@plurnk/plurnk-service 1.0.5 → 1.0.7

package/dist/core/PacketBuilder.js

@@ -1,9 +1,9 @@
 var _a;
 import { renderAddress, promptLoopPrefix } from "./plurnk-uri.js";
 import { rulerCount } from "./token-ruler.js";
-import { teachingLine, docsExcludeSet } from "./teaching.js";
+import { docsExcludeSet } from "./teaching.js";
 import { Policy } from "@plurnk/plurnk-execs";
-import SessionSettings from "./session-settings.js";
+import WorkspaceSettings from "./workspace-settings.js";
 import { DEFAULT_LOOP_FLAGS } from "./scheme-types.js";
 import { readPacketInject, readSystemPolicy, readProjectPolicy } from "./packet-inject.js";
 import { readFile } from "node:fs/promises";
@@ -20,6 +20,7 @@ import ProviderInstantiate from "./ProviderInstantiate.js";
 const TOKENS_FREE_PLACEHOLDER = "{{tokensFree}}";
 const TOKEN_USAGE_PLACEHOLDER = "{{tokenUsage}}";
 const TOKEN_PERCENT_PLACEHOLDER = "{{tokenPercent}}";
+const SYSTEM_CTX_PLACEHOLDER = "{{systemCtx}}"; // #440 — treemap's non-turn overhead = total − Σturns, known only post-assembly
 // §tokenomics-window-partition — the four partition numbers. REQUIRED (fail-hard, the
 // providers-env convention): the ceiling is DERIVED from these, never set directly
 // (PLURNK_BUDGET_CEILING is retired — a settable ceiling let policy contradict physics).
@@ -46,12 +47,9 @@ class PacketBuilder {
         this.#schemes = schemes;
         this.#telemetry = telemetry;
         this.#executors = executors;
-        // Prime the ACTIVE alias's partition NOW — capturing the env at construction, so a caller
-        // that sets PLURNK_SERVICE_* then constructs then restores (the budget tests, boot) reads
-        // the intended window. Per-alias overrides (a loop.run alias the boot env didn't set)
-        // resolve fresh at call time.
-        const bootAlias = resolveActiveAlias(process.env)?.alias ?? "";
-        this.#partitions.set(bootAlias, this.#resolvePartition(bootAlias));
+        // #507 — the envelope rides the provider; construction only runs the retired-knob shed
+        // so a stale operator .env fails at BOOT, not first use.
+        this.#safetyFor(resolveActiveAlias(process.env)?.alias ?? "");
     }
     // #352 — the generation envelope is PER-ALIAS: gemma keeps its measured llama-server policy
     // envelope (n_predict honored to the context wall — the cap MUST bound it, providers#10);
@@ -59,66 +57,52 @@ class PacketBuilder {
     // scopeEnvToAlias resolves PLURNK_SERVICE_*_<alias> over the bare fallback with providers' own
     // battle-tested suffix parser. Cached per alias; the boot-global case falls back to the active
     // alias when a provider carries no side-table entry (a test Mock).
-    static #KNOBS = ["PLURNK_SERVICE_CTX", "PLURNK_SERVICE_REASONING", "PLURNK_SERVICE_ASSISTANT", "PLURNK_SERVICE_SAFETY"];
-    #partitions = new Map();
-    #resolvePartition(alias) {
-        const view = scopeEnvToAlias(process.env, alias, _a.#KNOBS);
-        return {
-            ctx: readPartitionIntFrom(view, "PLURNK_SERVICE_CTX", 1),
-            reasoning: readPartitionIntFrom(view, "PLURNK_SERVICE_REASONING", 0),
-            assistant: readPartitionIntFrom(view, "PLURNK_SERVICE_ASSISTANT", 0),
-            safety: readPartitionIntFrom(view, "PLURNK_SERVICE_SAFETY", 0),
-        };
-    }
-    // #377 — a per-alias partition knob present in env (same suffix/fold rule as providers'
-    // scopeEnvToAlias: PLURNK_SERVICE_<KNOB>_<alias>, alias case-folded, a key that IS a bare knob
-    // is never an override).
-    static #hasAliasKnob(alias) {
-        if (alias.length === 0)
-            return false;
-        const folded = alias.toLowerCase();
-        for (const knob of _a.#KNOBS) {
-            for (const key of Object.keys(process.env)) {
-                if (!key.startsWith(knob + "_"))
-                    continue;
-                if (_a.#KNOBS.includes(key))
-                    continue;
-                if (key.slice(knob.length + 1).toLowerCase() === folded && (process.env[key] ?? "").length > 0)
-                    return true;
+    // #507 (owner-ruled full migration): the generation envelope is PROVIDER-owned — the window
+    // and both reserves ride the Provider surface (contextWindow/reasoningReserve/completionReserve,
+    // ingested or PLURNK_PROVIDERS_*-pinned in the provider tier). Core keeps ONE knob: SAFETY,
+    // the ruler's own packing margin — a service fact, not a model fact.
+    static #KNOBS = ["PLURNK_SERVICE_SAFETY"];
+    #shedChecked = false;
+    #safetyFor(alias) {
+        // #507 hard shed (the #472 pattern): the three misprefixed partition knobs moved to the
+        // provider tier; a stale operator .env must never silently lose its envelope to the move.
