@plurnk/plurnk-service 1.3.12 → 1.4.0

package/dist/core/PacketBuilder.js

@@ -4,24 +4,89 @@ import { rulerCount } from "./token-ruler.js";
 import { docsExcludeSet } from "./teaching.js";
 import { Policy } from "@plurnk/plurnk-execs";
 import WorkspaceSettings from "./workspace-settings.js";
-import { DEFAULT_LOOP_FLAGS } from "./scheme-types.js";
+import LoopFlagsReader from "./LoopFlagsReader.js";
 import { readPacketInject, readSystemPolicy, readProjectPolicy } from "./packet-inject.js";
 import { readFile } from "node:fs/promises";
-import { resolve as resolvePath } from "node:path";
 import Paths from "../Paths.js";
+import { readTeachingSource } from "./teaching-corpus.js";
 // Shared module imported by both Engine and bin/digest.ts, so wire
 // projection and digest projection are structurally one function — no
 // drift between wire and digest possible.
 import PacketWire from "./packet-wire.js";
-import { scopeEnvToAlias, resolveActiveAlias } from "@plurnk/plurnk-providers";
+import { assertPromptTokenMeasurement, scopeEnvToAlias, resolveActiveAlias } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "./ProviderInstantiate.js";
-// Substituted into the budget readout after the assembled packet is measured
-// (the figure depends on the packet's own rendered size — chicken/egg).
-const TOKENS_FREE_PLACEHOLDER = "{{tokensFree}}";
-const TOKEN_USAGE_PLACEHOLDER = "{{tokenUsage}}";
-const TOKEN_PERCENT_PLACEHOLDER = "{{tokenPercent}}";
-const SYSTEM_CTX_PLACEHOLDER = "{{systemCtx}}"; // #440 — treemap's non-turn overhead = total − Σturns, known only post-assembly
-// §tokenomics-window-partition — the four partition numbers. REQUIRED (fail-hard, the
+import BudgetOverflow from "./BudgetOverflow.js";
+import BudgetReadout from "./BudgetReadout.js";
+const trimHorizontal = (value) => value.replace(/^[\t ]+|[\t ]+$/gu, "");
+const tableCells = (line) => {
+    if (!line.startsWith("|") || !line.endsWith("|"))
+        return null;
+    const cells = [];
+    let start = 1;
+    for (let index = 1; index < line.length - 1; index += 1) {
+        if (line[index] !== "|")
+            continue;
+        let escapes = 0;
+        for (let previous = index - 1; previous >= start && line[previous] === "\\"; previous -= 1)
+            escapes += 1;
+        if (escapes % 2 === 1)
+            continue;
+        cells.push(line.slice(start, index));
+        start = index + 1;
+    }
+    cells.push(line.slice(start, -1));
+    return cells;
+};
+const isTableDivider = (cells) => cells.length > 0 && cells.every((cell) => /^:?-{3,}:?$/u.test(trimHorizontal(cell)));
+// {§definition-table-projection} — plurnk.md remains spacious for human editing;
+// only its well-formed Markdown tables lose authoring alignment on the packet wire.
+const compactDefinitionTables = (markdown) => {
+    const lines = markdown.split("\n");
+    let fence = null;
+    let inTable = false;
+    let dividerIndex = -1;
+    return lines.map((rawLine, index) => {
+        const carriageReturn = rawLine.endsWith("\r") ? "\r" : "";
+        const line = carriageReturn.length > 0 ? rawLine.slice(0, -1) : rawLine;
+        const fenceRun = line.match(/^ {0,3}(`{3,}|~{3,})/u)?.[1];
+        if (fence !== null) {
+            const closingRun = line.match(/^ {0,3}(`+|~+)[\t ]*$/u)?.[1];
+            if (closingRun?.[0] === fence.marker && closingRun.length >= fence.length)
+                fence = null;
+            return rawLine;
+        }
+        if (fenceRun !== undefined) {
+            fence = { marker: fenceRun[0], length: fenceRun.length };
+            inTable = false;
+            dividerIndex = -1;
+            return rawLine;
+        }
+        const cells = tableCells(line);
+        if (!inTable) {
+            const nextRawLine = lines[index + 1] ?? "";
+            const nextLine = nextRawLine.endsWith("\r") ? nextRawLine.slice(0, -1) : nextRawLine;
+            const dividerCells = tableCells(nextLine);
+            if (cells === null || dividerCells === null || cells.length !== dividerCells.length || !isTableDivider(dividerCells))
+                return rawLine;
+            inTable = true;
+            dividerIndex = index + 1;
+        }
+        else if (cells === null) {
+            inTable = false;
+            dividerIndex = -1;
+            return rawLine;
+        }
+        if (index === dividerIndex) {
+            const divider = cells.map((cell) => {
+                const value = trimHorizontal(cell);
+                return `${value.startsWith(":") ? ":" : ""}---${value.endsWith(":") ? ":" : ""}`;
+            });
+            return `|${divider.join("|")}|${carriageReturn}`;
+        }
+        return `| ${cells.map(trimHorizontal).join(" | ")} |${carriageReturn}`;
+    }).join("\n");
+};
+// {§tokenomics-window-partition} — the four partition numbers. REQUIRED (fail-hard, the
 // providers-env convention): the ceiling is DERIVED from these, never set directly
 // (PLURNK_BUDGET_CEILING is retired — a settable ceiling let policy contradict physics).
 const readPartitionIntFrom = (env, name, min) => {
@@ -31,40 +96,47 @@ const readPartitionIntFrom = (env, name, min) => {
         throw new Error(`${name} must be an integer >= ${min}; got ${raw}`);
     return n;
 };
-// Packet assembly (SPEC §packet-assembly) + the budget grinder (§grinder):
+const readOptionalPositiveIntFrom = (env, name) => {
+    const raw = env[name];
+    if (raw === undefined || raw.length === 0)
+        return null;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0)
+        throw new Error(`${name} must be a positive integer; got ${raw}`);
+    return n;
+};
+// Packet assembly (SPEC {§packet-assembly}) + the budget grinder ({§grinder}):
 // builds the spec'd request packet, measures it, and reclaims window on overflow.
 class PacketBuilder {
     #db;
     #schemes;
-    #telemetry;
+    #problems;
     // Boot-discovered runtime executors, late-injected on Engine after daemon
     // start() — read through a thunk so the post-construction set is visible.
     #executors;
-    // §tokenomics-window-partition — the partition is PER-ALIAS (#352), resolved per provider in
+    // {§tokenomics-window-partition} — the partition is PER-ALIAS, resolved per provider in
     // #partitionFor and cached by alias; no boot-time global read.
-    constructor({ db, schemes, telemetry, executors }) {
+    constructor({ db, schemes, problems, executors }) {
         this.#db = db;
         this.#schemes = schemes;
-        this.#telemetry = telemetry;
+        this.#problems = problems;
         this.#executors = executors;
-        // #507 — the envelope rides the provider; construction only runs the retired-knob shed
+        // {§tokenomics-window-partition} — the envelope rides the provider; construction only runs the retired-knob shed
         // so a stale operator .env fails at BOOT, not first use.
