@plurnk/plurnk-service 1.16.4 → 1.17.0

package/dist/core/TurnRunner.js

@@ -1,28 +1,35 @@
+import { TurnDisposition } from "@plurnk/plurnk-contracts";
+import NativeContent from "./NativeContent.js";
 import { PathSyntax, PlurnkParser, PlurnkParseError, UNKNOWN_POSITION } from "@plurnk/plurnk-contracts";
 import { setTimeout as delay } from "node:timers/promises";
 import { aggregateProviderAccounting } from "@plurnk/plurnk-providers";
 const comparePosition = (a, b) => a.line - b.line || a.column - b.column;
 import Meta from "@plurnk/plurnk-meta";
-import EntryCrud from "../schemes/_entry-crud.js";
 import GitMembership from "./git-membership.js";
 import { acceptedKinds } from "./attachments.js";
 import GitState from "./git-state.js";
 import WorkspaceSettings from "./workspace-settings.js";
-import { generatedPathname, promptPathname, promptLoopPrefix } from "./plurnk-uri.js";
+import { taskTiming } from "./LoopLifecycle.js";
+import { generatedPathname, promptLoopPrefix } from "./plurnk-uri.js";
+import PromptFrames from "./PromptFrames.js";
 import { readFile } from "node:fs/promises";
-// {§grammar-rail-registration} — bare names are the built-in rail namespace;
-// everything else is an import specifier resolved through the Node chain.
-export const resolveGrammarRailPath = (variant) => variant.startsWith("/") || variant.startsWith(".")
-    || variant.includes("/") || variant.includes(":")
-    ? (variant.startsWith("/") || variant.startsWith(".")
-        ? variant
-        : fileURLToPath(import.meta.resolve(variant)))
-    : fileURLToPath(import.meta.resolve(`@plurnk/plurnk-contracts/${variant}`));
-import { fileURLToPath } from "node:url";
+import { resolve as resolvePath } from "node:path";
+import { homedir } from "node:os";
+// {§operator-grammar} — an operator's own GBNF is a file path: absolute, `~`-relative, or
+// relative to the daemon's working directory. The service ships no grammar profile, so a bare
+// name (no separator) is refused by name rather than resolved against anything.
+export const resolveOperatorGrammarPath = (value) => {
+    if (value === "~" || value.startsWith("~/"))
+        return resolvePath(homedir(), value.slice(2));
+    if (value.startsWith("/") || value.startsWith(".") || value.includes("/"))
+        return resolvePath(value);
+    throw new Error(`PLURNK_PROVIDERS_GBNF=${value} names a bundled grammar profile; the service ships none (#588). Give the path of a grammar file you wrote.`);
+};
 // Shared module imported by both Engine and bin/digest.ts, so wire
 // projection and digest projection are structurally one function — no
 // drift between wire and digest possible.
 import PacketWire from "./packet-wire.js";
+import ReasoningView from "./ReasoningView.js";
 import Results, { OperationFailureError } from "./results.js";
 import Turn from "./Turn.js";
 import StoredPacket from "./StoredPacket.js";
@@ -30,39 +37,29 @@ import { observed, observedSync } from "../observe/spans.js";
 import { GEN_AI_REQUEST_SPAN, genAiRequestOptions, settleGenAiResponse } from "../observe/genai.js";
 import { PROVIDER_CALLS, recordCounter } from "../observe/metrics.js";
 import ModelCall, { ModelCallPersistenceError, ProviderAccountingIntegrityError } from "./ModelCall.js";
-import OverflowTurn from "./OverflowTurn.js";
+import WorkerName from "./WorkerName.js";
 import TurnOps from "./TurnOps.js";
 import CapabilityPolicies from "./CapabilityPolicies.js";
 import CapabilityResolver from "./CapabilityResolver.js";
-import LoopPolicyReader from "./LoopPolicyReader.js";
-// The prompt entry target - prompt:///<loop>/<N>, self-only ({§prompt-self-only}):
-// the owner rides the owner_id column, the address carries only the loop coordinate.
-const promptTarget = (loopSeq, promptOrdinal) => {
-    const storage = promptPathname(loopSeq, promptOrdinal);
+// {§prompt-address}: the same literal address in every observer's packet.
+const promptTarget = (workerName, storage) => {
     return {
-        kind: "url", raw: `prompt://${storage}`,
+        kind: "url", raw: `prompt://${workerName}${storage}`,
         scheme: "prompt", username: null, password: null,
-        hostname: null, port: null,
+        hostname: workerName, port: null,
         pathname: storage, query: null, fragment: null,
     };
 };
 const regexLiteral = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-const workerCatalogTarget = (namespace, availableNames, admittedNames) => {
-    if (availableNames.length > 0 && admittedNames.length === 0)
-        return null;
-    const leaf = availableNames.length === 0 || admittedNames.length === availableNames.length
-        ? "*.md"
-        : admittedNames.length === 1
-            ? `${admittedNames[0]}.md`
-            : `{${admittedNames.join(",")}}.md`;
-    const pathname = generatedPathname(`/${namespace}/${leaf}`);
+const workerCatalogTarget = (namespace) => {
+    const pathname = generatedPathname(`/${namespace}/*.md`);
     return {
         kind: "url",
-        raw: `worker://~${pathname}`,
+        raw: `worker://${pathname}`,
         scheme: "worker",
         username: null,
         password: null,
-        hostname: "~",
+        hostname: null,
         port: null,
         pathname,
         query: null,
@@ -115,35 +112,12 @@ const readFilesItems = () => {
     return normalizeFilesItems(Number.parseInt(raw, 10));
 };
 import { ProviderError, scopeEnvToAlias } from "@plurnk/plurnk-providers";
-import { validateGbnf } from "@plurnk/gbnf";
 import ProviderInstantiate from "./ProviderInstantiate.js";
 import TurnMaterialization from "./TurnMaterialization.js";
 import BareBatchRunner from "./BareBatchRunner.js";
-import { TERMINAL_SEND_SIGNALS, TURN_STATUS_IMPLICIT_CONTINUE } from "./turn-signals.js";
+import { TURN_STATUS_IMPLICIT_CONTINUE } from "./turn-signals.js";
 import AdmittedTurnExecutor from "./AdmittedTurnExecutor.js";
-// A generated rail may constrain only the sampled continuation while the chat
-// template contributes a prefix that llama-server preserves in its response.
-// The artifact names the alternate root that composes those bytes for evidence
-// grading; arbitrary grammars without the declaration retain their transport root.
-const grammarConstraint = (grammar) => {
-    const declarations = [...grammar.matchAll(/^# @plurnk-response-root ([A-Za-z][A-Za-z0-9-]*)$/gm)];
-    if (declarations.length === 0)
-        return { transport: grammar, response: grammar };
-    if (declarations.length !== 1)
-        throw new Error("GBNF constraint declares multiple @plurnk-response-root values");
-    const responseRoot = declarations[0][1];
-    if (!grammar.split("\n").some((line) => line.startsWith(`${responseRoot} ::=`))) {
-        throw new Error(`GBNF constraint declares missing response root ${responseRoot}`);
-    }
-    const roots = [...grammar.matchAll(/^root ::= ([A-Za-z][A-Za-z0-9-]*)$/gm)];
-    if (roots.length !== 1)
-        throw new Error("GBNF constraint must declare exactly one simple root");
-    return {
-        transport: grammar,
-        response: grammar.replace(roots[0][0], `root ::= ${responseRoot}`),
-    };
-};
-const TOKEN_BUDGET_OVERFLOW_HARD_DETAIL = "Context Token Budget Overflow: tokensActiveTotal exceeded tokensActiveMax, and the causal overflow turn could not make enough room.";
+const TOKEN_BUDGET_OVERFLOW_HARD_DETAIL = "Context Token Budget Overflow: logTokensTotal exceeds logTokensMax; retained context cannot fit.";
 const curationOverflowFailure = (pressure) => Results.failure("engine:context", "token-budget-overflow", 413, TOKEN_BUDGET_OVERFLOW_HARD_DETAIL, {}, {
     usage: pressure.weight,
     ceiling: pressure.budget,
@@ -202,7 +176,8 @@ export default class TurnRunner {
     #warmWorkspace;
     #dispatch;
     #resolveWorkerProviderIdentity;
-    #gbnfCache = new Map();
+    // {§operator-grammar} — one read per path per daemon; the file is the operator's and static.