+        if (!this.#shedChecked) {
+            this.#shedChecked = true;
+            const MOVED = {
+                CTX: "PLURNK_PROVIDERS_CONTEXT_WINDOW", CONTEXT_WINDOW: "PLURNK_PROVIDERS_CONTEXT_WINDOW",
+                REASONING: "PLURNK_PROVIDERS_REASONING_RESERVE",
+                ASSISTANT: "PLURNK_PROVIDERS_COMPLETION_RESERVE", COMPLETION: "PLURNK_PROVIDERS_COMPLETION_RESERVE",
+            };
+            for (const k of Object.keys(process.env)) {
+                const m = /^PLURNK_SERVICE_(CTX|CONTEXT_WINDOW|REASONING|ASSISTANT|COMPLETION)(_.*)?$/.exec(k);
+                if (m !== null)
+                    throw new Error(`${k} is retired (#507): the envelope is provider-owned — the knob is ${MOVED[m[1]]}${m[2] ?? ""}.`);
             }
         }
-        return false;
+        const view = scopeEnvToAlias(process.env, alias, _a.#KNOBS);
+        return readPartitionIntFrom(view, "PLURNK_SERVICE_SAFETY", 0);
+    }
+    // #421 — §tokenomics-window-unpollable-deliberate: provider.contextWindow null (env/probe/catalog
+    // all missed, provider-tier pins included) is genuinely-unknown — nobody chose an envelope. The
+    // budget/ceiling short-circuit to NO-CAP rather than substitute a stand-in the operator never chose.
+    #isUnboundedWindow(provider) {
+        return provider.contextWindow === null;
     }
     #partitionFor(provider) {
         const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
-        // #377 — §tokenomics-window-unpollable-deliberate: "CTX stands in for unknown physics" is
-        // only honest when the CTX is the operator's DELIBERATE policy for THIS alias. An unpollable
-        // window (provider.contextSize null — the provider's machine signal after env/probe/catalog
-        // all miss) riding BARE partition numbers is nobody's policy: numbers tuned for some other
-        // model silently applied, surfacing later as truncation/overflow telemetry (#352's failure
-        // mode recurring for every unpollable model). Fail loud at first use, naming both remedies.
-        if (provider.contextSize === null && !_a.#hasAliasKnob(alias)) {
-            // BEFORE the cache lookup — the constructor pre-primes the boot alias's partition, and a
-            // cache hit must never bypass this refusal (the check keys on the PROVIDER's null window,
-            // which the cached partition knows nothing about).
-            throw new Error(`window unpollable for alias '${alias || "<active>"}' and its partition rides bare numbers — nobody chose this envelope for this model. Either set PLURNK_PROVIDERS_CONTEXT_SIZE_${alias || "<alias>"} (so the window is known) or set the per-alias partition (PLURNK_SERVICE_{CTX,REASONING,ASSISTANT,SAFETY}_${alias || "<alias>"}) so the numbers are deliberate.`);
-        }
-        const hit = this.#partitions.get(alias);
-        if (hit !== undefined)
-            return hit;
-        const part = this.#resolvePartition(alias);
-        this.#partitions.set(alias, part);
-        return part;
+        return { reasoning: provider.reasoningReserve ?? null, completion: provider.completionReserve ?? null, safety: this.#safetyFor(alias) };
     }
-    // The generation envelope — REASONING + ASSISTANT, one undifferentiated pool, passed on
+    // The generation envelope — REASONING + COMPLETION, one undifferentiated pool, passed on
     // every generate({maxTokens}): no decode is unbounded (§tokenomics-window-partition). Per
     // alias (#352): gemma's measured envelope; a cloud alias's generous default the backend clamps.
-    decodeBudget(provider) {
-        const { reasoning, assistant } = this.#partitionFor(provider);
-        return reasoning + assistant;
+    maxTokensFor(provider) {
+        const { reasoning, completion } = this.#partitionFor(provider);
+        if (reasoning === null || completion === null)
+            return null; // #421 — unknown envelope, no cap; the backend clamps
+        return reasoning + completion;
     }
     // §tokenomics-window-partition — the prompt ceiling
-    // is DERIVED, never set: effectiveWindow = min(CTX, provider window; CTX alone when the
+    // is DERIVED, never set: effectiveWindow = min(CONTEXT_WINDOW, provider window; CONTEXT_WINDOW alone when the
     // provider reports none) minus the reserves, divided by the loop's observed real/measured
     // token ratio (usage.prompt is ground truth; a heuristic ruler shipped a 65k-real packet into
     // a 49k window, #311). A fractional ceiling also budgeted the prompt against the window and
@@ -129,9 +113,12 @@ class PacketBuilder {
     // space (usage.prompt, the numerator, is real; the calibration ratio maps measured→real and
     // has no business here). The raw n_ctx overstates usable room by the reserve total.
     promptBudgetFor(provider) {
-        const { ctx, reasoning, assistant, safety } = this.#partitionFor(provider);
-        const effectiveWindow = provider.contextSize === null ? ctx : Math.min(ctx, provider.contextSize);
-        return Math.max(0, effectiveWindow - reasoning - assistant - safety);
+        if (this.#isUnboundedWindow(provider) || provider.contextWindow === null)
+            return null; // #421 — no cap: an unknown window has no denominator
+        const { reasoning, completion, safety } = this.#partitionFor(provider);
+        if (reasoning === null || completion === null)
+            return null; // #421 — unknown reserves: no denominator either
+        return Math.max(0, provider.contextWindow - reasoning - completion - safety);
     }
     // §tokenomics-agnostic-ruler — the ceiling is the real window partition (window − reserves),
     // NO calibration ratio: the model-facing measure is the chars/2 ruler (an over-count for
@@ -139,12 +126,17 @@ class PacketBuilder {
     // bias — the model curates against less room than it has and never overflows for typical
     // content; the exact provider count guards the pathological tail at the materialization gate.