-        this.#safetyFor(resolveActiveAlias(process.env)?.alias ?? "");
+        const bootAlias = resolveActiveAlias(process.env)?.alias ?? "";
+        this.#safetyFor(bootAlias);
+        this.#promptBudgetCapFor(bootAlias);
     }
-    // #352 — the generation envelope is PER-ALIAS: gemma keeps its measured llama-server policy
-    // envelope (n_predict honored to the context wall — the cap MUST bound it, providers#10);
-    // cloud aliases get a generous default and the backend self-clamps to its true output limit.
+    // {§tokenomics-window-partition} — provider generation settings and core packet policy both resolve per alias.
     // scopeEnvToAlias resolves PLURNK_SERVICE_*_<alias> over the bare fallback with providers' own
     // battle-tested suffix parser. Cached per alias; the boot-global case falls back to the active
     // alias when a provider carries no side-table entry (a test Mock).
-    // #507 (owner-ruled full migration): the generation envelope is PROVIDER-owned — the window
-    // and both reserves ride the Provider surface (contextWindow/reasoningReserve/completionReserve,
-    // ingested or PLURNK_PROVIDERS_*-pinned in the provider tier). Core keeps ONE knob: SAFETY,
-    // the ruler's own packing margin — a service fact, not a model fact.
-    static #KNOBS = ["PLURNK_SERVICE_SAFETY"];
+    // Provider context and response reserves remain provider-owned. Core owns only its virtual
+    // prompt budget and the ruler's packing-safety margin.
+    static #KNOBS = ["PLURNK_SERVICE_PROMPT_BUDGET", "PLURNK_SERVICE_SAFETY"];
     #shedChecked = false;
     #safetyFor(alias) {
-        // #507 hard shed (the #472 pattern): the three misprefixed partition knobs moved to the
+        // {§tokenomics-window-partition} hard shed: the three misprefixed partition knobs moved to the
         // provider tier; a stale operator .env must never silently lose its envelope to the move.
         if (!this.#shedChecked) {
             this.#shedChecked = true;
@@ -76,108 +148,84 @@ class PacketBuilder {
             for (const k of Object.keys(process.env)) {
                 const m = /^PLURNK_SERVICE_(CTX|CONTEXT_WINDOW|REASONING|ASSISTANT|COMPLETION)(_.*)?$/.exec(k);
                 if (m !== null)
-                    throw new Error(`${k} is retired (#507): the envelope is provider-owned — the knob is ${MOVED[m[1]]}${m[2] ?? ""}.`);
+                    throw new Error(`${k} is retired: the envelope is provider-owned — the knob is ${MOVED[m[1]]}${m[2] ?? ""}.`);
             }
         }
         const view = scopeEnvToAlias(process.env, alias, _a.#KNOBS);
         return readPartitionIntFrom(view, "PLURNK_SERVICE_SAFETY", 0);
     }
-    // #421 — §tokenomics-window-unpollable-deliberate: provider.contextWindow null (env/probe/catalog
-    // all missed, provider-tier pins included) is genuinely-unknown — nobody chose an envelope. The
-    // budget/ceiling short-circuit to NO-CAP rather than substitute a stand-in the operator never chose.
-    #isUnboundedWindow(provider) {
-        return provider.contextWindow === null;
+    #promptBudgetCapFor(alias) {
+        const view = scopeEnvToAlias(process.env, alias, _a.#KNOBS);
+        return readOptionalPositiveIntFrom(view, "PLURNK_SERVICE_PROMPT_BUDGET");
     }
     #partitionFor(provider) {
         const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
         return { reasoning: provider.reasoningReserve ?? null, completion: provider.completionReserve ?? null, safety: this.#safetyFor(alias) };
     }
-    // #528 — the operator's CONTEXT_WINDOW pin is the LOG-budget cap, core-composed: the provider
-    // reports its natural window (construction strips the pin), and the cap tightens only the
-    // prompt — never the reserves, which stay task-natural. Alias-scoped else bare; garbage fails hard.
-    #capFor(provider) {
-        const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
-        const raw = scopeEnvToAlias(process.env, alias).PLURNK_PROVIDERS_CONTEXT_WINDOW;
-        if (raw === undefined || raw.length === 0)
-            return null;
-        const cap = Number.parseInt(raw, 10);
-        if (!Number.isInteger(cap) || cap <= 0)
-            throw new Error(`PLURNK_PROVIDERS_CONTEXT_WINDOW must be a positive integer, got '${raw}'`);
-        return cap;
-    }
     // The generation envelope — REASONING + COMPLETION, one undifferentiated pool, passed on
-    // every generate({maxTokens}): no decode is unbounded (§tokenomics-window-partition). Per
-    // alias (#352): gemma's measured envelope; a cloud alias's generous default the backend clamps.
+    // every generate({maxTokens}): no decode is unbounded ({§tokenomics-window-partition}). Per
+    // alias: gemma's measured envelope; a cloud alias's generous default the backend clamps.
     maxTokensFor(provider) {
         const { reasoning, completion } = this.#partitionFor(provider);
         if (reasoning === null || completion === null)
-            return null; // #421 — unknown envelope, no cap; the backend clamps
+            return null; // {§tokenomics-window-unpollable-deliberate}: unknown envelope, no cap; the backend clamps
         return reasoning + completion;
     }
-    // §tokenomics-window-partition — the prompt ceiling
-    // is DERIVED, never set: effectiveWindow = min(CONTEXT_WINDOW, provider window; CONTEXT_WINDOW alone when the
-    // provider reports none) minus the reserves, divided by the loop's observed real/measured
-    // token ratio (usage.prompt is ground truth; a heuristic ruler shipped a 65k-real packet into
-    // a 49k window, #311). A fractional ceiling also budgeted the prompt against the window and
-    // FORGOT the response lives there too. Reserves exceeding the window is a configuration
-    // contradiction — fail hard. ratio floors at 1: an overcounting ruler never expands the budget.
-    // #274/#312 follow-up (owner): the CLIENT-facing gauge denominator — the prompt budget the
-    // packet actually lives under (effective window minus the partition reserves), in REAL token
-    // space (usage.prompt, the numerator, is real; the calibration ratio maps measured→real and
-    // has no business here). The raw n_ctx overstates usable room by the reserve total.
+    // {§tokenomics-window-partition} — the natural prompt ceiling is the provider's
+    // effective context window minus its response reserves and the service's ruler
+    // safety. An optional service prompt budget may only tighten that result. It is
+    // model-facing grinder policy, never provider physics or a generation setting.
+    // The client-facing gauge, grinder ceiling, and persisted promptBudget use this one value.
     promptBudgetFor(provider) {
-        return this.ceilingFor(provider); // ONE derivation (#528) — the gauge denominator IS the grinder ceiling
+        return this.ceilingFor(provider); // ONE derivation — the gauge denominator IS the grinder ceiling
     }
-    // §tokenomics-agnostic-ruler — the ceiling is the real window partition (window − reserves),
+    // {§tokenomics-agnostic-ruler} — the ceiling is the real window partition (window − reserves),
     // NO calibration ratio: the model-facing measure is the chars/2 ruler (an over-count for
     // typical text), so comparing ruler-weight to the real-token ceiling is itself the conservative
-    // bias — the model curates against less room than it has and never overflows for typical
-    // content; the exact provider count guards the pathological tail at the materialization gate.