+    #grammarCache = new Map();
     #materialization;
     #bareBatch;
     #admitted;
@@ -228,7 +203,7 @@ export default class TurnRunner {
         this.#warmWorkspace = warmWorkspace;
         this.#dispatch = dispatch;
         this.#resolveWorkerProviderIdentity = resolveWorkerProviderIdentity;
-        this.#materialization = new TurnMaterialization({ db: this.#db, schemes: this.#schemes, weighContent: this.#weighContent });
+        this.#materialization = new TurnMaterialization({ db: this.#db, weighContent: this.#weighContent });
         this.#bareBatch = new BareBatchRunner({ db: this.#db, providerAttributions: this.#providerAttributions.bind(this), providerFailure: TurnRunner.#providerFailure });
         this.#admitted = new AdmittedTurnExecutor({ db: this.#db, schemes: this.#schemes, notices: this.#notices, problems: this.#problems, dispatcher: this.#dispatcher, bareBatch: this.#bareBatch });
     }
@@ -243,66 +218,31 @@ export default class TurnRunner {
             workerId: args.workerId,
             loopId: args.loopId,
             packetCount: packetCount.count,
+            ...taskTiming(packetCount),
         });
     }
-    // {§rail-truth-engine-verdict} — the verify GAP (a configured grammar @plurnk/gbnf can't
-    // parse): warn once per message, never per turn; the turn records railsVerdict "unverifiable".
-    static #railGapWarned = new Set();
-    static #warnRailVerdictGapOnce(message) {
-        if (TurnRunner.#railGapWarned.has(message))
-            return;
-        TurnRunner.#railGapWarned.add(message);
-        process.stderr.write(`plurnk-engine: rail verdict unavailable — the configured grammar did not parse in @plurnk/gbnf (${message})\n`);
-    }
-    static #requireGrammarEvidence(response, allowWithheld) {
-        const evidence = response.grammarEvidence;
-        if (evidence === undefined) {
-            throw new Error("provider contract violation: configured GBNF response omitted grammar evidence");
-        }
-        const input = [...evidence.input];
-        if (!Number.isInteger(evidence.contentStart)
-            || evidence.contentStart < 0
-            || evidence.contentStart > input.length
-            || typeof evidence.transported !== "boolean"
-            || input.slice(evidence.contentStart).join("") !== response.assistant.content) {
-            throw new Error("provider contract violation: grammar evidence does not map exactly to assistant.content");
-        }
-        if (!allowWithheld && !evidence.transported) {
-            throw new Error("provider contract violation: configured GBNF was not transported outside explicit debug mode");
-        }
-        return evidence;
-    }
-    async #grammarConstraint(provider) {
-        // A real alias scopes its rail; an alias-free direct route uses the
-        // global provider configuration. Unrelated alias settings never apply.
-        // {§grammar-configuration-admission}
+    // {§operator-grammar} — the operator's grammar text for this provider, or undefined when
+    // none is configured. A real alias scopes its knob; an alias-free direct route uses the
+    // global provider configuration. Unrelated alias settings never apply
+    // ({§grammar-configuration-admission}). An unreadable file throws: a configured grammar
+    // never silently degrades.
+    async #operatorGrammar(provider) {
         ProviderInstantiate.assertGrammarConfigurationScope(provider);
         const alias = ProviderInstantiate.configurationAliasOf(provider);
         const scoped = alias === undefined
             ? process.env
-            : scopeEnvToAlias(process.env, alias, [
-                "PLURNK_PROVIDERS_GBNF",
-                "PLURNK_PROVIDERS_GBNF_DEBUG",
-            ]);
-        const variant = scoped.PLURNK_PROVIDERS_GBNF;
-        if (variant === undefined || variant === "" || variant === "0")
+            : scopeEnvToAlias(process.env, alias, ["PLURNK_PROVIDERS_GBNF"]);
+        const configured = scoped.PLURNK_PROVIDERS_GBNF;
+        if (configured === undefined || configured === "" || configured === "0")
             return undefined;
-        const allowWithheld = scoped.PLURNK_PROVIDERS_GBNF_DEBUG !== undefined
-            && scoped.PLURNK_PROVIDERS_GBNF_DEBUG !== ""
-            && scoped.PLURNK_PROVIDERS_GBNF_DEBUG !== "0";
-        const hit = this.#gbnfCache.get(variant);
+        const path = resolveOperatorGrammarPath(configured);
+        const hit = this.#grammarCache.get(path);
         if (hit !== undefined)
-            return { ...hit, allowWithheld };
-        // {§grammar-rail-registration} — a bare name is a built-in rail subpath
-        // under @plurnk/plurnk-contracts; any other form is an import specifier
-        // (an operator file path or a package export subpath), so a third-party
-        // rail package plugs in with no built-in registry change.
-        const path = resolveGrammarRailPath(variant);
-        const text = await readFile(path, "utf8"); // unresolvable/unreadable throws — a configured rail never silently degrades
-        const constraint = grammarConstraint(text);
-        this.#gbnfCache.set(variant, constraint);
-        process.stderr.write(`plurnk-engine: GBNF constraint: ${alias || "(bare)"} → ${variant} (${text.length} chars)\n`);
-        return { ...constraint, allowWithheld };
+            return hit;
+        const text = await readFile(path, "utf8");
+        this.#grammarCache.set(path, text);
+        process.stderr.write(`plurnk-engine: operator grammar: ${alias || "(bare)"} → ${path} (${text.length} chars)\n`);
+        return text;
     }
     // A lineage's no-parent root; a root worker resolves to itself. Fail hard
     // when corruption leaves a worker without one. {§worker-primary}
@@ -342,10 +282,9 @@ export default class TurnRunner {
         }
         return { line, column };
     }
-    // {§packet-attachment-parts} — a route receives, as native parts read from the scheme's bytes at
-    // request time, the packet's attachments of every kind its model accepts; every other attachment
-    // reaches it as the text projection alone.
-    async #wireMessages(packet, workspaceId, provider) {
+    // {§packet-attachment-parts}: native parts come from the READ's immutable snapshot,
+    // never from a source that may have changed since the observation.
+    async #wireMessages(packet, ctx, provider) {
         const accepted = acceptedKinds(provider.inputModalities);
         if (accepted.length === 0 || !(packet.attachments ?? []).some((attachment) => accepted.includes(attachment.kind))) {
             return {
@@ -355,20 +294,14 @@ export default class TurnRunner {
         }
         const nativeInputs = new Set();
         const messages = await PacketWire.wireMessages(packet, async (attachment) => {
-            const handler = this.#schemes.get(attachment.scheme);
-            const source = handler?.byteSource?.(attachment.pathname, { db: this.#db, workspaceId });
-            if (source === undefined)
-                return null;
-            const total = await source.size();
-            if (total === null || total === 0)
-                return null;
-            const bytes = await source.read(1, total);
+            const bytes = await NativeContent.read(ctx.db, attachment.contentHash);
             nativeInputs.add(attachment.coordinate);
             return bytes;
         }, (kind) => accepted.includes(kind));
         return { messages, nativeInputs: [...nativeInputs] };
     }
-    async runTurn({ provider, childProvider = provider, messages, recap = "", workspaceId, workerId, loopId, signal, onDispatch, onSettled, turnNumber = 1, maxTurns = 50, invalidEmissionRecoveryEntryId, }) {
+    async runTurn({ provider, childProvider = provider, messages, recap = "", workspaceId, workerId, loopId, signal, onDispatch, onSettled, turnNumber = 1, maxTurns = 50, invalidEmissionRecoveryEntryId, allowUnobservedRetrievalCompletion = false, }) {
+        const workerName = await WorkerName.forId(this.#db, workerId);
         const transientOpenLogEntryId = typeof invalidEmissionRecoveryEntryId === "number"
             ? invalidEmissionRecoveryEntryId
             : null;
@@ -404,8 +337,8 @@ export default class TurnRunner {
                 createdTurnIds.push(initializationTurn.id);
             const initializationPolicies = initializationTurn === null
                 ? []
-                : (await CapabilityPolicies.layers(this.#db, workspaceId, workerId, await LoopPolicyReader.read(this.#db, loopId))).map((layer) => layer.policy);
-            const initializationAdmits = (statement) => this.#capabilities.allowsAcross(statement, workerId, initializationPolicies);
+                : (await CapabilityPolicies.layers(this.#db, workspaceId)).map((layer) => layer.policy);
+            const initializationAdmits = (statement) => this.#capabilities.allowsAcross(statement, workspaceId, initializationPolicies);
             let modelTurn = initializationTurn === null
                 ? await Turn.open(this.#db, { loopId, producer: "model", kind: "inference" })
                 : null;
@@ -421,109 +354,68 @@ export default class TurnRunner {
             // Threaded per turn, never engine state, so concurrent loops on
             // different providers each read their own honest tokenizer values.