     ceilingFor(provider) {
-        const { ctx, reasoning, assistant, safety } = this.#partitionFor(provider);
-        const effectiveWindow = provider.contextSize === null ? ctx : Math.min(ctx, provider.contextSize);
-        const promptBudget = effectiveWindow - reasoning - assistant - safety;
+        if (this.#isUnboundedWindow(provider) || provider.contextWindow === null)
+            return null; // #421 — no cap: the gauge headline is omitted
+        const { reasoning, completion, safety } = this.#partitionFor(provider);
+        if (reasoning === null || completion === null)
+            return null; // #421 — unknown reserves, no ceiling
+        const promptBudget = provider.contextWindow - reasoning - completion - safety;
         if (promptBudget <= 0) {
             const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
-            throw new Error(`window partition contradiction for alias '${alias}': effective window ${effectiveWindow} <= reserves ${reasoning}+${assistant}+${safety}. A local (llama-server) alias needs its OWN measured envelope — set PLURNK_SERVICE_{CTX,REASONING,ASSISTANT,SAFETY}_${alias || "<alias>"} (the bare defaults are cloud-generous; #352).`);
+            // #507 — post-migration this contradiction has ONE cause: pinned absolute reserves
+            // exceeding the window the provider detected (percent reserves derive and cannot contradict).
+            throw new Error(`window partition contradiction for alias '${alias}': window ${provider.contextWindow} <= reserves ${reasoning}+${completion}+${safety}. Pinned PLURNK_PROVIDERS_{REASONING,COMPLETION}_RESERVE absolutes exceed the detected window — repin them under it, or use percent reserves, which derive from the window.`);
         }
         return promptBudget;
     }
@@ -152,7 +144,7 @@ class PacketBuilder {
     // and §user) BEFORE the provider call. The same packet object is then
     // completed with assistant + assistantRaw after the model responds, so
     // the stored packet and the wire payload share one source of truth.
-    async buildRequestPacket({ initialMessages, requirements, sessionId, runId, loopId, currentTurnSeq, provider, gitStatus, telemetryErrors: presetTelemetry, }) {
+    async buildRequestPacket({ initialMessages, requirements, workspaceId, workerId, loopId, currentTurnSeq, provider, gitStatus, telemetryErrors: presetTelemetry, }) {
         const byRole = (role) => initialMessages.filter((m) => m.role === role).map((m) => m.content).join("\n\n");
         // plurnk.md (grammar/dialects) ONLY — the definition is the hot-path grammar.
         // The scheme catalogue is its own `schemes` section below tools (§schemes-directory),
@@ -165,7 +157,7 @@ class PacketBuilder {
         // the runLoop caller's messages.user for tests that bypass the
         // foist mechanism entirely.
         const loopSeqRow = await this.#db.engine_loop_sequence.get({ loop_id: loopId });
-        const promptRows = (await this.#db.drain_get_all_prompt_bodies_for_loop.all({ pattern: `${promptLoopPrefix(runId, loopSeqRow?.sequence ?? loopId)}%` }))
+        const promptRows = (await this.#db.drain_get_all_prompt_bodies_for_loop.all({ pattern: `${promptLoopPrefix(workerId, loopSeqRow?.sequence ?? loopId)}%` }))
             .filter((r) => typeof r.content === "string" && r.content.length > 0);
         // §prompt-auto-read (owner): the section is a PATHS list (the errors shape — no bodies);
         // each prompt's content reaches the model through its foisted auto-READ in the log, and
@@ -184,14 +176,14 @@ class PacketBuilder {
         // leads requirements.md, so a third copy here was pure duplication in the model's packet. PLAN
         // is mandated unconditionally by plurnk.md §Imperatives (grammar 0.70 requires every turn to
         // lead with PLAN), so the service injects no separate plan directive either.
-        const log = await this.#buildLog(runId);
+        const log = await this.#buildLog(workerId);
         const telemetryErrors = presetTelemetry ?? await this.buildTelemetryErrors(loopId, currentTurnSeq);
         const countTokens = rulerCount; // §tokenomics-agnostic-ruler — the ONE model-facing ruler (chars/2), not the provider
-        // #367 — the capability sheet must reflect the LOOP MODE, not just session-enablement: an
+        // #367 — the capability sheet must reflect the LOOP MODE, not just workspace-enablement: an
         // ask-mode loop advertises only what its dispatch gate (resolveForLoop) will accept, so the
         // model is never taught a tag it'll then be 403'd on (the taught→emitted→rejected→508 spiral).
         const activeSchemes = this.#schemes.resolveForLoop(await this.#loadLoopFlags(loopId));
-        const tools = this.#collectTools(await this.#sessionEnabled(sessionId), await SessionSettings.questionsEnabled(this.#db, sessionId), activeSchemes);
+        const tools = this.#collectTools(await this.#workspaceEnabled(workspaceId), await WorkspaceSettings.questionsEnabled(this.#db, workspaceId), activeSchemes);
         // Budget readout (SPEC.md §tokenomics). Two-pass: render the budget from
         // the structured log's subtotals with a {{tokensFree}} placeholder, build
         // the section list, measure the assembled total, resolve free, substitute.
