would show. The fiction lives in the plurnk worker's log; every other run pulls it
     // through the one delta path, exactly like a sibling's real edit.
-    // §membership-emi-divergence-signal — disk divergences logged as the plurnk run's source=file EDIT fictions
-    async #logFsFictions(sessionId, divergences) {
+    // §membership-emi-divergence-signal — disk divergences logged as the plurnk worker's source=file EDIT fictions
+    async #logFsFictions(workspaceId, divergences) {
         if (divergences.length === 0)
             return;
-        const run = await this.#db.envelope_get_run_by_name.get({ session_id: sessionId, name: "plurnk" })
-            ?? await this.#db.envelope_insert_run.get({ session_id: sessionId, name: "plurnk", origin: "plurnk" });
+        const run = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name: "plurnk" })
+            ?? await this.#db.envelope_insert_worker.get({ workspace_id: workspaceId, name: "plurnk", origin: "plurnk" });
         if (run === undefined)
-            throw new Error("logFsFictions: plurnk run resolution returned no row");
-        const loop = await this.#db.envelope_insert_client_loop.get({ run_id: run.id });
+            throw new Error("logFsFictions: plurnk worker resolution returned no row");
+        const loop = await this.#db.envelope_insert_client_loop.get({ worker_id: run.id });
         if (loop === undefined)
             throw new Error("logFsFictions: loop insert returned no row");
         const seq = await this.#db.client_turn_next_sequence.get({ loop_id: loop.id });
@@ -1286,7 +1327,7 @@ export default class Engine {
         for (const d of divergences) {
             const span = editedSpan(d.before, d.after);
             await this.#db.engine_insert_log_entry.get({
-                run_id: run.id, loop_id: loop.id, turn_id: turn.id, sequence: sequence++,
+                worker_id: run.id, loop_id: loop.id, turn_id: turn.id, sequence: sequence++,
                 origin: "plurnk", source: "file", op: "EDIT", suffix: "", signal: null,
                 scheme: d.scheme, username: null, password: null, hostname: null, port: null,
                 pathname: d.pathname, params: null, fragment: null, lineMarker: null,
@@ -1328,79 +1369,63 @@ export default class Engine {
     // run still accepting turns?" If yes, skip the wake — the active loop
     // will pick up the channel transition at its next turn boundary. If no,
     // the daemon opens a fresh loop with the wake prompt.
-    async hasActiveLoopForRun(runId) {
-        const row = await this.#db.engine_count_active_loops_for_run.get({ run_id: runId });
+    async hasActiveLoopForWorker(workerId) {
+        const row = await this.#db.engine_count_active_loops_for_worker.get({ worker_id: workerId });
         return (row?.n ?? 0) > 0;
     }
     // #290 — run the derivation pump (deep channels: symbols/refs/FTS +
-    // embeddings, deep_hash-gated) at SESSION-SCOPE, off the per-turn path, so a freshly-created
-    // session's corpus warms DURING the client's startup window instead of freezing the first
-    // loop.run. session.create fires this and returns immediately; embed_progress live-fans-out as it
+    // embeddings, deep_hash-gated) at WORKSPACE-SCOPE, off the per-turn path, so a freshly-created
+    // workspace's corpus warms DURING the client's startup window instead of freezing the first
+    // loop.run. workspace.create fires this and returns immediately; embed_progress live-fans-out as it
     // runs. Idempotent + deep_hash-gated, so turn 1's pump finds the work done (or harmlessly re-runs);
     // a no-embedder build derives the cheap symbols/refs/FTS channels and skips the embed pass. Has no
     // loop yet — telemetry fans out live only (loopId 0), never buffered to a loop that never drains.