             const systemContext = (contextTurnId) => ({
-                db: this.#db, workspaceId, workerId, functionalityWorkerId: workerId, loopId, turnId: contextTurnId,
+                db: this.#db, workspaceId, workerId, loopId, turnId: contextTurnId,
                 writer: "_plurnk",
                 signal: this.#loopSignal(loopId),
                 streamEventNotify: this.#streamEventNotify,
                 wakeWorkerNotify: this.#wakeWorkerNotify,
                 weigh: this.#weighContent,
                 mimetypes: this.#mimetypes,
-                defaultChannelFor: (s) => this.#schemes.defaultChannelFor(s, workerId),
+                defaultChannelFor: (s) => this.#schemes.defaultChannelFor(s, workspaceId),
                 pushNotice: (notice) => this.#notices.push(workspaceId, workerId, loopId, notice),
-                requestInteraction: (request) => this.#interactions.request(request, { workspaceId, workerId, loopId, turnId: contextTurnId }, this.#loopSignal(loopId)),
+                requestInteraction: (request, signal = this.#loopSignal(loopId)) => this.#interactions.request(request, { workspaceId, workerId, loopId, turnId: contextTurnId }, signal),
             });
             let systemCtx = systemContext(initializationTurn?.id ?? modelTurn.id);
             // {§prompt-entry} — the prompt entry exists before any turn of the loop
-            // runs, so the initialization COPY archives a real source; its `prompt`
-            // log row is published to the model turn below (one durable publication
-            // per loop, decided by that row).
+            // runs; its `prompt` log row is published to the model turn below (one
+            // durable publication per loop, decided by that row).
             const promptPublication = turnNumber === 1 && loopRow?.prompt_published === 0
                 && typeof loopRow.prompt === "string" && loopRow.prompt.length > 0
                 ? {
                     content: loopRow.prompt,
                     source: loopRow.prompt_source,
-                    path: promptTarget(loopRow.sequence, 1),
+                    path: promptTarget(workerName, await PromptFrames.write(systemCtx, {
+                        loopSequence: loopRow.sequence, ordinal: 1, content: loopRow.prompt,
+                        source: loopRow.prompt_source, pathname: loopRow.prompt_pathname,
+                        openPaths: assertOpenPaths(JSON.parse(loopRow.open_paths), `Loop ${loopId} open_paths`),
+                    })),
                     openPaths: assertOpenPaths(JSON.parse(loopRow.open_paths), `Loop ${loopId} open_paths`),
                 }
                 : null;
-            if (promptPublication !== null) {
-                const entry = {
-                    channels: { body: { content: promptPublication.content, mimetype: "text/markdown" } },
-                    attributes: {
-                        openPaths: promptPublication.openPaths,
-                        ...(promptPublication.source === null ? {} : { source: promptPublication.source }),
-                    },
-                };
-                await EntryCrud.writeEntry({ authority: "", pathname: promptPublication.path.pathname }, entry, systemCtx, "prompt", workerId);
-            }
             const initializationStatements = [];
             // {§worker-initialization-entry} — the worker's first turn is the worked
-            // example itself: an ordinary PLAN, the actual orienting operations,
-            // and an ordinary terminal SEND.
+            // example itself: the actual orienting operations and an ordinary TASK.
             if (initializationTurn !== null) {
-                const plan = {
-                    op: "PLAN", delimiter: "", annotation: "Determinations and Decisions must be persisted as `memory` items.",
-                    target: null, metadata: null, lineMarker: null,
-                    body: [
-                        {
-                            content: "Discover the tooling available and survey the workspace file root.",
-                            status: "in_progress",
-                        },
-                    ],
-                    position: UNKNOWN_POSITION,
-                };
-                initializationStatements.push(plan);
-                // {§worker-initialization-entry} — the prompt is archived into the
-                // worker's private space: the worked COPY specimen, and the private
-                // space shown as scratch. An append onto an absent entry creates it.
-                // Authored first among the operations because it executes first
-                // ({§op-mode-phases}: Mutate precedes Observe).
-                if (promptPublication !== null) {
-                    const archive = {
-                        op: "COPY", delimiter: "", annotation: null,
-                        source: { target: promptPublication.path, metadata: null, lineMarker: null },
-                        destination: {
-                            target: { kind: "url", raw: "worker://~/prompts.md", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: "/prompts.md", query: null, fragment: null },
-                            metadata: null,
-                            lineMarker: { marks: [-1] },
-                        },
-                        position: UNKNOWN_POSITION,
-                    };
-                    initializationStatements.push(archive);
-                }
                 // {§turn0-agents-stunt} — the project AGENTS.md (materialized by LoopDocs as
-                // worker://~/_plurnk/agents.md) gets one foisted READ on the worker's first
+                // worker:///_plurnk/agents.md) gets one foisted READ on the worker's first
                 // loop, so local repo guidance is visible turn-0 content. Global policy
                 // stays in the system prompt; nothing else is force-read.
                 if (workerFirstInference) {
                     const agentsEntry = await this.#db.crud_find_workspace_entry.get({
                         workspace_id: workspaceId,
-                        owner_id: workerId,
                         scheme: "worker",
                         authority: "",
                         pathname: generatedPathname("/agents.md"),
                     });
                     if (agentsEntry !== undefined) {
                         const agentsTarget = {
-                            kind: "url", raw: "worker://~/_plurnk/agents.md", scheme: "worker",
-                            username: null, password: null, hostname: "~", port: null,
+                            kind: "url", raw: "worker:///_plurnk/agents.md", scheme: "worker",
+                            username: null, password: null, hostname: null, port: null,
                             pathname: generatedPathname("/agents.md"), query: null, fragment: null,
                         };
                         const agentsRead = {
-                            op: "READ", delimiter: "", annotation: null, target: agentsTarget,
-                            metadata: null, lineMarker: null, body: null, position: UNKNOWN_POSITION,
+                            op: "READ", aside: null, target: agentsTarget,
+                            metadata: null, lineMarker: null, matcher: null, body: null, position: UNKNOWN_POSITION,
                         };
                         initializationStatements.push(agentsRead);
                     }
                 }
             }
             // The persistent search-index pass (_search-index.maintain) attaches
-            // every readable entry/log projection to complete graph/FTS/vector derivations.
+            // every readable entry/log projection to complete graph/FTS derivations.
             // NOT an action: no log entry, no sequence slot,
             // not dispatched. There is no materialized manifest entry — the catalog
             // is served on demand by FIND: recursive when asked, shallow-mapped below.
-            // {§semantic-embed-dedup} — one pass-wide semantic plan binds every
-            // chunk counter to the derivation identity it produces.
             // SPEC {§membership} D4/D5 — git-ls-files workspace membership, resolved at
             // prompt-composition (EMI is eager + exhaustive — git is the only bound). When the
             // workspace's project_root is a git working tree, tracked files are
@@ -550,7 +442,7 @@ export default class TurnRunner {
             // Turn-0 catalog preview (PLURNK_SERVICE_FILES_ITEMS, {§actor-boundary-catalog-preview}):
             // Eight bodyless FIND surveys in the worker's packetless initialization turn establish the Agent
             // Skills, the plurnk references, the enabled tools, agents, and members, then the project, commons,
-            // and private surfaces, in that order.
+            // and named scratch, in that order.
             // Their `init` classification lets the model curate this opening survey as one log set.
             if (initializationTurn !== null) {
                 // {§operator-config-workspace-files-items} — workspace filesItems replaces the env default.