@@ -200,7 +192,8 @@ class PacketBuilder {
         // PLURNK_BUDGET_CEILING (null when no window is reported → headline
         // omitted, section lines still shown). §tokenomics-render-weight-budget
         const ceiling = this.ceilingFor(provider);
-        const budgetReadout = this.#renderBudget(PacketWire.measureLogBudget(log, countTokens), ceiling);
+        const logBudget = PacketWire.measureLogBudget(log, countTokens);
+        const budgetReadout = this.#renderBudget(logBudget, ceiling);
         // The default packet: an ordered list of addressable sections (§packet-assembly).
         // `slot` is a TRUST boundary (and the prompt-cache boundary): system holds only
         // framework-authored, non-injectable sections — the static head (definition/tools/
@@ -209,24 +202,24 @@ class PacketBuilder {
         // the requirements footer. The budget section carries its {{tokensFree}} placeholders
         // here; they resolve below once the assembled total is known.
         const inject = await readPacketInject(); // #240 — operator section, per-turn, fail-hard on a broken path
-        const sessionRoot = (await this.#db.envelope_get_session.get({ id: sessionId }))?.project_root ?? null;
+        const workspaceRoot = (await this.#db.envelope_get_workspace.get({ id: workspaceId }))?.project_root ?? null;
         const systemPolicy = await readSystemPolicy(); // ~/.plurnk/AGENTS.md (or PLURNK_SERVICE_POLICY)
-        const projectPolicy = await readProjectPolicy(sessionRoot); // <projectRoot>/AGENTS.md (or PLURNK_SERVICE_PROJECT)
+        const projectPolicy = await readProjectPolicy(workspaceRoot); // <projectRoot>/AGENTS.md (or PLURNK_SERVICE_PROJECT)
         // Child-orientation (§child-orientation): the live things THIS run holds — open streams +
-        // unconcluded child runs — surfaced every turn as terse `* <status> <path>` pointers (same shape
+        // unconcluded child workers — surfaced every turn as terse `* <status> <path>` pointers (same shape
         // as errors) just above the errors section. Orienting STATE so the model never loses track of
         // what it's holding (the premature-terminate trap), never advice on what to do. Empty → omitted.
-        const childStreams = (await this.#db.engine_child_streams_open.all({ run_id: runId }))
+        const childStreams = (await this.#db.engine_child_streams_open.all({ worker_id: workerId }))
             .map((s) => ({ status: "active", path: renderAddress(s.scheme, s.pathname) }));
-        const childRuns = (await this.#db.engine_child_runs_live.all({ run_id: runId }))
-            .map((r) => ({ status: r.status, path: `run://${r.name}` }));
+        const childWorkers = (await this.#db.engine_child_workers_live.all({ worker_id: workerId }))
+            .map((r) => ({ status: r.status, path: `worker://${r.name}` }));
         const defaults = [
             { name: "definition", slot: "system", header: null, content: system_definition, tokens: 0 },
-            { name: "tools", slot: "system", header: null, content: tools.join("\n"), tokens: 0 }, // titleless — the examples flow on from plurnk.md (definition) directly above
-            { name: "schemes", slot: "system", header: "Plurnk Service Schemes", content: this.#schemes.teach(), tokens: 0 },
-            ...(inject !== null ? [{ name: "inject", slot: "system", header: "Plurnk Operator Notes", content: inject, tokens: 0 }] : []),
+            { name: "tools", slot: "system", header: null, content: tools, tokens: 0 }, // titleless — the fenced op catalog flows on from plurnk.md (definition) directly above
+            { name: "schemes", slot: "system", header: "Schemes", content: this.#schemes.teach(), tokens: 0 },
+            ...(inject !== null ? [{ name: "inject", slot: "system", header: "Operator Notes", content: inject, tokens: 0 }] : []),
             // policy: the client's privileged rules — ~/.plurnk/AGENTS.md (system) then <root>/AGENTS.md (project) — below grammar/tools/schemes, above budget-the-law. AGENTS is POLICY here, never a curatable READable entry. Empty content ⇒ section omitted.
-            { name: "system-policy", slot: "system", header: "Plurnk Service Policy", content: systemPolicy ?? "", tokens: 0 },
+            { name: "system-policy", slot: "system", header: "Policy", content: systemPolicy ?? "", tokens: 0 },
             { name: "project-policy", slot: "system", header: "Project Policy", content: projectPolicy ?? "", tokens: 0 },
             // The packet split is a TRUST boundary: system carries only framework-authored, non-injectable
             // sections; anything that could carry attacker-reachable text (a READ result, exec output, the
@@ -235,19 +228,19 @@ class PacketBuilder {
             // neither is an injection surface; both sit at the bottom of system, just above budget-the-law.
