@plurnk/plurnk-service 1.4.0 → 1.6.0

package/dist/core/Engine.js

@@ -1,5 +1,6 @@
+var _a;
 import { PlurnkParser, PlurnkParseError, UNKNOWN_POSITION } from "@plurnk/plurnk-contracts";
-import { RuntimeTag } from "@plurnk/plurnk-execs";
+import { RuntimeInvocation, RuntimeTag } from "@plurnk/plurnk-execs";
 import Owner from "./Owner.js";
 const TERMINAL_SEND_SIGNALS = new Set([102, 200, 202, 300, 499]);
 const comparePosition = (a, b) => a.line - b.line || a.column - b.column;
@@ -7,7 +8,6 @@ import { Mimetypes, emptyRegistry } from "@plurnk/plurnk-mimetypes";
 import Meta from "@plurnk/plurnk-meta";
 import EntryCrud from "../schemes/_entry-crud.js";
 import SearchIndex from "../schemes/_search-index.js";
-import { markTerminal } from "../schemes/Worker.js";
 import GitMembership from "./git-membership.js";
 import GitState from "./git-state.js";
 import WorkspaceSettings from "./workspace-settings.js";
@@ -20,13 +20,14 @@ import LoopLifecycle from "./LoopLifecycle.js";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { setTimeout as delay } from "node:timers/promises";
+import { randomUUID } from "node:crypto";
 // Shared module imported by both Engine and bin/digest.ts, so wire
 // projection and digest projection are structurally one function — no
 // drift between wire and digest possible.
 import PacketWire from "./packet-wire.js";
 import Results, { OperationFailureError } from "./results.js";
 import BranchReceipt from "./BranchReceipt.js";
-import BudgetOverflow from "./BudgetOverflow.js";
+import TerminalResult from "./TerminalResult.js";
 import WorkerControlAddress from "./WorkerControlAddress.js";
 import JournalTurn from "./JournalTurn.js";
 // The engine's collaborators — each owns one machine; Engine owns the loop/turn
@@ -41,7 +42,22 @@ import Dispatcher from "./Dispatcher.js";
 import { observed, observedSync } from "../observe/spans.js";
 import { OPS_DISPATCHED, PROVIDER_CALLS, recordCounter } from "../observe/metrics.js";
 import { scheduleTurnOps } from "./turn-scheduler.js";
-const DEFAULT_MAX_STRIKES = 3;
+import { readOptimisticSettlementMs } from "./optimistic-settlement.js";
+import { providerRequestFromStorageRow, } from "./provider-accounting.js";
+import ModelCall, { ModelCallPersistenceError, ProviderAccountingIntegrityError, } from "./ModelCall.js";
+const DEFAULT_MAX_STRIKES = 6;
+const RECORD_STREAM_MIMETYPES = new Set(["application/jsonl", "application/x-ndjson"]);
+const baseMimetype = (mimetype) => mimetype.split(";", 1)[0].trim().toLowerCase();
+// {§exec-stream} Active streams publish only independently meaningful units.
+// Atomic documents wait for close; JSONL stops after its last complete record.
+const streamPublicationEnd = (content, mimetype, cursor, closed) => {
+    const type = baseMimetype(mimetype);
+    if (closed || type.startsWith("text/"))
+        return content.length;
+    if (!RECORD_STREAM_MIMETYPES.has(type))
+        return cursor;
+    return Math.max(cursor, content.lastIndexOf("\n") + 1);
+};
 const ENGINE_PROBLEMS = Object.freeze({
     max_commands_exceeded: {
         status: 429,
@@ -51,7 +67,7 @@ const ENGINE_PROBLEMS = Object.freeze({
     idle_turn: {
         status: 409,
         code: "idle-turn",
-        detail: "SEND[102] was emitted without an operation to continue from.",
+        detail: "`## SEND0 [102]` was emitted without an operation to continue from.",
     },
 });
 // The prompt entry target - prompt:///<loop>/<N>, self-only ({§prompt-self-only}):
@@ -102,7 +118,7 @@ const readMaxCommands = () => {
     return n;
 };
 // PLURNK_SERVICE_FILES_ITEMS — the turn-0 catalog preview. null = off;
-// -1 = the complete one-level map; positive N caps its file rows. 0 / unset = off.