+    // bias - the packet reports less room than the provider usually has; authoritative
+    // provider request evidence guards the pathological tail at recovery admission.
     ceilingFor(provider) {
-        if (this.#isUnboundedWindow(provider) || provider.contextWindow === null)
-            return null; // #421 — no cap: the gauge headline is omitted
+        const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
+        const operatorCap = this.#promptBudgetCapFor(alias);
+        // Unknown provider physics stays unknown; an explicit virtual ceiling still bounds
+        // PLURNK's packet without pretending to describe the backend.
+        if (provider.contextWindow === null)
+            return operatorCap;
         const { reasoning, completion, safety } = this.#partitionFor(provider);
         if (reasoning === null || completion === null)
-            return null; // #421 — unknown reserves, no ceiling
+            return operatorCap;
         const naturalBudget = provider.contextWindow - reasoning - completion - safety;
         if (naturalBudget <= 0) {
-            const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
-            // #507 — post-migration this contradiction has ONE cause: pinned absolute reserves
+            // {§tokenomics-window-partition} — this contradiction has one cause: pinned absolute reserves
             // exceeding the window the provider detected (percent reserves derive and cannot contradict).
             throw new Error(`window partition contradiction for alias '${alias}': window ${provider.contextWindow} <= reserves ${reasoning}+${completion}+${safety}. Pinned PLURNK_PROVIDERS_{REASONING,COMPLETION}_RESERVE absolutes exceed the detected window — repin them under it, or use percent reserves, which derive from the window.`);
         }
-        // #528 — the operator's cap tightens the PROMPT alone (reserves above are off the natural
-        // window). A cap tighter than the reserves is deliberate tightening, not a contradiction —
-        // the budget floors at 1 (0 and 1 force the same every-packet-413; the usage record needs
-        // a positive denominator). ONE derivation: the grinder ceiling IS the gauge denominator.
-        const cap = this.#capFor(provider);
-        if (cap === null)
-            return naturalBudget;
-        return Math.max(1, Math.min(cap, provider.contextWindow) - reasoning - completion - safety);
+        return operatorCap === null ? naturalBudget : Math.min(operatorCap, naturalBudget);
     }
-    // Assemble the request half of the spec'd packet (Packet.json system
-    // and §user) BEFORE the provider call. The same packet object is then
-    // completed with assistant + assistantRaw after the model responds, so
-    // the stored packet and the wire payload share one source of truth.
-    async buildRequestPacket({ initialMessages, requirements, workspaceId, workerId, loopId, currentTurnSeq, provider, gitStatus, telemetryErrors: presetTelemetry, }) {
+    // {§packet-stored-shape} — assemble the system/user request before the
+    // provider call; complete the same record with the provider response.
+    async buildRequestPacket({ initialMessages, requirements, workspaceId, workerId, loopId, currentTurnSeq, provider, gitStatus, notices = [], }) {
         const byRole = (role) => initialMessages.filter((m) => m.role === role).map((m) => m.content).join("\n\n");
         // plurnk.md (grammar/dialects) ONLY — the definition is the hot-path grammar.
-        // The scheme catalogue is its own `schemes` section below tools (§schemes-directory),
-        // NOT appended here: grammar 0.49+ is scheme-agnostic, so the service advertises
-        // the scheme set at packet-time (grammar#239 item 7) via SchemeRegistry.teach().
-        const system_definition = byRole("system");
-        // the prompt section sources from the loop's most recent prompt entry first
-        // (plurnk://prompt/<run>/<loop>/<N> for the highest N written to date).
-        // This is what inject + the turn-1 foist write into. Falls back to
-        // the runLoop caller's messages.user for tests that bypass the
-        // foist mechanism entirely.
+        // The scheme catalogue is its own `schemes` section below tools ({§schemes-directory}),
+        // NOT appended here: the language teaching is scheme-agnostic, so the service advertises
+        // the installed scheme set at packet-time via SchemeRegistry.teach().
+        const system_definition = compactDefinitionTables(byRole("system"));
+        // The prompt section sources the loop's prompt:///<loop>/<N> entries.
+        // Inject and turn-1 initialization write them. Bare callers that
+        // bypass prompt persistence fall back to messages.user.
         const loopSeqRow = await this.#db.engine_loop_sequence.get({ loop_id: loopId });
-        const promptRows = (await this.#db.drain_get_all_prompt_bodies_for_loop.all({ owner_id: workerId, pattern: `${promptLoopPrefix(loopSeqRow?.sequence ?? loopId)}%` }))
+        const promptPrefix = promptLoopPrefix(loopSeqRow?.sequence ?? loopId);
+        const promptRows = (await this.#db.drain_get_all_prompt_bodies_for_loop.all({
+            owner_id: workerId,
+            pattern: `${promptPrefix}%`,
+            prefix_len: promptPrefix.length,
+        }))
             .filter((r) => typeof r.content === "string" && r.content.length > 0);
-        // §prompt-auto-read (owner): the section is a PATHS list (the errors shape — no bodies);
-        // each prompt's content reaches the model through its foisted auto-READ in the log, and
-        // prior prompts stay READable by the listed address — never silently lost, never an
-        // unfair curation imposition. Fallback: callers that bypass the foist (bare messages)
+        // The section is a paths list (the errors shape - no bodies);
+        // each prompt's content reaches the model through its actionless prompt row, and
+        // prior prompts stay READable by the listed address - never silently lost, never an
+        // unfair curation imposition. Fallback: callers that bypass persistence (bare messages)
         // still get their user text rendered directly.
         const prompt = promptRows.length > 0
             ? promptRows.map((r) => `* prompt://${r.pathname}`).join("\n")
@@ -186,44 +234,29 @@ class PacketBuilder {
         // exactly how it went missing (callers read the sysprompt but never the
         // requirements). Read Paths.defaultRequirements (PLURNK_SERVICE_REQUIREMENTS env →
         // requirements.md) fresh each build so edits take effect; a non-empty param wins.
-        const baseRequirements = requirements.length > 0 ? requirements : await readFile(Paths.defaultRequirements, "utf8");
-        // No injected syntax line: the grammar already headlines the system definition (§Syntax) and
-        // leads requirements.md, so a third copy here was pure duplication in the model's packet. PLAN
-        // is mandated unconditionally by plurnk.md §Imperatives (grammar 0.70 requires every turn to
-        // lead with PLAN), so the service injects no separate plan directive either.
+        const baseRequirements = requirements.length > 0
+            ? requirements
+            : Paths.defaultRequirementsTeachingSource === null
+                ? await readFile(Paths.defaultRequirements, "utf8")
+                : await readTeachingSource(Paths.defaultRequirementsTeachingSource);
+        // {§emission-admission}: the definition owns PLAN framing, so the packet
+        // injects no duplicate syntax or plan directive.
         const log = await this.#buildLog(workerId);
-        const telemetryErrors = presetTelemetry ?? await this.buildTelemetryErrors(loopId, currentTurnSeq);
-        const countTokens = rulerCount; // §tokenomics-agnostic-ruler — the ONE model-facing ruler (chars/2), not the provider
-        // #367 — the capability sheet must reflect the LOOP MODE, not just workspace-enablement: an
-        // ask-mode loop advertises only what its dispatch gate (resolveForLoop) will accept, so the
-        // model is never taught a tag it'll then be 403'd on (the taught→emitted→rejected→508 spiral).