             // child-orientation: what THIS run holds live — streams then runs — just above errors. Terse
             // pointers (the path is the actionable address the model READs/OPENs/KILLs), never advice. §child-orientation
-            { name: "child-streams", slot: "system", header: "Plurnk Service Child Streams", content: PacketWire.renderChildPointers(childStreams), tokens: 0 },
-            { name: "child-runs", slot: "system", header: "Plurnk Service Active Child Worker Runs", content: PacketWire.renderChildPointers(childRuns), tokens: 0 },
-            { name: "errors", slot: "system", header: "Plurnk Service Errors", content: PacketWire.renderErrors(telemetryErrors), tokens: 0 },
-            { name: "git", slot: "system", header: "Plurnk Service Git Status", content: PacketWire.renderGit(gitStatus), tokens: 0 },
+            { name: "child-streams", slot: "system", header: "Child Streams", content: PacketWire.renderChildPointers(childStreams), tokens: 0 },
+            { name: "child-workers", slot: "system", header: "Active Child Workers", content: PacketWire.renderChildPointers(childWorkers), tokens: 0 },
+            { name: "errors", slot: "system", header: "Errors", content: PacketWire.renderErrors(telemetryErrors), tokens: 0 },
+            { name: "git", slot: "system", header: "Git Status", content: PacketWire.renderGit(gitStatus), tokens: 0 },
             // budget — LAW (a hard ceiling the model must obey).
-            { name: "budget", slot: "system", header: "Plurnk Service Budget", content: budgetReadout, tokens: 0 },
+            { name: "budget", slot: "system", header: "Budget", content: budgetReadout, tokens: 0 },
             // §prompt-auto-read (owner): the prompts section is the system slot's very bottom —
             // a paths-only list (the errors shape); bodies arrive via the foisted auto-READ.
-            { name: "prompt", slot: "system", header: "Plurnk Service User Prompts", content: prompt, tokens: 0 },
+            { name: "prompt", slot: "system", header: "User Prompts", content: prompt, tokens: 0 },
             // log in the user slot: injectable content (READ results, exec output, the model's own mirror) — data, never rules — kept at the action point so the model consults its history.
-            { name: "log", slot: "user", header: "Plurnk Service Log", content: PacketWire.renderLog(log, countTokens), tokens: 0 },
+            { name: "log", slot: "user", header: "Log", content: PacketWire.renderLog(log, countTokens), tokens: 0 },
             // requirements renders LAST — the user-slot footer, the syntax contract closest to the model's turn (a recency carve-out for weak models).
-            { name: "requirements", slot: "user", header: "Plurnk Service Requirements", content: baseRequirements, tokens: 0 },
+            { name: "requirements", slot: "user", header: "Recap", content: baseRequirements, tokens: 0 },
         ];
         // Plugin packet control (§packet-assembly): trusted schemes rewrite the
         // default list — add, remove, reorder — in-process, before measurement.
@@ -257,14 +250,18 @@ class PacketBuilder {
         let total = countTokens(PacketWire.renderSlot(sections, "system")) + countTokens(PacketWire.renderSlot(sections, "user"));
         {
             const budgetSec = sections.find((s) => s.name === "budget"); // a plugin may have removed it
-            if (budgetSec) {
+            // A null ceiling (#421 — unbounded window) has no headline to calibrate: no truncation, no
+            // percent/free substitution. #renderBudget already omitted the headline, so nothing to do.
+            if (budgetSec && ceiling !== null) {
                 // Curation pressure gates on OCCUPANCY (§tokenomics-pressure-gates-on-occupancy, #308):
                 // the Turns/Heaviest tables are a standing FOLD-target list, and a high-headroom model
                 // reads them as a todo — burning turns on token hygiene at 3% of a 64k window. Under
                 // half-full, the headline's numbers stand alone (truncate at the first blank line) and
                 // the total RE-measures — the substituted figures must reconcile with what ships.
                 // A null ceiling can't calibrate, so the full readout stays.
-                if ((total / ceiling) * 100 < 50) {
+                // A mermaid budget (#440) self-scales to pressure, so it is never truncated — the calm
+                // low-usage view IS the point; only the tabular readout collapses under half-full.
+                if (!budgetSec.content.includes("```mermaid") && (total / ceiling) * 100 < 50) {
                     const cut = budgetSec.content.indexOf("\n\n");
                     if (cut !== -1) {
                         budgetSec.content = budgetSec.content.slice(0, cut);
@@ -273,12 +270,17 @@ class PacketBuilder {
                 }
                 const tokensFree = Math.max(0, ceiling - total); // free floors at 0 on overshoot — §tokenomics-over-budget-floor
                 const percent = (total / ceiling) * 100; // usage as % of the ceiling — §tokenomics-context-percent
+                const sumTurns = logBudget.byTurn.reduce((s, t) => s + t.tokens, 0); // #440 — treemap non-turn box = total − Σturns
+                const systemCtx = Math.max(0, total - sumTurns);
+                // replaceAll: a mermaid budget recurs free/used across the headline + treemap + pie, so a
+                // single .replace would leave the diagrams carrying literal {{…}} placeholders.
                 budgetSec.content = budgetSec.content
-                    .replace(TOKEN_USAGE_PLACEHOLDER, String(total))
+                    .replaceAll(TOKEN_USAGE_PLACEHOLDER, String(total))
                     // Any nonzero usage under 1% is "<1" — Math.round alone claimed "1%" from 0.51%,
                     // overstating a near-empty window.