@@ -560,81 +452,49 @@ export default class TurnRunner {
                     const catalogSchemes = await this.#db.engine_scheme_catalog_summary.all({ workspace_id: workspaceId });
                     const fileItems = catalogSchemes.find(({ scheme }) => scheme === "file")?.shallow_items ?? 0;
                     const fileCap = filesItems > 0 && fileItems > 0 ? Math.min(filesItems, fileItems) : null;
-                    // {§tools-resource-materialization} — a PLURNK_MCP_EXPANDED server
-                    // contributes one FIND over its family document matching the
-                    // `### EXEC0` headings: one row per tool — heading, annotation,
-                    // signature — paged like every survey. No document is delivered
-                    // unasked; per-target child documents do not exist.
+                    // {§tools-resource-materialization} — expanded families project complete
+                    // invocation blocks, paged through ordinary FIND result ranges.
                     const registry = this.#executors();
-                    const references = await this.#packets.referenceEntries(workspaceId, workerId);
-                    const referenceNames = (namespace) => {
-                        const prefix = generatedPathname(`/${namespace}/`);
-                        return [...new Set(references.flatMap(({ pathname }) => {
-                                if (!pathname.startsWith(prefix) || !pathname.endsWith(".md"))
-                                    return [];
-                                const name = pathname.slice(prefix.length, -3);
-                                return name.includes("/") ? [] : [name];
-                            }))].toSorted();
-                    };
-                    const schemeExamples = new Map(this.#schemes.examples(workerId).map(({ name, source }) => [name, source]));
-                    const runtimeAdmitted = (runtime) => {
-                        const tools = registry?.toolRegistry(runtime, workerId);
-                        return tools === null || tools === undefined
-                            ? this.#capabilities.allowsRuntimeAcross(runtime, null, workerId, initializationPolicies)
-                            : tools.tools.some((tool) => this.#capabilities.allowsRuntimeAcross(runtime, tool.target, workerId, initializationPolicies));
-                    };
-                    const referenceAdmitted = (namespace, name) => {
-                        const entry = registry?.entry(name, workerId);
-                        const entryNamespace = entry?.resourcesPath === "/tools" ? "tools" : "plurnk";
-                        if (entry !== undefined && entryNamespace === namespace)
-                            return runtimeAdmitted(name);
-                        const source = schemeExamples.get(name);
-                        return source === undefined
-                            || this.#capabilities.allowsExampleAcross(source, workerId, initializationPolicies);
-                    };
-                    const plurnkReferences = referenceNames("plurnk");
-                    const toolReferences = referenceNames("tools");
-                    const plurnkCatalog = workerCatalogTarget("plurnk", plurnkReferences, plurnkReferences.filter((name) => referenceAdmitted("plurnk", name)));
-                    const toolsCatalog = workerCatalogTarget("tools", toolReferences, toolReferences.filter((name) => referenceAdmitted("tools", name)));
+                    const plurnkCatalog = workerCatalogTarget("plurnk");
+                    const toolsCatalog = workerCatalogTarget("tools");
                     const toolExpansions = [];
-                    for (const tag of registry?.availableRuntimes(workerId) ?? []) {
-                        const entry = registry?.entry(tag, workerId);
+                    for (const tag of registry?.availableRuntimes(workspaceId) ?? []) {
+                        const entry = registry?.entry(tag, workspaceId);
                         if (entry?.resourcesPath !== "/tools" || entry.expandTools !== true)
                             continue;
-                        const tools = registry?.toolRegistry(tag, workerId);
-                        const admittedTools = tools?.tools.filter((tool) => this.#capabilities.allowsRuntimeAcross(tag, tool.target, workerId, initializationPolicies)) ?? [];
+                        const tools = registry?.toolRegistry(tag, workspaceId);
+                        const admittedTools = tools?.tools.filter((tool) => this.#capabilities.allowsRuntimeAcross(tag, tool.target, workspaceId, initializationPolicies)) ?? [];
                         if (admittedTools.length === 0)
                             continue;
-                        const pattern = tools !== null && tools !== undefined && admittedTools.length !== tools.tools.length
-                            ? `^### EXEC0 \\[${regexLiteral(tag)}\\] \\((?:${admittedTools
-                                .map((tool) => regexLiteral(PathSyntax.escapeTarget(tool.target)))
-                                .join("|")})\\).*\\n.*$`
-                            : "^### EXEC0 .*\\n.*$";
+                        const targetFilter = tools !== null && tools !== undefined && admittedTools.length !== tools.tools.length
+                            ? " \\((?:" + admittedTools.map((tool) => regexLiteral(PathSyntax.escapeTarget(tool.target))).join("|") + ")\\)"
+                            : " ";
+                        const pattern = "^(\x60{3,})" + regexLiteral(tag) + targetFilter + "[^\\n]*?(?:\\1|\\n[\\s\\S]*?\\n\\1)$";
                         toolExpansions.push({
                             statement: {
-                                op: "FIND", delimiter: "", annotation: null,
-                                target: { kind: "url", raw: `worker://~/_plurnk/tools/${tag}.md`, scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: generatedPathname(`/tools/${tag}.md`), query: null, fragment: null },
+                                op: "FIND", aside: null,
+                                target: { kind: "url", raw: `worker:///_plurnk/tools/${tag}.md`, scheme: "worker", username: null, password: null, hostname: null, port: null, pathname: generatedPathname(`/tools/${tag}.md`), query: null, fragment: null },
                                 metadata: null,
-                                body: { dialect: "regex", raw: `/${pattern.replaceAll("/", "\\/")}/m`, pattern, flags: "m" },
-                                lineMarker: null, position: UNKNOWN_POSITION,
+                                matcher: { dialect: "regex", raw: `/${pattern.replaceAll("/", "\\/")}/m`, pattern, flags: "m" },
+                                body: null, lineMarker: null, position: UNKNOWN_POSITION,
                             },
                         });
                     }
                     const surveys = [
                         {
                             statement: {
-                                op: "FIND", delimiter: "", annotation: null,
-                                target: { kind: "url", raw: "worker://~/_plurnk/skills/*.md", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: generatedPathname("/skills/*.md"), query: null, fragment: null },
+                                op: "FIND", aside: null,
+                                target: { kind: "url", raw: "skill://*/SKILL.md", scheme: "skill", username: null, password: null, hostname: "*", port: null, pathname: "/SKILL.md", query: null, fragment: null },
                                 metadata: null,
-                                body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                                matcher: null, body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
                             },
                         },
                         ...(plurnkCatalog === null ? [] : [{
                                 statement: {
-                                    op: "FIND", delimiter: "", annotation: null,
+                                    op: "FIND", aside: null,
                                     target: plurnkCatalog,
                                     metadata: null,
-                                    body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                                    matcher: null, body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
                                 },
                             }]),
                         ...(toolsCatalog === null ? [] : [{
@@ -645,10 +505,10 @@ export default class TurnRunner {
                                 // PLURNK_MCP_EXPANDED add a second survey of their complete
                                 // tool tree.
                                 statement: {
-                                    op: "FIND", delimiter: "", annotation: null,
+                                    op: "FIND", aside: null,
                                     target: toolsCatalog,
                                     metadata: null,
-                                    body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                                    matcher: null, body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
                                 },
                             }]),
                         ...toolExpansions,
@@ -657,27 +517,28 @@ export default class TurnRunner {
                             // alias level; each row's summary is the agent's identity line,
                             // the exact card stays pullable through READ a2a://<alias>.
                             statement: {
-                                op: "FIND", delimiter: "", annotation: null,
-                                target: { kind: "url", raw: "worker://~/_plurnk/agents/*.md", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: generatedPathname("/agents/*.md"), query: null, fragment: null },
+                                op: "FIND", aside: null,
+                                target: { kind: "url", raw: "worker:///_plurnk/agents/*.md", scheme: "worker", username: null, password: null, hostname: null, port: null, pathname: generatedPathname("/agents/*.md"), query: null, fragment: null },
                                 metadata: null,
-                                body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                                matcher: null, body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
                             },
                         },
                         {
                             // {§members-projection} — enabled members definitions survey at alias
                             // level; each row's summary is what its glob resolved to.