-        const activeSchemes = this.#schemes.resolveForLoop(await this.#loadLoopFlags(loopId));
+        const failures = await this.buildFailurePointers(loopId, currentTurnSeq);
+        const countTokens = rulerCount; // {§tokenomics-agnostic-ruler} — the ONE model-facing ruler (chars/2), not the provider
+        // {§tools-loop-affinity}: teaching and dispatch resolve the same loop flags.
+        const activeSchemes = this.#schemes.resolveForLoop(await LoopFlagsReader.read(this.#db, loopId));
         const tools = this.#collectTools(await this.#workspaceEnabled(workspaceId), await WorkspaceSettings.questionsEnabled(this.#db, workspaceId), activeSchemes);
-        // Budget readout (SPEC.md §tokenomics). Two-pass: render the budget from
-        // the structured log's subtotals with a {{tokensFree}} placeholder, build
-        // the section list, measure the assembled total, resolve free, substitute.
-        // Subtotals come from the real log render — meta and fences included — not
-        // a serialized approximation. ceiling is the provider's window ×
-        // PLURNK_BUDGET_CEILING (null when no window is reported → headline
-        // omitted, section lines still shown). §tokenomics-render-weight-budget
         const ceiling = this.ceilingFor(provider);
-        const logBudget = PacketWire.measureLogBudget(log, countTokens);
-        const budgetReadout = this.#renderBudget(logBudget, ceiling);
-        // The default packet: an ordered list of addressable sections (§packet-assembly).
-        // `slot` is the MESSAGE boundary — and therefore the cache breakpoint every serving
-        // stack keys on. The wire is monotone in volatility ({§packet-cache-monotone}, #531):
-        // system = the timeless (definition/tools/schemes/policy — byte-stable doctrine), user
-        // = the situated (append-mostly log → per-turn status clump → recap), so the prefix
-        // cache survives through the log's frozen head instead of dying at the first gauge
-        // digit. Trust is the one-way ADMISSION rule, not the slot: system admits only
-        // framework-authored, non-injectable content; engine-authored status may ride user;
-        // attacker-reachable text may never ride system. The budget section carries its
-        // {{tokensFree}} placeholders here; they resolve below once the assembled total is known.
-        const inject = await readPacketInject(); // #240 — operator section, per-turn, fail-hard on a broken path
+        const budgetReadout = BudgetReadout.draft(ceiling);
+        // The canonical default order, trust boundary, and cache-locality bias are
+        // specified at {§packet-cache-monotone}. Budget placeholders resolve only
+        // after trusted whole-list transforms establish the packet being measured.
+        const inject = await readPacketInject(); // {§packet-inject} — per-turn; a broken configured path fails hard
         const workspaceRoot = (await this.#db.envelope_get_workspace.get({ id: workspaceId }))?.project_root ?? null;
         const systemPolicy = await readSystemPolicy(); // ~/.plurnk/AGENTS.md (or PLURNK_SERVICE_POLICY)
         const projectPolicy = await readProjectPolicy(workspaceRoot); // <projectRoot>/AGENTS.md (or PLURNK_SERVICE_PROJECT)
-        // Child-orientation (§child-orientation): the live things THIS run holds — open streams +
+        // Child-orientation ({§child-orientation}): the live things this worker holds — open streams +
         // unconcluded child workers — surfaced every turn as terse `* <status> <path>` pointers (same shape
         // as errors) just above the errors section. Orienting STATE so the model never loses track of
         // what it's holding (the premature-terminate trap), never advice on what to do. Empty → omitted.
@@ -232,193 +265,71 @@ class PacketBuilder {
         const childWorkers = (await this.#db.engine_child_workers_live.all({ worker_id: workerId }))
             .map((r) => ({ status: r.status, path: `worker://${r.name}` }));
         const defaults = [
-            { name: "definition", slot: "system", header: null, content: system_definition, tokens: 0 },
-            { name: "tools", slot: "system", header: "Registered Executable Tools", content: tools.executors, tokens: 0 },
+            { name: "definition", slot: "system", header: null, content: system_definition },
+            { name: "tools", slot: "system", header: "Registered Executable Tools", content: tools.executors },
             ...(tools.optionalOperations.length > 0
-                ? [{ name: "optional-operations", slot: "system", header: "Enabled Optional Operations", content: tools.optionalOperations, tokens: 0 }]
+                ? [{ name: "optional-operations", slot: "system", header: "Enabled Optional Operations", content: tools.optionalOperations }]
                 : []),
-            { name: "schemes", slot: "system", header: "Schemes", content: this.#schemes.teach(), tokens: 0 },
-            ...(inject !== null ? [{ name: "inject", slot: "system", header: "Operator Notes", content: inject, tokens: 0 }] : []),
+            { name: "schemes", slot: "system", header: "Schemes", content: this.#schemes.teach() },
+            ...(inject !== null ? [{ name: "inject", slot: "system", header: "Operator Notes", content: inject }] : []),
             // policy: the client's privileged rules — ~/.plurnk/AGENTS.md (system) then <root>/AGENTS.md (project) — below grammar/tools/schemes, above budget-the-law. AGENTS is POLICY here, never a curatable READable entry. Empty content ⇒ section omitted.
-            { name: "system-policy", slot: "system", header: "Policy", content: systemPolicy ?? "", tokens: 0 },
-            { name: "project-policy", slot: "system", header: "Project Policy", content: projectPolicy ?? "", tokens: 0 },
-            // log leads the user slot: injectable content (READ results, exec output, the model's own mirror) — data, never rules — its frozen head extends the cache prefix ({§packet-cache-monotone}).
-            { name: "log", slot: "user", header: "Log", content: PacketWire.renderLog(log, countTokens), tokens: 0 },
-            // The status clump — every per-turn-volatile section, quarantined between the log and
-            // the recap ({§packet-cache-monotone}, #531): after the append-only log so its churn
-            // never invalidates the log's cache prefix, and nearest the generation point (the
-            // dashboard reads freshest exactly where the model acts). Engine-authored riding the
-            // user slot is the legal trust direction; errors are uri+status POINTERS (the item +
-            // body live in the log), git is counts — no injection surface either way.
-            // child-orientation: what THIS run holds live — streams then runs — just above errors. Terse
-            // pointers (the path is the actionable address the model READs/OPENs/KILLs), never advice. §child-orientation
-            { name: "child-streams", slot: "user", header: "Child Streams", content: PacketWire.renderChildPointers(childStreams), tokens: 0 },
-            { name: "child-workers", slot: "user", header: "Active Child Workers", content: PacketWire.renderChildPointers(childWorkers), tokens: 0 },
-            { name: "errors", slot: "user", header: "Errors", content: PacketWire.renderErrors(telemetryErrors), tokens: 0 },
-            { name: "git", slot: "user", header: "Git Status", content: PacketWire.renderGit(gitStatus), tokens: 0 },
+            { name: "system-policy", slot: "system", header: "Policy", content: systemPolicy ?? "" },
+            { name: "project-policy", slot: "system", header: "Project Policy", content: projectPolicy ?? "" },
+            // The append-mostly log leads volatile user status ({§packet-cache-monotone}).