-                    .replace(TOKEN_PERCENT_PLACEHOLDER, total > 0 && percent < 1 ? "<1" : String(Math.round(percent)))
-                    .replace(TOKENS_FREE_PLACEHOLDER, String(tokensFree));
+                    .replaceAll(TOKEN_PERCENT_PLACEHOLDER, total > 0 && percent < 1 ? "<1" : String(Math.round(percent)))
+                    .replaceAll(TOKENS_FREE_PLACEHOLDER, String(tokensFree))
+                    .replaceAll(SYSTEM_CTX_PLACEHOLDER, String(systemCtx));
             }
         }
         // Pass 2: per-section render-weight + the assembled packet total (post
@@ -294,7 +296,23 @@ class PacketBuilder {
     // placeholder here — buildRequestPacket substitutes it after measuring the packet.
     #renderBudget(log, ceiling) {
         const lines = [];
-        lines.push(`Token Ceiling ${ceiling} · Token Usage ${TOKEN_USAGE_PLACEHOLDER} (${TOKEN_PERCENT_PLACEHOLDER}%) · Tokens Free ${TOKENS_FREE_PLACEHOLDER}`);
+        // #421 — no ceiling (unbounded window): omit the headline entirely; the section lines below
+        // stay so the model keeps its FOLD-target surface, just with no percent it can't compute.
+        if (ceiling !== null)
+            lines.push(`Token Ceiling ${ceiling} · Token Usage ${TOKEN_USAGE_PLACEHOLDER} (${TOKEN_PERCENT_PLACEHOLDER}%) · Tokens Free ${TOKENS_FREE_PLACEHOLDER}`);
+        // #440 {§budget-mermaid} — the enriched visual Budget (default on). With a ceiling to scale
+        // against, the treemap REPLACES the Turns table (per-turn composition) + a pie gauge; the
+        // heaviest-items list stays a table (#450). Self-scaled to pressure (calm→urgent), never <50%-truncated.
+        // Set PLURNK_SERVICE_BUDGET_MERMAID=off to A/B against the tabular baseline (#440's before/after).
+        if (process.env.PLURNK_SERVICE_BUDGET_MERMAID !== "off" && ceiling !== null && log.entries > 0) {
+            if (lines.length > 0)
+                lines.push("");
+            lines.push(_a.#renderBudgetMermaid(log, ceiling));
+            // #450 — the heaviest items stay a plain ranked list (a ranking isn't a composition, no
+            // treemap; two mermaid diagrams are enough visual examples) — the same table as the tabular budget.
+            lines.push(..._a.#heaviestItemsLines(log.largest));
+            return lines.join("\n");
+        }
         if (log.entries > 0) {
             if (lines.length > 0)
                 lines.push("");
@@ -306,23 +324,54 @@ class PacketBuilder {
                 for (const t of log.byTurn)
                     lines.push(`| ${t.turn} | ${t.tokens} |`);
             }
-            // The heaviest individual log items — the FOLD targets behind the weight
-            // (§tokenomics {§tokenomics-largest-entries}). "items", not "entries": the readout
-            // lists log:/// rows (log items), distinct from catalog entries (plurnk.md: "EDIT
-            // is only for entries. Do not attempt to edit log items.").
-            if (log.largest.length > 0) {
-                lines.push("", "Heaviest items (FOLD targets — folding reclaims their tokens):", "| item | tokens |", "|---|--:|");
-                for (const e of log.largest)
-                    lines.push(`| ${e.path} | ${e.tokens} |`);
-            }
+            lines.push(..._a.#heaviestItemsLines(log.largest));
         }
         return lines.join("\n");
     }
-    // #328 — the per-session client execs policy narrows what the packet ADVERTISES, matching what
-    // dispatch refuses: a session-disabled tag is absent from the capability sheet and the doc set,
+    // The heaviest individual log items — the FOLD targets behind the weight, a ranked LIST in both the
+    // mermaid and tabular budgets (#450: a ranking isn't a composition, so it's never a chart). "items",
+    // not "entries": log:/// rows, distinct from catalog entries (plurnk.md: "EDIT is only for entries").
+    // {§tokenomics-largest-entries}
+    static #heaviestItemsLines(largest) {
+        if (largest.length === 0)
+            return [];
+        return ["", "Heaviest items (FOLD targets — folding reclaims their tokens):", "| item | tokens |", "|---|--:|",
+            ...largest.map((e) => `| ${e.path} | ${e.tokens} |`)];
+    }
+    // #440 {§budget-mermaid} — the Budget as two budget-scaled mermaid diagrams (validated to render on
+    // GitHub; syntax: plurnk-plurnkdown/demo/budget-mermaid.md). Both scaled to the CEILING, so salience
+    // tracks pressure: `free` dominates at low usage (calm), turn boxes fill as it climbs (urgent).
+    // free/used/system+context are placeholders — the post-assembly total resolves them. (#450 cut the xychart.)
+    static #renderBudgetMermaid(log, ceiling) {
+        // Turn composition → treemap: turn boxes + system+context + free compose the whole ceiling —
+        // the per-turn FOLD surface (which turns are heavy, labeled `turn L/T`) the headline can't give.
+        const treemap = [
+            "```mermaid",
+            "treemap-beta",
+            `"Budget — ceiling ${ceiling}"`,
+            `    "free": ${TOKENS_FREE_PLACEHOLDER}`,
+            `    "system + context": ${SYSTEM_CTX_PLACEHOLDER}`,
+            ...log.byTurn.map((t) => `    "turn ${t.turn}": ${t.tokens}`),
+            "```",
+        ].join("\n");
+        // Gauge → pie: used vs free, budget-scaled (used + free = ceiling); also a visual exemplar for
+        // the model's own user-facing SENDs. (#450 cut the heaviest-items xychart — its bare-coordinate
+        // labels a floor model can't decode, and the treemap already surfaces per-turn heaviness.)