                             statement: {
-                                op: "FIND", delimiter: "", annotation: null,
-                                target: { kind: "url", raw: "worker://~/_plurnk/members/*.md", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: generatedPathname("/members/*.md"), query: null, fragment: null },
+                                op: "FIND", aside: null,
+                                target: { kind: "url", raw: "worker:///_plurnk/members/*.md", scheme: "worker", username: null, password: null, hostname: null, port: null, pathname: generatedPathname("/members/*.md"), query: null, fragment: null },
                                 metadata: null,
-                                body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                                matcher: null, body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
                             },
                         },
                         {
                             statement: {
-                                op: "FIND", delimiter: "", annotation: "workspace files",
+                                op: "FIND", aside: "project root member files",
                                 target: { kind: "local", raw: "*" },
                                 metadata: null,
+                                matcher: null,
                                 body: null,
                                 lineMarker: fileCap === null ? null : { marks: [1, fileCap] },
                                 position: UNKNOWN_POSITION,
@@ -685,37 +546,52 @@ export default class TurnRunner {
                         },
                         {
                             statement: {
-                                op: "FIND", delimiter: "", annotation: "workspace entries",
+                                op: "FIND", aside: "shared worker Extended Context",
                                 target: { kind: "url", raw: "worker:///*", scheme: "worker", username: null, password: null, hostname: null, port: null, pathname: "/*", query: null, fragment: null },
                                 metadata: null,
-                                body: null, lineMarker: null, position: UNKNOWN_POSITION,
+                                matcher: null, body: null, lineMarker: null, position: UNKNOWN_POSITION,
                             },
                         },
                         {
                             statement: {
-                                op: "FIND", delimiter: "", annotation: "private worker entries",
-                                target: { kind: "url", raw: "worker://~/*", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: "/*", query: null, fragment: null },
+                                op: "FIND", aside: "private worker Extended Context",
+                                target: { kind: "url", raw: `worker://${workerName}/*`, scheme: "worker", username: null, password: null, hostname: workerName, port: null, pathname: "/*", query: null, fragment: null },
                                 metadata: null,
-                                body: null, lineMarker: null, position: UNKNOWN_POSITION,
+                                matcher: null, body: null, lineMarker: null, position: UNKNOWN_POSITION,
                             },
                         },
                     ];
-                    initializationStatements.push(...surveys.map(({ statement }) => statement));
+                    initializationStatements.push(...surveys.map(({ statement }) => statement).filter(({ target }) => this.#schemes.get(target?.kind === "url" ? target.scheme : "file", workspaceId) !== undefined));
                 }
-                const send = {
-                    op: "SEND", delimiter: "", annotation: null,
-                    status: 102, target: null, metadata: null, lineMarker: null,
-                    body: { raw: "Next: Address the prompt.", json: null },
+                const task = {
+                    op: "TASK", aside: null, target: null, metadata: null, lineMarker: null,
+                    body: [{ content: "Address the prompt.", status: "in_progress" }],
                     position: UNKNOWN_POSITION,
                 };
-                initializationStatements.push(send);
+                const pathname = `/${loopRow.sequence}/${initializationTurn.sequence}`;
+                await Turn.recordSource(this.#db, initializationTurn.id, "reasoning", ReasoningView.initialSource());
+                // {§reasoning-initial-read} — the pattern READ needs a text/plain projection to run the regex.
+                const pluck = await this.#mimetypes.getHandler("text/plain") !== null;
+                const reasoningRead = ReasoningView.initialRead(provider, loopRow.sequence, initializationTurn.sequence, pluck);
+                if (reasoningRead !== null)
+                    initializationStatements.push(reasoningRead);
+                initializationStatements.push({
+                    op: "READ", aside: "inspect this turn's emission", matcher: null, body: null, metadata: null,
+                    target: {
+                        kind: "url", raw: `ops://${pathname}`, scheme: "ops", pathname,
+                        username: null, password: null, hostname: null, port: null, query: null, fragment: null,
+                    },
+                    lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                });
+                // {§prompt-entry} — the prompt reaches the model as its `prompt` row in the first
+                // model turn; initialization does not READ it a second time.
+                initializationStatements.push(task);
                 const admittedInitializationStatements = initializationStatements.filter(initializationAdmits);
                 const source = TurnOps.renderInternal(admittedInitializationStatements);
                 const admitted = TurnOps.parseInternal(source);
                 const result = await this.executeAdmittedTurn({
                     statements: admitted,
                     source,
-                    sourceFolded: false,
                     origin: "_plurnk",
                     workspaceId,
                     workerId,
@@ -728,7 +604,7 @@ export default class TurnRunner {
                     onSettled,
                 });
                 if (result.status !== TURN_STATUS_IMPLICIT_CONTINUE) {
-                    throw new Error(`initialization SEND returned ${result.status}; expected ${TURN_STATUS_IMPLICIT_CONTINUE}`);
+                    throw new Error(`initialization TASK returned ${result.status}; expected ${TURN_STATUS_IMPLICIT_CONTINUE}`);
                 }
             }
             // Initialization is a complete preceding turn, not a set of rows
@@ -767,7 +643,7 @@ export default class TurnRunner {
                 const loopSeq = loopSeqRow?.sequence ?? loopId;
                 const prefix = promptLoopPrefix(loopSeq);
                 const undelivered = (await this.#db.drain_undelivered_prompts_for_loop.all({
-                    owner_id: workerId,
+                    worker_id: workerId,
                     pattern: `${prefix}%`,
                     prefix_len: prefix.length,
                     loop_id: loopId,
@@ -778,13 +654,12 @@ export default class TurnRunner {
                     if (attributes.openPaths !== undefined) {
                         turnOpenPaths.push(...assertOpenPaths(attributes.openPaths, `Prompt ${injectedRow.pathname} openPaths`));
                     }
-                    const ordinal = Number(injectedRow.pathname.split("/").filter(Boolean).at(-1));
                     const promptLogId = await this.#materialization.writePromptLog({
                         workerId,
                         loopId,
                         turnId,
                         sequence: nextActionIndex++,
-                        target: promptTarget(loopSeq, ordinal),
+                        target: promptTarget(workerName, injectedRow.pathname),
                         content: injectedRow.content,
                         source: promptSourceFromAttributes(attributes, `Prompt ${injectedRow.pathname} attributes`),
                     });
@@ -798,7 +673,7 @@ export default class TurnRunner {
             for (const raw of turnOpenPaths) {
                 const pathname = raw.startsWith("/") ? raw : `/${raw}`;
                 const fileRead = {
-                    op: "READ", delimiter: "", annotation: null, lineMarker: null,
+                    op: "READ", aside: null, lineMarker: null, matcher: null,
                     target: {
                         kind: "url", raw: `file://${pathname}`, scheme: "file",
                         username: null, password: null, hostname: null, port: null,
@@ -821,7 +696,7 @@ export default class TurnRunner {
             // the subsequent turn. The terminal output then surfaces initially visible via the stream-delta path.
             await this.#reapTurnScopedStreams(workerId);
             nextActionIndex += await this.#materialization.materializeEnvironmentDeltas({ workspaceId, workerId, loopId, turnId, fromSequence: nextActionIndex });
-            nextActionIndex += await this.#materialization.materializeStreamDeltas({ workerId, loopId, turnId, fromSequence: nextActionIndex });
+            nextActionIndex += await this.#materialization.materializeStreamDeltas({ workspaceId, workerId, loopId, turnId, fromSequence: nextActionIndex });
             // The post-reconciliation Git snapshot above is threaded into the packet
             // and every budget rebuild; overflow never shells again.
             // Notices are non-terminal observations, never operation-failure truth.
@@ -832,6 +707,7 @@ export default class TurnRunner {
             // queries log_entries scoped to the worker — the prompt entry just
             // written (if turn 1) is part of that query result.
             let promptProjection = "automatic";
+            const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
             const buildPacket = () => this.#packets.buildRequestPacket({
                 initialMessages: messages,
                 recap,
@@ -844,63 +720,35 @@ export default class TurnRunner {
                 notices,
                 transientOpenLogEntryId,
                 promptProjection,
+                turnId,
             });
             let requestPacket = await buildPacket();
-            // {§overflow-turn} — measured overflow diverts this would-be model
-            // turn into an ordinary packetless `_plurnk` operation batch. Every
-            // visibility effect goes through an ordinary Dispatcher scoped KILL; provider I/O is
-            // structurally unreachable on this branch.