+            { name: "log", slot: "user", header: "Log", content: PacketWire.renderLog(log, countTokens) },
+            // The per-turn status clump sits between log and recap ({§packet-cache-monotone}).
+            // child-orientation: what this worker holds live — streams then child workers — just above errors. Terse
+            // pointers (the path is the actionable address the model READs/OPENs/KILLs), never advice. {§child-orientation}
+            { name: "child-streams", slot: "user", header: "Child Streams", content: PacketWire.renderChildPointers(childStreams) },
+            { name: "child-workers", slot: "user", header: "Active Child Workers", content: PacketWire.renderChildPointers(childWorkers) },
+            { name: "errors", slot: "user", header: "Errors", content: PacketWire.renderFailurePointers(failures) },
+            { name: "notices", slot: "user", header: "Notices", content: PacketWire.renderNotices(notices) },
+            { name: "git", slot: "user", header: "Git Status", content: PacketWire.renderGit(gitStatus) },
             // budget — LAW (a hard ceiling the model must obey).
-            { name: "budget", slot: "user", header: "Budget", content: budgetReadout, tokens: 0 },
-            // §prompt-auto-read (owner): the prompts section closes the status clump —
-            // a paths-only list (the errors shape); bodies arrive via the foisted auto-READ.
-            { name: "prompt", slot: "user", header: "User Prompts", content: prompt, tokens: 0 },
+            { name: "budget", slot: "user", header: "Budget", content: budgetReadout },
+            // The prompts section closes the status clump as a paths-only list;
+            // bodies arrive through first-class prompt rows.
+            { name: "prompt", slot: "user", header: "User Prompts", content: prompt },
             // requirements renders LAST — the user-slot footer, the syntax contract closest to the model's turn (a recency carve-out for weak models).
-            { name: "requirements", slot: "user", header: "Recap", content: baseRequirements, tokens: 0 },
+            { name: "requirements", slot: "user", header: "Recap", content: baseRequirements },
         ];
-        // Plugin packet control (§packet-assembly): trusted schemes rewrite the
+        // Plugin packet control ({§packet-assembly}): trusted schemes rewrite the
         // default list — add, remove, reorder — in-process, before measurement.
-        const sections = await this.#schemes.transformSections(defaults);
-        // Pass 1: measure the assembled total with the placeholder budget in
-        // place, resolve free/percent, substitute into the budget section.
-        let total = countTokens(PacketWire.renderSlot(sections, "system")) + countTokens(PacketWire.renderSlot(sections, "user"));
-        {
-            const budgetSec = sections.find((s) => s.name === "budget"); // a plugin may have removed it
-            // A null ceiling (#421 — unbounded window) has no headline to calibrate: no truncation, no
-            // percent/free substitution. #renderBudget already omitted the headline, so nothing to do.
-            if (budgetSec && ceiling !== null) {
-                // Curation pressure gates on OCCUPANCY (§tokenomics-pressure-gates-on-occupancy, #308):
-                // the Turns/Heaviest tables are a standing FOLD-target list, and a high-headroom model
-                // reads them as a todo — burning turns on token hygiene at 3% of a 64k window. Under
-                // half-full, the headline's numbers stand alone (truncate at the first blank line) and
-                // the total RE-measures — the substituted figures must reconcile with what ships.
-                // A null ceiling can't calibrate, so the full readout stays.
-                // A mermaid budget (#440) self-scales to pressure, so it is never truncated — the calm
-                // low-usage view IS the point; only the tabular readout collapses under half-full.
-                if (!budgetSec.content.includes("```mermaid") && (total / ceiling) * 100 < 50) {
-                    const cut = budgetSec.content.indexOf("\n\n");
-                    if (cut !== -1) {
-                        budgetSec.content = budgetSec.content.slice(0, cut);
-                        total = countTokens(PacketWire.renderSlot(sections, "system")) + countTokens(PacketWire.renderSlot(sections, "user"));
-                    }
-                }
-                const tokensFree = Math.max(0, ceiling - total); // free floors at 0 on overshoot — §tokenomics-over-budget-floor
-                const percent = (total / ceiling) * 100; // usage as % of the ceiling — §tokenomics-context-percent
-                const sumTurns = logBudget.byTurn.reduce((s, t) => s + t.tokens, 0); // #440 — treemap non-turn box = total − Σturns
-                const systemCtx = Math.max(0, total - sumTurns);
-                // replaceAll: a mermaid budget recurs free/used across the headline + treemap + pie, so a
-                // single .replace would leave the diagrams carrying literal {{…}} placeholders.
-                budgetSec.content = budgetSec.content
-                    .replaceAll(TOKEN_USAGE_PLACEHOLDER, String(total))
-                    // Any nonzero usage under 1% is "<1" — Math.round alone claimed "1%" from 0.51%,
-                    // overstating a near-empty window.
-                    .replaceAll(TOKEN_PERCENT_PLACEHOLDER, total > 0 && percent < 1 ? "<1" : String(Math.round(percent)))
-                    .replaceAll(TOKENS_FREE_PLACEHOLDER, String(tokensFree))
-                    .replaceAll(SYSTEM_CTX_PLACEHOLDER, String(systemCtx));
-            }
+        let drafts = await this.#schemes.transformSections(defaults);
+        const budgetSection = drafts.find((section) => section.name === "budget");
+        if (budgetSection !== undefined && ceiling !== null) {
+            const content = BudgetReadout.resolve(budgetSection.content, ceiling, (candidate) => {
+                const candidateDrafts = drafts.map((section) => section === budgetSection ? { ...section, content: candidate } : section);
+                return countTokens(PacketWire.renderSlot(candidateDrafts, "system"))
+                    + countTokens(PacketWire.renderSlot(candidateDrafts, "user"));
+            });
+            drafts = drafts.map((section) => section === budgetSection ? { ...section, content } : section);
         }
-        // Pass 2: per-section render-weight + the assembled packet total (post
-        // substitution — the placeholder/number length delta is negligible).
-        for (const s of sections)
-            s.tokens = countTokens(PacketWire.renderSection(s));
+        // Core alone turns validated drafts into measured durable sections.
+        const sections = drafts.map((section) => ({
+            ...section,
+            tokens: countTokens(PacketWire.renderSection(section)),
+        }));
         const packetTokens = countTokens(PacketWire.renderSlot(sections, "system")) + countTokens(PacketWire.renderSlot(sections, "user"));
-        return { tokens: packetTokens, sections, telemetryErrors };
-    }
-    // Budget readout body, rendered into the `## Plurnk Service Budget` section.
-    // Headline `ceiling/free` only when a ceiling exists; section lines for the
-    // curatable index/log weight the model can FOLD back. tokensFree is a
-    // placeholder here — buildRequestPacket substitutes it after measuring the packet.
-    #renderBudget(log, ceiling) {
-        const lines = [];
-        // #421 — no ceiling (unbounded window): omit the headline entirely; the section lines below
-        // stay so the model keeps its FOLD-target surface, just with no percent it can't compute.