+// -1 = the ordinary markerless page; positive N explicitly caps file rows. 0 / unset = off.
 const normalizeFilesItems = (n) => (!Number.isFinite(n) || n === 0 ? null : n < 0 ? -1 : n);
 const readFilesItems = () => {
     const raw = process.env.PLURNK_SERVICE_FILES_ITEMS;
@@ -110,13 +126,55 @@ const readFilesItems = () => {
         return null;
     return normalizeFilesItems(Number.parseInt(raw, 10));
 };
-import { ProviderError, providerCostFor, providerCostUsd, validateProviderCost, scopeEnvToAlias, resolveActiveAlias } from "@plurnk/plurnk-providers";
+import { aggregateProviderAccounting, ProviderError, resolveActiveAlias, scopeEnvToAlias, } from "@plurnk/plurnk-providers";
 import { validateGbnf } from "@plurnk/gbnf";
 import ProviderInstantiate from "./ProviderInstantiate.js";
+// A generated rail may constrain only the sampled continuation while the chat
+// template contributes a prefix that llama-server preserves in its response.
+// The artifact names the alternate root that composes those bytes for evidence
+// grading; arbitrary grammars without the declaration retain their transport root.
+const grammarConstraint = (grammar) => {
+    const declarations = [...grammar.matchAll(/^# @plurnk-response-root ([A-Za-z][A-Za-z0-9-]*)$/gm)];
+    if (declarations.length === 0)
+        return { transport: grammar, response: grammar };
+    if (declarations.length !== 1)
+        throw new Error("GBNF constraint declares multiple @plurnk-response-root values");
+    const responseRoot = declarations[0][1];
+    if (!grammar.split("\n").some((line) => line.startsWith(`${responseRoot} ::=`))) {
+        throw new Error(`GBNF constraint declares missing response root ${responseRoot}`);
+    }
+    const roots = [...grammar.matchAll(/^root ::= ([A-Za-z][A-Za-z0-9-]*)$/gm)];
+    if (roots.length !== 1)
+        throw new Error("GBNF constraint must declare exactly one simple root");
+    return {
+        transport: grammar,
+        response: grammar.replace(roots[0][0], `root ::= ${responseRoot}`),
+    };
+};
+const TOKEN_BUDGET_OVERFLOW_DETAIL = "Token Budget Overflow: Token Usage exceeded Token Ceiling. Newest log items were automatically FOLDed to fit within token budget. Curate the log and/or perform more conservatively scoped or chunked retrieval operations to recover.";
+const tokenBudgetOverflowFailure = (pressure) => Results.failure("engine:context", "token-budget-overflow", 413, TOKEN_BUDGET_OVERFLOW_DETAIL, {}, { ...pressure });
+const budgetPressure = (usage, ceiling) => {
+    if (usage <= ceiling)
+        throw new Error("context-envelope admission requires positive ruler debt");
+    return { usage, ceiling, deficit: usage - ceiling };
+};
+const contextEnvelopeFailure = (pressure, admission) => Results.failure("engine:context", "context-envelope-admission-failed", 413, `The configured context envelope cannot admit this request: ${admission.detail}.`, {}, {
+    ...pressure,
+    stage: "context-envelope-admission",
+    contextAdmission: admission.reason,
+    contextCapacity: admission.capacity,
+    ...(admission.measurement === undefined ? {} : {
+        promptTokens: admission.measurement.tokens,
+        tokenKind: admission.measurement.kind,
+        tokenSource: admission.measurement.source,
+    }),
+    retryable: false,
+});
 // Runtime normalization for a disposition the engine refuses or resolves as a
 // continue after dispatch ({§send}). Every admitted emission itself ends in an
 // explicit disposition SEND ({§emission-admission}).
 const TURN_STATUS_IMPLICIT_CONTINUE = 102;
+const INVALID_EMISSION_RECOVERY_MESSAGE = "Your previous response contained an unrecoverable syntax error. No operations were performed. Try again.";
 const DEFAULT_MIN_CYCLES = 3;
 const DEFAULT_MAX_CYCLE_PERIOD = 4;
 const readPositiveInt = (envVar, fallback) => {
@@ -141,7 +199,7 @@ const DEFAULT_LOOP_TIMEOUT_MS = 86400000;
 const readLoopTimeoutMs = () => readPositiveInt("PLURNK_SERVICE_LOOP_TIMEOUT", DEFAULT_LOOP_TIMEOUT_MS);
 // The wall's abort reason — runLoop branches a mid-turn teardown to the 504 terminal on it.
 const LOOP_TIMEOUT_REASON = "loop_timeout";
-export default class Engine {
+class Engine {
     static fingerprintTurn(ops) {
         return StrikeRail.fingerprintTurn(ops);
     }
@@ -158,7 +216,7 @@ export default class Engine {
     // Boot-discovered runtime executors. Daemon builds + sets via
     // setExecutors at start(); undefined until then (and in bare tests).