-            const pressure = this.#packets.curationOverflow(requestPacket, provider);
-            if (pressure !== null) {
-                const kills = await OverflowTurn.plan(this.#db, loopId, turnId);
-                await Turn.becomeOverflow(this.#db, turnId);
-                const internalStatements = [
-                    OverflowTurn.planStatement(),
-                    ...kills.map(({ statement }) => statement),
-                    OverflowTurn.sendStatement(),
-                ];
-                const source = TurnOps.renderInternal(internalStatements);
-                const admitted = TurnOps.parseInternal(source);
-                const executed = await this.executeAdmittedTurn({
-                    statements: admitted,
-                    source,
-                    sourceFolded: true,
-                    origin: "_plurnk",
-                    workspaceId,
-                    workerId,
-                    loopId,
-                    turnId,
-                    fromSequence: nextActionIndex,
-                    failOnOperationError: true,
-                    signal: this.#loopSignal(loopId),
-                    onDispatch,
-                    onSettled,
-                });
-                if (executed.status !== TURN_STATUS_IMPLICIT_CONTINUE) {
-                    throw new Error(`overflow SEND returned ${executed.status}; expected ${TURN_STATUS_IMPLICIT_CONTINUE}`);
-                }
-                const rebuilt = await buildPacket();
-                const remaining = this.#packets.curationOverflow(rebuilt, provider);
-                const curationFailure = kills.length === 0 || remaining !== null
-                    ? curationOverflowFailure(remaining ?? pressure)
-                    : undefined;
+            // {§context-output-admission} — output admission changes no operation
+            // outcome, authored inventory, or turn identity.
+            if (await this.#packets.admitOutput(requestPacket, turnId))
+                requestPacket = await buildPacket();
+            const remaining = this.#packets.curationOverflow(requestPacket);
+            if (remaining !== null) {
+                const curationFailure = curationOverflowFailure(remaining);
+                await Turn.complete(this.#db, turnId, curationFailure.status);
                 return {
                     createdTurnIds,
                     turnId,
-                    producer: "_plurnk",
-                    kind: "overflow",
-                    status: curationFailure?.status ?? TURN_STATUS_IMPLICIT_CONTINUE,
+                    producer: "model",
+                    kind: "inference",
+                    status: curationFailure.status,
                     outcomes: [],
                     fingerprint: "",
                     capacityHardStop: false,
                     providerParked: false,
                     steerStruck: false,
+                    emptyTurn: false,
                     emissionAttempts: 0,
                     emissionExhausted: false,
-                    ...(curationFailure === undefined ? {} : { curationFailure }),
+                    curationFailure,
                 };
             }
-            let materializedRequest = await this.#wireMessages(requestPacket, workspaceId, provider);
+            let materializedRequest = await this.#wireMessages(requestPacket, systemCtx, provider);
             let modelMessages = materializedRequest.messages;
             let nativeInputs = materializedRequest.nativeInputs;
             // Curation pressure and provider generation are independent. The
@@ -908,8 +756,6 @@ export default class TurnRunner {
             let response;
             let splitResponse;
             let railGrammar;
-            let railResponseGrammar;
-            let railAllowWithheld = false;
             let railEvidence;
             let emissionAttempts = 0;
             let providerCallInFlight = false;
@@ -928,7 +774,6 @@ export default class TurnRunner {
             const providerSignal = this.#loopSignal(loopId) ?? signal;
             // {§client-metadata}
             const { client } = await WorkspaceSettings.read(this.#db, workspaceId);
-            const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
             const providerIdentity = await this.#resolveWorkerProviderIdentity(workerId);
             const { workerId: providerWorkerId, primaryWorkerId } = providerIdentity;
             const classifyProviderAttempt = async (id, attemptSplit, emissionAttempt, accepted) => {
@@ -947,7 +792,7 @@ export default class TurnRunner {
                 if (promptProjection === "automatic") {
                     promptProjection = "withheld";
                     const candidate = await buildPacket();
-                    const candidateRequest = await this.#wireMessages(candidate, workspaceId, provider);
+                    const candidateRequest = await this.#wireMessages(candidate, systemCtx, provider);
                     if (JSON.stringify(candidateRequest.messages) !== JSON.stringify(baselineMessages)) {
                         requestPacket = candidate;
                         materializedRequest = candidateRequest;
@@ -963,12 +808,9 @@ export default class TurnRunner {
                 // {§turn-lifecycle}: bracket the complete provider-attempt window with liveness notices.
                 if (!signal?.aborted)
                     this.#notices.push(workspaceId, workerId, loopId, { source: "engine:turn", kind: "turn_awaiting_model", level: "info", message: "awaiting model response" });
-                const railConstraint = await this.#grammarConstraint(provider);
-                railGrammar = railConstraint?.transport;
-                railResponseGrammar = railConstraint?.response;
-                railAllowWithheld = railConstraint?.allowWithheld ?? false;
+                railGrammar = await this.#operatorGrammar(provider);
                 const attemptLimit = readEmissionAttempts();
-                const strikeStreak = this.#strikes.streak(loopId);
+                const strikeStreak = await this.#strikes.streak(loopId);
                 // {§turn-accounting-notice} (#465) — every physical exchange this turn pays
                 // for, successes and failed calls alike, so the completion notice carries
                 // the exact settled wire spend.
@@ -1059,6 +901,7 @@ export default class TurnRunner {
                         completedResponse = await observed(// {§observability-boundary}
                         GEN_AI_REQUEST_SPAN, { model: provider.model, attempt: modelCallSequence }, async (span) => {
                             try {
+                                await this.#packets.recordObservations(requestPacket);
                                 const generated = await provider.generate({
                                     messages: modelMessages,
                                     workerId: providerWorkerId,
@@ -1116,7 +959,7 @@ export default class TurnRunner {
                                 // {§provider-interrupted-attempt} — the interrupted response stays durable
                                 // as an unaccepted attempt; it is never admitted or replayed.
                                 await currentModelCall.observeResponse(error.attempt, failure, nativeInputs);
-                                await classifyProviderAttempt(providerAttemptId, this.#splitResponse(error.attempt), currentEmissionAttempt, false);
+                                await classifyProviderAttempt(providerAttemptId, this.#splitResponse(error.attempt, this.#executors()?.availableRuntimes(workspaceId) ?? []), currentEmissionAttempt, false);
                             }
                             else {
                                 await currentModelCall.fail(failure, error.capacity ?? null);
@@ -1166,7 +1009,7 @@ export default class TurnRunner {
                         // Include the durable recovery signal in the replacement
                         // request while preserving the selected recovery posture.
                         requestPacket = await buildPacket();
-                        materializedRequest = await this.#wireMessages(requestPacket, workspaceId, provider);
+                        materializedRequest = await this.#wireMessages(requestPacket, systemCtx, provider);
                         modelMessages = materializedRequest.messages;
                         nativeInputs = materializedRequest.nativeInputs;
                         continue;
@@ -1187,10 +1030,8 @@ export default class TurnRunner {
                     response = completedResponse;
                     turnWireAccounting.push(...completedResponse.accounting);
                     await currentModelCall.observeResponse(completedResponse, null, nativeInputs);
-                    railEvidence = railGrammar === undefined
-                        ? undefined
-                        : TurnRunner.#requireGrammarEvidence(completedResponse, railAllowWithheld);
-                    splitResponse = this.#splitResponse(completedResponse);
+                    railEvidence = railGrammar === undefined ? undefined : completedResponse.grammarEvidence;
+                    splitResponse = this.#splitResponse(completedResponse, this.#executors()?.availableRuntimes(workspaceId) ?? []);
                     await classifyProviderAttempt(attemptRow.id, splitResponse, attempt, splitResponse.emissionValid);
                     if (splitResponse.emissionValid)
                         break;
@@ -1235,7 +1076,7 @@ export default class TurnRunner {
                 if (err instanceof ProviderError && err.attempt !== undefined) {
                     response = err.attempt;
                     await providerModelCall.observeResponse(response, failure, nativeInputs);
-                    splitResponse = this.#splitResponse(response);
+                    splitResponse = this.#splitResponse(response, this.#executors()?.availableRuntimes(workspaceId) ?? []);
                     await classifyProviderAttempt(providerAttemptId, splitResponse, currentEmissionAttempt, false);
                 }
                 else {
@@ -1244,10 +1085,9 @@ export default class TurnRunner {
                         emissionAttempts = currentEmissionAttempt;
                 }
                 // {§turn-never-blank} — a ProviderError means no completed exchange exists.