-    async warmSessionDerivations(sessionId) {
+    async warmWorkspaceDerivations(workspaceId) {
         const ctx = {
-            db: this.#db, sessionId, runId: 0, loopId: 0, turnId: 0,
+            db: this.#db, workspaceId, workerId: 0, loopId: 0, turnId: 0,
             writer: "plurnk",
             signal: undefined,
             streamEventNotify: this.#streamEventNotify,
-            wakeRunNotify: this.#wakeRunNotify,
+            wakeWorkerNotify: this.#wakeWorkerNotify,
             tokenize: this.#tokenize,
             mimetypes: this.#mimetypes,
             defaultChannelFor: (s) => this.#schemes.defaultChannelFor(s),
-            pushTelemetry: (event) => this.#telemetry.notify(sessionId, 0, event),
+            pushTelemetry: (event) => this.#telemetry.notify(workspaceId, 0, event),
         };
         await this.#queueDerivation(() => EntryManifest.maintainDerivations(ctx)); // §derivation-off-hot-path
     }
-    // Inject a prompt into the run's currently-executing loop. Writes a
+    // Inject a prompt into the worker's currently-executing loop. Writes a
     // plurnk://prompt/<run>/<loop>/<next-turn> entry whose body becomes the
     // prompt section at the next turn boundary. Last-wins: if two
     // injects target the same next-turn slot, the second overwrites the
     // first.
     //
-    // Returns null when no loop in the run is currently active (status=102).
+    // Returns null when no loop in the worker is currently active (status=102).
     // The daemon-side inject path then enqueues a fresh loop with this
     // prompt; engine doesn't open loops itself.
     //
     // Rummy parallel: AgentLoop.inject(). The "active drain → write
     // prompt entry, return immediately" branch.
-    // §search-prefetch — the pass's scheme context: plurnk-written, the same notifier wiring
-    // dispatch uses, bound to the run's current loop for teardown scoping (inject's shape).
-    async prefetchCtx(sessionId, runId) {
-        const loop = await this.#db.drain_current_loop_for_run.get({ run_id: runId });
-        const loopId = loop?.id ?? 0;
-        return {
-            db: this.#db, sessionId, runId, loopId, turnId: 0,
-            writer: "plurnk",
-            signal: this.#loopAborts.get(loopId)?.signal,
-            streamEventNotify: this.#streamEventNotify,
-            wakeRunNotify: this.#wakeRunNotify,
-            tokenize: this.#tokenize,
-            mimetypes: this.#mimetypes,
-            pushTelemetry: (event) => this.#telemetry.push(sessionId, loopId, event),
-        };
-    }
-    async inject(runId, prompt) {
-        const loopRow = await this.#db.drain_current_loop_for_run.get({ run_id: runId });
+    async inject(workerId, prompt) {
+        const loopRow = await this.#db.drain_current_loop_for_worker.get({ worker_id: workerId });
         if (loopRow === undefined)
             return null;
         const loopId = loopRow.id;
         const turnRow = await this.#db.drain_next_turn_seq_for_loop.get({ loop_id: loopId });
         const turnSeq = turnRow?.next ?? 1;
-        const sessionRow = await this.#db.drain_get_run_session.get({ run_id: runId });
-        if (sessionRow === undefined)
-            throw new Error(`Engine.inject: run ${runId} not found`);
-        const pathname = promptPathname(runId, loopRow.sequence, turnSeq); // canonical storage form, run-qualified loop-SEQ coordinates matching the turn-1 foist
+        const workspaceRow = await this.#db.drain_get_worker_workspace.get({ worker_id: workerId });
+        if (workspaceRow === undefined)
+            throw new Error(`Engine.inject: run ${workerId} not found`);
+        const pathname = promptPathname(workerId, loopRow.sequence, turnSeq); // canonical storage form, worker-qualified loop-SEQ coordinates matching the turn-1 foist
         const ctx = {
-            db: this.#db, sessionId: sessionRow.session_id, runId, loopId,
+            db: this.#db, workspaceId: workspaceRow.workspace_id, workerId, loopId,
             turnId: 0, // no turn open at inject time; entries don't pin turnId
             writer: "plurnk",
             signal: this.#loopAborts.get(loopId)?.signal,
             streamEventNotify: this.#streamEventNotify,
-            wakeRunNotify: this.#wakeRunNotify,
+            wakeWorkerNotify: this.#wakeWorkerNotify,
             tokenize: this.#tokenize,
-            pushTelemetry: (event) => this.#telemetry.push(sessionRow.session_id, loopId, event),
+            pushTelemetry: (event) => this.#telemetry.push(workspaceRow.workspace_id, loopId, event),
         };
         const entry = {
             channels: { body: { content: prompt, mimetype: "text/markdown" } },