-        if (ceiling !== null)
-            lines.push(`Token Ceiling ${ceiling} · Token Usage ${TOKEN_USAGE_PLACEHOLDER} (${TOKEN_PERCENT_PLACEHOLDER}%) · Tokens Free ${TOKENS_FREE_PLACEHOLDER}`);
-        // #440 {§budget-mermaid} — the enriched visual Budget (default on). With a ceiling to scale
-        // against, the treemap REPLACES the Turns table (per-turn composition) + a pie gauge; the
-        // heaviest-items list stays a table (#450). Self-scaled to pressure (calm→urgent), never <50%-truncated.
-        // Set PLURNK_SERVICE_BUDGET_MERMAID=off to A/B against the tabular baseline (#440's before/after).
-        if (process.env.PLURNK_SERVICE_BUDGET_MERMAID !== "off" && ceiling !== null && log.entries > 0) {
-            if (lines.length > 0)
-                lines.push("");
-            lines.push(_a.#renderBudgetMermaid(log, ceiling));
-            // #450 — the heaviest items stay a plain ranked list (a ranking isn't a composition, no
-            // treemap; two mermaid diagrams are enough visual examples) — the same table as the tabular budget.
-            lines.push(..._a.#heaviestItemsLines(log.largest));
-            return lines.join("\n");
-        }
-        if (log.entries > 0) {
-            if (lines.length > 0)
-                lines.push("");
-            lines.push(`Log entries: ${log.entries} entries, ${log.tokens} tokens`);
-            // Per-turn weight — chronological (oldest first); the turn is the grinder's
-            // rollback unit and the rail folds the newest first (§tokenomics {§tokenomics-turn-totals}).
-            if (log.byTurn.length > 0) {
-                lines.push("", "Turns:", "| turn | tokens |", "|---|--:|");
-                for (const t of log.byTurn)
-                    lines.push(`| ${t.turn} | ${t.tokens} |`);
-            }
-            lines.push(..._a.#heaviestItemsLines(log.largest));
-        }
-        return lines.join("\n");
-    }
-    // The heaviest individual log items — the FOLD targets behind the weight, a ranked LIST in both the
-    // mermaid and tabular budgets (#450: a ranking isn't a composition, so it's never a chart). "items",
-    // not "entries": log:/// rows, distinct from catalog entries (plurnk.md: "EDIT is only for entries").
-    // {§tokenomics-largest-entries}
-    static #heaviestItemsLines(largest) {
-        if (largest.length === 0)
-            return [];
-        return ["", "Heaviest items (FOLD targets — folding reclaims their tokens):", "| item | tokens |", "|---|--:|",
-            ...largest.map((e) => `| ${e.path} | ${e.tokens} |`)];
-    }
-    // #440 {§budget-mermaid} — the Budget as two budget-scaled mermaid diagrams (validated to render on
-    // GitHub; syntax: plurnk-plurnkdown/demo/budget-mermaid.md). Both scaled to the CEILING, so salience
-    // tracks pressure: `free` dominates at low usage (calm), turn boxes fill as it climbs (urgent).
-    // free/used/system+context are placeholders — the post-assembly total resolves them. (#450 cut the xychart.)
-    static #renderBudgetMermaid(log, ceiling) {
-        // Turn composition → treemap: turn boxes + system+context + free compose the whole ceiling —
-        // the per-turn FOLD surface (which turns are heavy, labeled `turn L/T`) the headline can't give.
-        const treemap = [
-            "```mermaid",
-            "treemap-beta",
-            `"Budget — ceiling ${ceiling}"`,
-            `    "free": ${TOKENS_FREE_PLACEHOLDER}`,
-            `    "system + context": ${SYSTEM_CTX_PLACEHOLDER}`,
-            ...log.byTurn.map((t) => `    "turn ${t.turn}": ${t.tokens}`),
-            "```",
-        ].join("\n");
-        // Gauge → pie: used vs free, budget-scaled (used + free = ceiling); also a visual exemplar for
-        // the model's own user-facing SENDs. (#450 cut the heaviest-items xychart — its bare-coordinate
-        // labels a floor model can't decode, and the treemap already surfaces per-turn heaviness.)
-        const pie = [
-            "```mermaid",
-            "pie showData",
-            `    title Budget — used vs free (ceiling ${ceiling})`,
-            `    "used" : ${TOKEN_USAGE_PLACEHOLDER}`,
-            `    "free" : ${TOKENS_FREE_PLACEHOLDER}`,
-            "```",
-        ].join("\n");
-        return [treemap, pie].join("\n\n");
+        return { tokens: packetTokens, sections, attributions: [] };
     }
-    // #328 — the per-workspace client execs policy narrows what the packet ADVERTISES, matching what
-    // dispatch refuses: a workspace-disabled tag is absent from the capability sheet and the doc set,
-    // never taught-then-refused. No policy (execs unset) → everything boot-registered shows.
+    // {§operator-config-workspace-execs} — the capability sheet and executor
+    // documents share one workspace predicate with dispatch.
     async #workspaceEnabled(workspaceId) {
         const { execs } = await WorkspaceSettings.read(this.#db, workspaceId);
         if (execs === null)
             return () => true;
         return (tag) => Policy.isEnabled(tag, execs);
     }
-    // The ## Registered Executable Tools capability sheet (SPEC §tools). Each available executor
-    // tag contributes its self-documenting example (plurnk-execs#7); the closed heading distinguishes
-    // registered selectors from the open-ended general examples above it. §tools-capability-sheet
-    // Mirror of Dispatcher.#loadLoopFlags — the packet reads the SAME persisted flags the gate does.
-    async #loadLoopFlags(loopId) {
-        const row = await this.#db.engine_get_loop_flags.get({ loop_id: loopId });
-        if (row === undefined)
-            return DEFAULT_LOOP_FLAGS;
-        try {
-            return { ...DEFAULT_LOOP_FLAGS, ...JSON.parse(row.flags) };
-        }
-        catch {
-            return DEFAULT_LOOP_FLAGS;
-        }
-    }
+    // The ## Registered Executable Tools capability sheet. Each available executor
+    // tag contributes its self-documenting example; the closed heading distinguishes
+    // registered selectors from the open-ended general examples above it. {§tools-capability-sheet}
     #collectTools(workspaceEnabled, questionsOn = false, activeSchemes) {
-        // §PACKET Tools (#441) — registered executor examples form a closed, explicitly titled
-        // catalogue. Optional non-EXEC operations are separate so the heading remains truthful.
+        // Registered executors and optional operations remain distinct fenced sheets.