-                // Persist its exact RFC 9457 result before propagating it. Grammar evidence
-                // and its engine-owned verdict exist only on completed responses
-                // ({§rail-truth-engine-verdict}). Cancellation is lifecycle truth, not a
-                // provider failure. Close the
+                // Persist its exact RFC 9457 result before propagating it. Grammar transport
+                // evidence exists only on completed responses ({§operator-grammar}).
+                // Cancellation is lifecycle truth, not a provider failure. Close the
                 // attempted turn without inventing an assistant response, then let
                 // runLoop/Daemon settle the exact 504/499 loop result.
                 if (providerSignal?.aborted) {
@@ -1256,7 +1096,8 @@ export default class TurnRunner {
                         workspaceId, workerId, loopId, turnId,
                         evidence: {
                             packet: StoredPacket.stringify(requestPacket),
-                            usageCurationBudget: this.#packets.curationBudgetFor(provider),
+                            sections: StoredPacket.sections(requestPacket),
+                            usageCurationBudget: this.#packets.curationBudgetFor(requestPacket),
                             finishReason: splitResponse?.callMetadata.finishReason ?? null,
                             model: splitResponse?.callMetadata.model ?? provider.model,
                             meta: JSON.stringify(response?.meta ?? {}),
@@ -1281,7 +1122,8 @@ export default class TurnRunner {
                     workspaceId, workerId, loopId, turnId,
                     evidence: {
                         packet: StoredPacket.stringify(requestPacket),
-                        usageCurationBudget: this.#packets.curationBudgetFor(provider),
+                        sections: StoredPacket.sections(requestPacket),
+                        usageCurationBudget: this.#packets.curationBudgetFor(requestPacket),
                         finishReason: splitResponse?.callMetadata.finishReason ?? null,
                         model: splitResponse?.callMetadata.model ?? provider.model,
                         meta: JSON.stringify(response?.meta ?? {}),
@@ -1308,6 +1150,7 @@ export default class TurnRunner {
                         capacityHardStop: false, providerParked: true,
                         providerFailure: recorded.result,
                         steerStruck: false,
+                        emptyTurn: false,
                         emissionAttempts,
                         emissionExhausted: false,
                     };
@@ -1325,6 +1168,7 @@ export default class TurnRunner {
                         providerParked: false,
                         capacityFailure: recorded.result,
                         steerStruck: false,
+                        emptyTurn: false,
                         emissionAttempts,
                         emissionExhausted: false,
                     };
@@ -1347,6 +1191,7 @@ export default class TurnRunner {
                         providerParked: false,
                         providerFailure: recorded.result,
                         steerStruck: false,
+                        emptyTurn: false,
                         emissionAttempts,
                         emissionExhausted: false,
                     };
@@ -1357,6 +1202,9 @@ export default class TurnRunner {
                 throw new Error("provider attempt loop completed without a response");
             }
             const emissionModelCallId = providerModelCall.id;
+            if (splitResponse.packetAssistant.reasoning?.length) {
+                await Turn.recordSource(this.#db, turnId, "reasoning", splitResponse.packetAssistant.reasoning, { modelCallId: emissionModelCallId });
+            }
             if (!splitResponse.emissionValid) {
                 // {§invalid-emission-attempts} Every exhaustion publishes the raw final
                 // response and its recovery fact; {§engine-rails} Contract Strikes rule
@@ -1370,9 +1218,6 @@ export default class TurnRunner {
                         turnId,
                         sequence: nextActionIndex,
                         modelCallId: emissionModelCallId,
-                        ...(response.assistant.reasoningEncrypted?.length
-                            ? { reasoningItems: response.assistant.reasoningEncrypted }
-                            : {}),
                     });
                     // {§invalid-emission-attempts} — the informed turn carries the parser's own
                     // diagnostic and position: the model sees WHY, not only that it was refused.
@@ -1405,7 +1250,8 @@ export default class TurnRunner {
                     workspaceId, workerId, loopId, turnId,
                     evidence: {
                         packet: StoredPacket.stringify(requestPacket),
-                        usageCurationBudget: this.#packets.curationBudgetFor(provider),
+                        sections: StoredPacket.sections(requestPacket),
+                        usageCurationBudget: this.#packets.curationBudgetFor(requestPacket),
                         finishReason: splitResponse.callMetadata.finishReason,
                         model: splitResponse.callMetadata.model,
                         meta: JSON.stringify(response.meta ?? {}),
@@ -1423,6 +1269,7 @@ export default class TurnRunner {
                     capacityHardStop: false,
                     providerParked: false,
                     steerStruck: false,
+                    emptyTurn: false,
                     emissionAttempts,
                     emissionExhausted: true,
                     ...(rejectedModelEntryId === undefined ? {} : { rejectedModelEntryId }),
@@ -1434,9 +1281,22 @@ export default class TurnRunner {
             for (const notice of parseNotices) {
                 this.#notices.push(workspaceId, workerId, loopId, notice);
             }
+            // {§empty-turn} — a response cut at the output allowance with nothing admitted names the
+            // cut, so the model reads the ceiling, never a parser symptom (#478).
+            if (splitResponse.emptyTurn && callMetadata.finishReason === "length") {
+                const cut = allowanceCutMessage(callMetadata.finishReason, response.capacity.responseMax ?? provider.outputBudget);
+                if (cut !== null) {
+                    this.#notices.push(workspaceId, workerId, loopId, {
+                        source: "engine:turn",
+                        kind: "output_truncated",
+                        level: "warn",
+                        message: `${cut}; no operations were performed`,
+                    });
+                }
+            }
             // Non-fatal provider transport notices on an accepted turn. Forward each
             // Notice with a content-offset `line:col`;
-            // the model resolves it against its own emission — READ the body-suppressed turnOps row at the
+            // the model resolves it against its own emission — READ ops:///<loop>/<turn> at the
             // cited lines ({§turn-ops-entry}) — not an embedded snippet that would duplicate the emission.
             for (const notice of response.notices ?? []) {
                 const located = typeof notice.position === "number"
@@ -1461,45 +1321,12 @@ export default class TurnRunner {
                     level: "warn",
                 });
             }
-            // Grade configured local evidence independently. Endpoint-owned
-            // constraints remain provider observations. {§rail-truth-engine-verdict}
-            let railKeys;
-            if (railGrammar !== undefined) {
-                if (railEvidence === undefined)
-                    throw new Error("configured GBNF response has no final grammar evidence");
-                if (railResponseGrammar === undefined)
-                    throw new Error("configured GBNF has no response grammar");
-                let verdict = null;
-                try {
-                    verdict = validateGbnf(railResponseGrammar, railEvidence.input);
-                }
-                catch (cause) {
-                    TurnRunner.#warnRailVerdictGapOnce(cause.message);
-                }
-                railKeys = {
-                    railsAttached: railEvidence.transported ? "client" : "withheld",
-                    railsVerdict: verdict?.status ?? "unverifiable",
-                };
-                if (verdict !== null && verdict.status !== "accept" && allowanceCut === null) {
-                    const contentPosition = verdict.pos >= railEvidence.contentStart
-                        ? verdict.pos - railEvidence.contentStart
-                        : null;
-                    const located = contentPosition === null
-                        ? null
-                        : this.#offsetToLineColumn(packetAssistant.content, contentPosition);
-                    this.#notices.push(workspaceId, workerId, loopId, {
-                        source: "engine:rails",
-                        kind: "grammar_unenforced",
-                        message: verdict.status === "reject"
-                            ? `emission rejects the grammar at raw code point ${verdict.pos}`
-                            : `emission is an incomplete grammar sentence (ends at raw code point ${verdict.pos})`,
-                        level: "warn",
-                        ...(located === null
-                            ? {}
-                            : { position: { type: "content-offset", line: located.line, column: located.column } }),
-                    });
-                }
-            }
+            // {§operator-grammar} — transport evidence only: the turn records whether the operator's
+            // grammar reached the wire. Nothing grades the response against it; the parser's
+            // admission is the one verdict (#588).