+        const pie = [
+            "```mermaid",
+            "pie showData",
+            `    title Budget — used vs free (ceiling ${ceiling})`,
+            `    "used" : ${TOKEN_USAGE_PLACEHOLDER}`,
+            `    "free" : ${TOKENS_FREE_PLACEHOLDER}`,
+            "```",
+        ].join("\n");
+        return [treemap, pie].join("\n\n");
+    }
+    // #328 — the per-workspace client execs policy narrows what the packet ADVERTISES, matching what
+    // dispatch refuses: a workspace-disabled tag is absent from the capability sheet and the doc set,
     // never taught-then-refused. No policy (execs unset) → everything boot-registered shows.
-    async #sessionEnabled(sessionId) {
-        const { execs } = await SessionSettings.read(this.#db, sessionId);
+    async #workspaceEnabled(workspaceId) {
+        const { execs } = await WorkspaceSettings.read(this.#db, workspaceId);
         if (execs === null)
             return () => true;
         return (tag) => Policy.isEnabled(tag, execs);
@@ -344,58 +393,55 @@ class PacketBuilder {
             return DEFAULT_LOOP_FLAGS;
         }
     }
-    #collectTools(sessionEnabled, questionsOn = false, activeSchemes) {
-        const tools = [];
+    #collectTools(workspaceEnabled, questionsOn = false, activeSchemes) {
+        // §PACKET Tools (#441) — the capability sheet's OP examples ride a `plurnk` fence, matching the
+        // Schemes catalog (one packet, one shape for op-example sheets). Prose notices (EXEC-disabled)
+        // stay prose beside the fence — a prose line isn't an op for the op-fence gate to validate.
+        const ops = [];
+        const notices = [];
         // §send-300-choices — the one-liner rides ONLY where questions are enabled (allowed +
         // client-requested); the fuller questions.md doc injects through docEntries the same way.
         if (questionsOn)
-            tools.push(teachingLine("<<SEND[300]:Deploy where?;staging;production:SEND"));
-        // Each available runtime tag contributes its self-documenting example —
-        // the example carries syntax + purpose, so there's no prose line. Tags
-        // with no example (sh/node, covered by the core prompt) contribute
-        // nothing; available-only, so the model never sees an unusable tag. `* `
-        // bullets + bare op forms match the packet's list/op rendering (no `- `,
-        // no backticks — see packet-wire.ts).
+            ops.push("<<SEND[300]:Deploy where?;staging;production:SEND");
         const executors = this.#executors();
         if (executors !== undefined) {
             const excluded = docsExcludeSet();
             const runtimes = executors.availableRuntimes();
-            // execs#24 (operator design, via the client) + the #367 filter CORRECTED: the per-tag
-            // runtime schemes are READ faces (reading sh:// history is legitimate in ask mode), so
-            // keying the sheet on activeSchemes.has(tag) filtered NOTHING — the untested corner of
-            // be8a77c. The sheet's lines are EXEC-usage examples, so the key is the 'exec' scheme
-            // (the op face, excludedInAsk). When it's inactive, say so POSITIVELY: plurnk.md still
-            // teaches EXEC as language, and silent absence measurably invites confabulated runtimes
-            // (the client's 5-probe: 500×3). Core speaks the line — only core knows the gate closed.
+            // execs#24 / #367: the sheet's lines are EXEC-usage examples, keyed on the 'exec' scheme
+            // (the op face, excludedInAsk). When inactive, say so POSITIVELY (a prose notice): plurnk.md
+            // still teaches EXEC as language, and silent absence measurably invites confabulated runtimes.
             const execActive = activeSchemes === undefined || activeSchemes.has("exec");
             if (runtimes.length > 0 && !execActive) {
-                tools.push(teachingLine("EXEC operations are disabled for this loop — do not run commands; answer or advise directly"));
-                return tools;
+                notices.push("EXEC operations are disabled for this loop — do not run commands; answer or advise directly");
             }
-            for (const tag of runtimes) {
-                if (excluded.has(tag))
-                    continue; // #240 — PLURNK_SERVICE_DOCS_EXCLUDE drops the oneliner + the doc
-                if (!sessionEnabled(tag))
-                    continue; // #328 — session-disabled tags aren't advertised
-                const entry = executors.entry(tag);
-                // #240 — identical treatment with the scheme directory: the example IS the oneliner,
-                // the fuller doc (materialized at plurnk://docs/<tag>.md) rides an inline link whose
-                // token cost lives on that manifest entry. No example → no line (like a provisional scheme).
-                if (entry?.example)
-                    tools.push(teachingLine(entry.example));
+            else {
+                for (const tag of runtimes) {
+                    if (excluded.has(tag))
+                        continue; // #240 — PLURNK_SERVICE_DOCS_EXCLUDE drops the oneliner + the doc
+                    if (!workspaceEnabled(tag))
+                        continue; // #328 — workspace-disabled tags aren't advertised
+                    const entry = executors.entry(tag);
+                    // #240 — the example IS the oneliner (a bare op, fenced below); the fuller doc
+                    // materializes at plurnk://docs/<tag>.md. No example → no line.