+        // {§tools-capability-sheet} {§packet-operation-fences}
         const executorOps = [];
         const notices = [];
-        // §send-300-choices — the one-liner rides ONLY where questions are enabled (allowed +
+        // {§send-300-choices} — the one-liner rides ONLY where questions are enabled (allowed +
         // client-requested); the fuller questions.md doc injects through docEntries the same way.
         const optionalOperations = questionsOn
             ? "```plurnk\n<<SEND[300]:Deploy where?;staging;production:SEND\n```"
@@ -427,7 +338,7 @@ class PacketBuilder {
         if (executors !== undefined) {
             const excluded = docsExcludeSet();
             const runtimes = executors.availableRuntimes();
-            // execs#24 / #367: the sheet's lines are EXEC-usage examples, keyed on the 'exec' scheme
+            // {§tools-capability-sheet} The sheet's lines are EXEC-usage examples, keyed on the 'exec' scheme
             // (the op face, excludedInAsk). When inactive, say so POSITIVELY (a prose notice): plurnk.md
             // still teaches EXEC as language, and silent absence measurably invites confabulated runtimes.
             const execActive = activeSchemes === undefined || activeSchemes.has("exec");
@@ -437,12 +348,12 @@ class PacketBuilder {
             else {
                 for (const tag of runtimes) {
                     if (excluded.has(tag))
-                        continue; // #240 — PLURNK_SERVICE_DOCS_EXCLUDE drops the oneliner + the doc
+                        continue; // {§tools-capability-sheet} — exclude drops the example and doc
                     if (!workspaceEnabled(tag))
-                        continue; // #328 — workspace-disabled tags aren't advertised
+                        continue; // {§operator-config-workspace-execs}
                     const entry = executors.entry(tag);
-                    // #240 — the example IS the oneliner (a bare op, fenced below); the fuller doc
-                    // materializes at plurnk://docs/<tag>.md. No example → no line.
+                    // {§tools-capability-sheet} — the example is the bare op fenced below; the fuller doc
+                    // materializes at worker://plurnk/docs/<tag>.md. No example → no line.
                     if (entry?.example)
                         executorOps.push(entry.example);
                 }
@@ -454,28 +365,25 @@ class PacketBuilder {
         return { executors: parts.join("\n\n"), optionalOperations };
     }
     // #note12 — the plugin-provided reference docs (schemes' + execs' `documentation`),
-    // materialized at plurnk:///docs/<name>.md by loop_run (like operator docs) so the
-    // catalogue's doc-links READ and the manifest carries each doc's token weight.
+    // materialized at worker://plurnk/docs/<name>.md by LoopDocs (like operator
+    // docs) so the catalog can expose each doc's token weight.
     async docEntries(workspaceId) {
-        const out = this.#schemes.docs(); // scheme docs already drop PLURNK_SERVICE_DOCS_EXCLUDE names
-        // §send-300-choices — the conditional teaching: questions.md (from the docs corpus)
+        const out = await this.#schemes.docs(); // scheme docs already drop PLURNK_SERVICE_DOCS_EXCLUDE names
+        // {§send-300-choices} {§teaching-corpus} — the conditional teaching: questions.md
         // materializes ONLY for enabled workspaces — the same conditional-doc mechanism as the EXEC
         // plugin docs below. An un-enabled workspace is never taught the op it can't use.
         if (await WorkspaceSettings.questionsEnabled(this.#db, workspaceId)) {
-            try {
-                const q = await readFile(resolvePath(Paths.schemeDocs, "questions.md"), "utf8");
-                if (q.length > 0)
-                    out.push({ name: "questions", content: q });
-            }
-            catch { /* docs package without questions.md — nothing to inject */ }
+            const q = await this.#schemes.questionsDoc();
+            if (q.length > 0)
+                out.push({ name: "questions", content: q });
         }
         const executors = this.#executors();
         if (executors !== undefined) {
             const excluded = docsExcludeSet();
-            const workspaceEnabled = await this.#workspaceEnabled(workspaceId); // #328 — no doc for a disabled tag
+            const workspaceEnabled = await this.#workspaceEnabled(workspaceId); // {§operator-config-workspace-execs}
             for (const tag of executors.availableRuntimes()) {
                 if (excluded.has(tag))
-                    continue; // #240 — exec docs honor the same exclude
+                    continue; // {§tools-capability-sheet} — exec docs honor the same exclude
                 if (!workspaceEnabled(tag))
                     continue;
                 const doc = executors.entry(tag)?.documentation;
@@ -485,90 +393,120 @@ class PacketBuilder {
         }
         return out;
     }
-    // SPEC §grinder — the budget grinder. Runs pre-LLM (in runTurn, after the packet
+    // SPEC {§grinder} — the budget grinder. Runs pre-LLM (in runTurn, after the packet
     // is built, before provider.generate); fires only on actual overflow. One rule:
     // fold the NEWEST turn boundary's open rows (errors exempt) — never history —
     // strike, rebuild, re-measure. Folds (never deletes). The strike it raises and
     // the hard-stop it can signal are returned to runLoop, which owns abandonment.
-    // §grinder-overflow-only — fires only on actual overflow, never speculatively
+    // {§grinder-overflow-only} — fires only on actual overflow, never speculatively
     async enforceBudget({ packet, provider, workerId, loopId, turnId, mintSequence, rebuild }) {
         const ceiling = this.ceilingFor(provider);
         const measure = (p) => p.tokens;
-        // #421 — a null ceiling is an unbounded window: always fit, never fold or strike (the backend
-        // clamps; this mirrors Engine's physicallySendable, which treats a null contextWindow as sendable).
-        if (ceiling === null || measure(packet) <= ceiling)
-            return { packet, fit: true, struck: false };
-        // ONE rule, every turn — turn 1 and turn 101 alike (§grinder-layer1-rollback): fold the
+        // {§tokenomics-window-unpollable-deliberate} — a null policy ceiling never triggers grinding. If a virtual ceiling
+        // does trigger recovery while provider physics is unknown, physical admission
+        // separately fails closed under {§tokenomics-physical-admission}.
+        if (ceiling === null || measure(packet) <= ceiling) {
+            return { packet, fit: true, struck: false, recorded: false };
+        }
+        // ONE rule, every turn — turn 1 and turn 101 alike ({§grinder-layer1-rollback}): fold the
         // NEWEST turn boundary's still-open rows (the prior turn's emissions + this turn's
         // pre-model rows; errors exempt) in one set-op, strike once, rebuild, re-measure.
-        // THE DOCTRINE: the log is the model's memory and the model ALONE curates history — the
-        // grinder never reaches back; it only blocks NEW memories from landing when there is no
-        // room, forcing the model to do its own housekeeping (the strike is the escalation,
-        // §grinder-compaction-strikes; a model that won't curate hard-413s/strikes out).
-        // Mint the overflow as a terse op='error' log row BEFORE the rebuild, so the rebuild's
-        // re-derived errors section surfaces it THIS turn — the warning lands at strike 1, not a
-        // turn late. The row is grinder-exempt, so it stacks into a visible recurrence trail. It
-        // sits at the turn's reserved running sequence (mintSequence) so it never collides with the
-        // post-generate dispatch rows. §telemetry-uniform-error-channel, §grinder-overflow-error-row
-        await this.#telemetry.mintEngineError("budget_overflow", { workerId, loopId, turnId, sequence: mintSequence });
-        await this.#db.engine_grinder_fold_newest_turn.run({ loop_id: loopId, turn_id: turnId });
-        const current = await rebuild();
-        return { packet: current, fit: measure(current) <= ceiling, struck: true };
-    }
-    // §tokenomics-agnostic-ruler — the EXACT materialization measure: the provider's own token
-    // count of the assembled packet, the ONE place per-model exactness is used (once per turn, at
-    // the fit-gate). The model-facing render-weight (packet.tokens) stays the ruler; this is the
-    // physics check that the real bytes fit the real window.