+            const railKeys = railGrammar === undefined
+                ? undefined
+                : { railsAttached: railEvidence?.transported === true ? "client" : "withheld" };
             // Attach the admitted inference evidence. The turn remains open until
             // the producer-neutral admitted-turn executor settles every operation
             // and its exact source artifact.
@@ -1508,11 +1335,12 @@ export default class TurnRunner {
                 workspaceId, workerId, loopId, turnId,
                 evidence: {
                     packet: StoredPacket.stringify(packet),
-                    usageCurationBudget: this.#packets.curationBudgetFor(provider), // {§tokenomics-client-gauge}
+                    sections: StoredPacket.sections(packet),
+                    usageCurationBudget: this.#packets.curationBudgetFor(requestPacket), // {§tokenomics-client-gauge}
                     finishReason: callMetadata.finishReason,
                     model: callMetadata.model,
-                    // Opaque provider metadata plus engine-authored rail keys.
-                    // {§meta-passthrough}, {§rail-truth-engine-verdict}
+                    // Opaque provider metadata plus the grammar transport key.
+                    // {§meta-passthrough}, {§operator-grammar}
                     meta: JSON.stringify({ ...(response.meta ?? {}), ...(railKeys ?? {}) }),
                 },
             });
@@ -1520,15 +1348,10 @@ export default class TurnRunner {
             // narrows the operator ceiling before the admitted program reaches the
             // shared executor.
             const maxCommands = Math.min(readMaxCommands(), (await WorkspaceSettings.read(this.#db, workspaceId)).maxCommands ?? Number.POSITIVE_INFINITY);
-            const reasoningItems = response.assistant.reasoningEncrypted?.length
-                ? response.assistant.reasoningEncrypted
-                : undefined;
             const executed = await this.executeAdmittedTurn({
                 statements: packetAssistant.ops,
                 source: splitResponse.sourceBacked ? packetAssistant.content : null,
-                sourceFolded: true,
                 sourceModelCallId: emissionModelCallId,
-                ...(reasoningItems !== undefined ? { sourceReasoningItems: reasoningItems } : {}),
                 origin: "model",
                 workspaceId,
                 workerId,
@@ -1536,8 +1359,9 @@ export default class TurnRunner {
                 turnId,
                 fromSequence: nextActionIndex,
                 maxCommands,
-                enforceIdle: true,
+                allowUnobservedRetrievalCompletion,
                 recoverableParseErrors,
+                emptyTurn: splitResponse.emptyTurn,
                 bare: {
                     provider: childProvider,
                     primaryWorkerId,
@@ -1560,6 +1384,7 @@ export default class TurnRunner {
                 capacityHardStop: false,
                 providerParked: false,
                 steerStruck: executed.steerStruck,
+                emptyTurn: executed.emptyTurn,
                 emissionAttempts,
                 emissionExhausted: false,
             };
@@ -1592,13 +1417,11 @@ export default class TurnRunner {
     // its assistant payload to skip the parse roundtrip. The wire Provider
     // contract has no `ops` field; only Mock exposes one. Real providers
     // always take the parse path because their `assistant.ops` is undefined.
-    #splitResponse(response) {
+    #splitResponse(response, executors = []) {
         const { assistant } = response;
         const preParsedOps = assistant.ops;
         const ops = [];
-        // PLAN is an ordinary op — emitted by the model, dispatched, and passed to the
-        // client as a log entry. No special hoisting into the reasoning field. Only
-        // structured operations are executable; interstitial text is not an operation.
+        // Only structured operations are executable; interstitial text is not an operation.
         // Full PlurnkParseError context is preserved on rejected attempt evidence;
         // warnings remain admissible Notices. {§parse-diagnostics}
         const parseErrors = [];
@@ -1611,7 +1434,9 @@ export default class TurnRunner {
             // {§observability-boundary} — the parse is observed without its input;
             // only the resulting statement count is attributable.
             const parsed = observedSync("contracts.parse", {}, (span) => {
-                const result = PlurnkParser.parse(assistant.content);
+                // {§fence-heading-in-body} {§interstitial-fence} — the executors this workspace can run
+                // are heading tags to the parser; anything else tagged is a code block.
+                const result = PlurnkParser.parse(assistant.content, { executors });
                 span.setAttribute("statements", result.items.filter((item) => item.kind === "statement").length);
                 return result;
             });
@@ -1637,7 +1462,7 @@ export default class TurnRunner {
                             });
                         }
                         else {
-                            parseErrors.push({ message: err.message, line: err.line, column: err.column, source: err.source });
+                            parseErrors.push({ message: err.message, line: err.line, column: err.column, source: err.source, ...(err.code === undefined ? {} : { code: err.code }) });
                         }
                     }
                     else {
@@ -1655,25 +1480,23 @@ export default class TurnRunner {
             }
         }
         const sourceStatementCount = ops.filter(({ position }) => position.line > 0).length;
-        const plan = ops[0]?.op === "PLAN" ? ops[0] : undefined;
-        const finalOp = ops.at(-1);
-        const terminalSend = finalOp?.op === "SEND"
-            && finalOp.status !== null
-            && TERMINAL_SEND_SIGNALS.has(finalOp.status)
-            ? finalOp
-            : undefined;
-        const recoveredSend = terminalSend?.position.line === 0;
-        // {§turn-shape} — PLAN is a SHOULD: a turn without one is complete once it ends in a
-        // terminal SEND, and the recoverable window then starts at the turn's first statement.
-        const recoverableParseErrors = terminalSend !== undefined && !hasUnparsedTail
-            ? parseErrors.filter((error) => (error.message === PlurnkParser.MISSING_SEND
-                || ((plan === undefined || comparePosition(error, plan.position) > 0)
-                    && (recoveredSend || comparePosition(error, terminalSend.position) < 0)))).toSorted(comparePosition)
+        const dispositions = ops.filter(TurnDisposition.is);
+        const trustworthyBoundary = dispositions.length <= 1 && !hasUnparsedTail;
+        // {§turn-shape} — bounded operation errors are recoverable and ride with the
+        // admitted program; document-boundary failures still reject it.
+        const recoverableParseErrors = trustworthyBoundary
+            ? parseErrors.filter((error) => error.code !== "invalid-turn-structure").toSorted(comparePosition)
             : [];
+        // {§empty-turn} — no operation and no other hard error: admitted as an empty turn, never
+        // resampled; its advisories ({§bare-heading-advisory}) ride as notices.
+        const emptyTurn = preParsedOps === undefined
+            && trustworthyBoundary
+            && sourceStatementCount === 0
+            && parseErrors.every((error) => error.message === PlurnkParser.NO_VALID_OPERATION);
         const emissionValid = preParsedOps !== undefined
-            || (terminalSend !== undefined
+            || emptyTurn
+            || (trustworthyBoundary
                 && sourceStatementCount > 0
-                && !hasUnparsedTail
                 && recoverableParseErrors.length === parseErrors.length);
         const reasoning = assistant.reasoning ?? null;
         return {
@@ -1681,18 +1504,19 @@ export default class TurnRunner {
             sourceBacked: preParsedOps === undefined,
             callMetadata: { finishReason: assistant.finishReason, model: assistant.model },
             parseErrors,
-            recoverableParseErrors: emissionValid ? recoverableParseErrors : [],
+            recoverableParseErrors: emissionValid && !emptyTurn ? recoverableParseErrors : [],
+            emptyTurn,
             parseNotices,
             // The ANTLR model-turn parser is authoritative. At least one source
-            // operation lets an omitted terminal SEND default around it; the
-            // exact defaults and bounded statement failures become durable
-            // operation results. Boundary loss and an unparsed tail still reject
+            // operation is required; TASK omission continues silently. Bounded
+            // statement failures become durable operation results.
+            // Boundary loss and an unparsed tail still reject
             // wholesale. Pre-parsed ops are Mock's trusted test seam.
             emissionValid,
         };
     }
     // #note12 — plugin reference docs are materialized beneath
-    // worker://~/_plurnk/plurnk/ by LoopDocs.
+    // worker:///_plurnk/plurnk/ by LoopDocs.
     // {§exec-poll} — EXEC `<0>` is turn-scoped: abort the worker's open turn-scoped streams via their
     // owning scheme (the same registry-routed abort the total reap uses). Called at each pre-turn
     // before the turn's own spawns, so every open turn-scoped sub here is from a prior turn — it