+                    if (entry?.example)
+                        ops.push(entry.example);
+                }
             }
         }
-        return tools;
+        const parts = [...notices];
+        if (ops.length > 0)
+            parts.push(`\`\`\`plurnk\n${ops.join("\n")}\n\`\`\``);
+        return parts.join("\n\n");
     }
     // #note12 — the daughter-provided reference docs (schemes' + execs' `documentation`),
     // materialized at plurnk:///docs/<name>.md by loop_run (like operator docs) so the
     // catalogue's doc-links READ and the manifest carries each doc's token cost.
-    async docEntries(sessionId) {
+    async docEntries(workspaceId) {
         const out = this.#schemes.docs(); // scheme docs already drop PLURNK_SERVICE_DOCS_EXCLUDE names
         // §send-300-choices — the conditional teaching: questions.md (from the docs corpus)
-        // materializes ONLY for enabled sessions — the same conditional-doc mechanism as the EXEC
-        // plugin docs below. An un-enabled session is never taught the op it can't use.
-        if (await SessionSettings.questionsEnabled(this.#db, sessionId)) {
+        // materializes ONLY for enabled workspaces — the same conditional-doc mechanism as the EXEC
+        // plugin docs below. An un-enabled workspace is never taught the op it can't use.
+        if (await WorkspaceSettings.questionsEnabled(this.#db, workspaceId)) {
             try {
                 const q = await readFile(resolvePath(Paths.schemeDocs, "questions.md"), "utf8");
                 if (q.length > 0)
@@ -406,11 +452,11 @@ class PacketBuilder {
         const executors = this.#executors();
         if (executors !== undefined) {
             const excluded = docsExcludeSet();
-            const sessionEnabled = await this.#sessionEnabled(sessionId); // #328 — no doc for a disabled tag
+            const workspaceEnabled = await this.#workspaceEnabled(workspaceId); // #328 — no doc for a disabled tag
             for (const tag of executors.availableRuntimes()) {
                 if (excluded.has(tag))
                     continue; // #240 — exec docs honor the same exclude
-                if (!sessionEnabled(tag))
+                if (!workspaceEnabled(tag))
                     continue;
                 const doc = executors.entry(tag)?.documentation;
                 if (doc !== undefined && doc.length > 0)
@@ -425,10 +471,12 @@ class PacketBuilder {
     // strike, rebuild, re-measure. Folds (never deletes). The strike it raises and
     // the hard-stop it can signal are returned to runLoop, which owns abandonment.
     // §grinder-overflow-only — fires only on actual overflow, never speculatively
-    async enforceBudget({ packet, provider, runId, loopId, turnId, mintSequence, rebuild }) {
+    async enforceBudget({ packet, provider, workerId, loopId, turnId, mintSequence, rebuild }) {
         const ceiling = this.ceilingFor(provider);
         const measure = (p) => p.tokens;
-        if (measure(packet) <= ceiling)
+        // #421 — a null ceiling is an unbounded window: always fit, never fold or strike (the backend
+        // clamps; this mirrors Engine's physicallySendable, which treats a null contextWindow as sendable).
+        if (ceiling === null || measure(packet) <= ceiling)
             return { packet, fit: true, struck: false };
         // ONE rule, every turn — turn 1 and turn 101 alike (§grinder-layer1-rollback): fold the
         // NEWEST turn boundary's still-open rows (the prior turn's emissions + this turn's
@@ -442,7 +490,7 @@ class PacketBuilder {
         // turn late. The row is grinder-exempt, so it stacks into a visible recurrence trail. It
         // sits at the turn's reserved running sequence (mintSequence) so it never collides with the
         // post-generate dispatch rows. §telemetry-uniform-error-channel, §grinder-overflow-error-row
-        await this.#telemetry.mintEngineError("budget_overflow", { runId, loopId, turnId, sequence: mintSequence });
+        await this.#telemetry.mintEngineError("budget_overflow", { workerId, loopId, turnId, sequence: mintSequence });
         await this.#db.engine_grinder_fold_newest_turn.run({ loop_id: loopId, turn_id: turnId });
         const current = await rebuild();
         return { packet: current, fit: measure(current) <= ceiling, struck: true };
@@ -492,16 +540,16 @@ class PacketBuilder {
     // Snapshot is taken at packet build (pre-dispatch this turn), so it
     // reflects "what has happened before this turn." Each row carries a
     // log:///<loop_seq>/<turn_seq>/<sequence> coordinate the model can READ.
-    async #buildLog(runId) {
-        // SPEC §packet-terms: runs own log entries — log is the run's history,
-        // not the loop's. Span all loops in the run so the model sees
+    async #buildLog(workerId) {
+        // SPEC §packet-terms: runs own log entries — log is the worker's history,
+        // not the loop's. Span all loops in the worker so the model sees
         // earlier loops' work as conversational memory.
         //
         // User prompts are first-class log entries: runTurn writes a
         // client-origin SEND[200] row at sequence=0 of each new
         // turn-1. Prompts thus surface naturally in this query — no
         // synthetic / shim layer.
-        const rows = await this.#db.engine_render_log.all({ run_id: runId });
+        const rows = await this.#db.engine_render_log.all({ worker_id: workerId });
         return rows.map((r) => ({
             coordinate: `${r.loop_seq}/${r.turn_seq}/${r.sequence}`,
             origin: r.origin,