-    exactPacketTokens(packet, provider) {
-        return provider.countTokens(PacketWire.renderSlot(packet.sections, "system"))
-            + provider.countTokens(PacketWire.renderSlot(packet.sections, "user"));
-    }
-    // Complete the packet by adding the model's response. After this the
-    // packet matches Packet.json fully and is ready for storage.
-    completePacket(requestPacket, assistant, assistantRaw, provider) {
-        const assistantTokens = rulerCount(assistant.content); // §tokenomics-agnostic-ruler — render-weight in ruler units (usage_* keep the provider's real count)
+        // The model owns history visibility. The grinder never reaches back; it folds only the
+        // newest boundary required to produce a physically valid packet. Continued overflow
+        // follows the explicit recovery/hard-stop contract ({§grinder-fold-strikes}).
+        const usage = measure(packet);
+        await this.#db.engine_grinder_fold_newest_turn({ loop_id: loopId, turn_id: turnId });
+        let current = await rebuild();
+        if (measure(current) > ceiling) {
+            // Engine owns the hard-overflow branch and records its one occurrence with
+            // the enforced recovery constraint (or terminal physics), so this layer does
+            // not mint a second, weaker account of the same failure.
+            return { packet: current, fit: false, struck: true, recorded: false };
+        }
+        // The fold recovered the request. Preserve the triggering measurements on one
+        // actionless row and rebuild once so its Problem surfaces in this same packet.
+        await this.#problems.record({
+            workerId,
+            loopId,
+            turnId,
+            sequence: mintSequence,
+            origin: "plurnk",
+            source: "rail",
+            result: BudgetOverflow.foldedResult(usage, ceiling),
+        });
+        current = await rebuild();
         return {
-            tokens: requestPacket.tokens + assistantTokens,
-            sections: requestPacket.sections,
-            telemetryErrors: requestPacket.telemetryErrors,
-            assistant,
-            assistantRaw,
+            packet: current,
+            fit: measure(current) <= ceiling,
+            struck: true,
+            recorded: true,
         };
     }
-    // SPEC §telemetry: model-facing alert surface.
-    // Two sources, merged on each packet build:
-    //   1. Previous-turn action-bound failures (status_rx >= 400 on log_entries).
-    //   2. Engine-buffered actionless failures (no_send, parse, watchdog, rails).
-    // Buffer drains on read — each error appears in exactly one packet.
-    async buildTelemetryErrors(loopId, currentTurnSeq) {
-        // The uniform error channel (§telemetry-uniform-error-channel): every 4xx/5xx log row
-        // becomes a LogCoordinate-positioned TelemetryEvent — a terse pointer; the model READs the
-        // row for its term + detail. Buffer events that point at the model's own emission keep their
-        // ContentOffset position. info-level notices (progress) are not errors and never surface here.
-        const rows = await this.#db.engine_render_telemetry_errors.all({ loop_id: loopId, current_turn_seq: currentTurnSeq });
-        const logErrors = rows.map((r) => ({
-            source: "engine:rail",
-            kind: "log_error",
-            level: "error",
+    // {§tokenomics-physical-admission}: one request-shaped physical predicate.
+    // The exact PacketWire messages used for dispatch are the measurement input;
+    // empirical estimates cannot authorize recovery against a hard window.
+    async physicalAdmission(packet, provider, signal) {
+        if (provider.contextWindow === null) {
+            return {
+                admitted: false,
+                reason: "unknown_context_window",
+                detail: `provider ${JSON.stringify(provider.model)} reports no physical context window`,
+                capacity: null,
+            };
+        }
+        const maxTokens = this.maxTokensFor(provider);
+        if (maxTokens === null) {
+            return {
+                admitted: false,
+                reason: "unknown_output_envelope",
+                detail: `provider ${JSON.stringify(provider.model)} reports no resolved output envelope`,
+                capacity: null,
+            };
+        }
+        const capacity = provider.contextWindow - maxTokens;
+        const measurement = assertPromptTokenMeasurement(await provider.countPromptTokens(PacketWire.packetToWireMessages(packet), signal), `provider ${JSON.stringify(provider.model)}`);
+        if (measurement.kind === "estimate") {
+            return {
+                admitted: false,
+                reason: "estimate",
+                detail: `${measurement.source} is an empirical estimate and cannot authorize physical recovery: ${measurement.detail}`,
+                capacity,
+                measurement,
+            };
+        }
+        if (measurement.tokens > capacity) {
+            return {
+                admitted: false,
+                reason: "over_capacity",
+                detail: `${measurement.kind} prompt measurement ${measurement.tokens} exceeds physical prompt capacity ${capacity}`,
+                capacity,
+                measurement,
+            };
+        }
+        return { admitted: true, capacity, measurement };
+    }
+    // Every prior-turn operation failure is durable before packet assembly.
+    // The model-facing Errors section is only a terse projection of those rows;
+    // it never reconstructs failure truth from an in-memory event.
+    async buildFailurePointers(loopId, currentTurnSeq) {
+        const rows = await this.#db.engine_render_errors.all({ loop_id: loopId, current_turn_seq: currentTurnSeq });
+        return rows.map((r) => ({
             status: r.status_rx,
-            position: { type: "log-coordinate", coordinate: `${r.loop_seq}/${r.turn_seq}/${r.sequence}/${r.op}` },
+            coordinate: `${r.loop_seq}/${r.turn_seq}/${r.sequence}/${r.op}`,
         }));
-        const bufferEvents = this.#telemetry.drain(loopId).filter((e) => e.level !== "info");
-        return [...bufferEvents, ...logErrors];
     }
-    // SPEC §packet the log section — chronological action-entries for the loop.
+    // SPEC {§packet} the log section — chronological action-entries for the loop.
     // Snapshot is taken at packet build (pre-dispatch this turn), so it
     // reflects "what has happened before this turn." Each row carries a
     // log:///<loop_seq>/<turn_seq>/<sequence> coordinate the model can READ.
     async #buildLog(workerId) {
-        // SPEC §packet-terms: runs own log entries — log is the worker's history,
+        // SPEC {§packet-terms}: workers own log entries — log is the worker's history,
         // not the loop's. Span all loops in the worker so the model sees
         // earlier loops' work as conversational memory.
         //
-        // User prompts are first-class log entries: runTurn writes a
-        // client-origin SEND[200] row at sequence=0 of each new
-        // turn-1. Prompts thus surface naturally in this query — no
-        // synthetic / shim layer.
+        // User prompts are first-class actionless log entries written by
+        // runTurn. They surface naturally in this query without synthetic
+        // EDIT/READ delivery rows.
         const rows = await this.#db.engine_render_log.all({ worker_id: workerId });
         return rows.map((r) => ({
             coordinate: `${r.loop_seq}/${r.turn_seq}/${r.sequence}`,
@@ -581,7 +519,7 @@ class PacketBuilder {
                 username: r.username, password: r.password,
                 hostname: r.hostname, port: r.port,
                 pathname: r.pathname,
-                params: r.params === null ? null : JSON.parse(r.params),
+                query: r.query,
                 fragment: r.fragment,
             },
             status: r.status_rx,