     #executors;
-    // {§send-premature-terminate}/SEND[202]<T> — park deadlines by loopId, written at dispatch (the
+    // {§send-premature-terminate}/scoped SEND signal 202 — park deadlines by loopId, written at dispatch (the
     // marker's seconds; -1 = indefinite), consumed by the daemon's drain park-exit to schedule
     // the deadline wake. In-memory: a daemon restart drops pending deadlines (documented).
     parkDeadlines = new Map();
@@ -170,9 +228,6 @@ export default class Engine {
     #notices;
     #problems;
     #strikes;
-    // {§grinder-hard-413-recovery} - loops granted their one over-ceiling recovery turn. Cleared on a
-    // fitting turn so a later independent overflow can earn a fresh recovery, and at loop cleanup.
-    #hardOverflowRecovery = new Set();
     #packets;
     searchGate = new SearchGate();
     #proposals;
@@ -208,7 +263,13 @@ export default class Engine {
         if (!invalidate && this.#workspaceWarmStatus.get(workspaceId)?.phase === "complete") {
             return Promise.resolve();
         }
-        const state = { dirty: false, materialize, ctx, promise: Promise.resolve() };
+        const state = {
+            dirty: false,
+            materialize,
+            ctx,
+            abort: new AbortController(),
+            promise: Promise.resolve(),
+        };
         // Register before publishing the first synchronous Notice. A
         // listener may request another warm from that callback; it must join
         // this state rather than opening a second pump in the re-entrant gap.
@@ -231,10 +292,14 @@ export default class Engine {
                     completed: 0, total: 1, percent: 0, level: "info",
                 });
                 try {
+                    const signal = current.signal === undefined
+                        ? state.abort.signal
+                        : AbortSignal.any([current.signal, state.abort.signal]);
+                    const cancellable = { ...current, signal };
                     if (shouldMaterialize)
-                        await GitMembership.indexGitMembership(current);
+                        await GitMembership.indexGitMembership(cancellable);
                     await SearchIndex.maintain({
-                        ...current,
+                        ...cancellable,
                         pushNotice: (notice) => {
                             if (notice.kind === "embed_progress"
                                 && typeof notice.completed === "number"
@@ -277,9 +342,26 @@ export default class Engine {
     workspaceDerivationStatus(workspaceId) {
         return this.#workspaceWarmStatus.get(workspaceId) ?? null;
     }
-    // Awaited by Daemon.stop before the db closes.
-    async drainDerivations() {
-        await Promise.all([...this.#workspaceWarms.values()].map((state) => state.promise));
+    cancelDerivations(reason = new DOMException("derivations cancelled", "AbortError")) {
+        for (const state of this.#workspaceWarms.values()) {
+            if (!state.abort.signal.aborted)
+                state.abort.abort(reason);
+        }
+    }
+    // Awaited by Daemon.stop before the db closes. Shutdown supplies the exact
+    // cancellation reason it owns; every unrelated failure remains visible.
+    async drainDerivations(ignoredReason) {
+        const results = await Promise.allSettled([...this.#workspaceWarms.values()].map((state) => state.promise));
+        const errors = results
+            .filter((result) => result.status === "rejected")
+            .flatMap((result) => result.reason instanceof AggregateError
+            ? [...result.reason.errors]
+            : [result.reason])
+            .filter((error) => error !== ignoredReason);
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1)
+            throw new AggregateError(errors, "derivation drain failed");
     }
     async drainWorkspaceDerivations(workspaceId) {
         await this.#workspaceWarms.get(workspaceId)?.promise;
@@ -294,9 +376,9 @@ export default class Engine {
     // parse): warn once per message, never per turn; the turn records railsVerdict "unverifiable".
     static #railGapWarned = new Set();
     static #warnRailVerdictGapOnce(message) {
-        if (Engine.#railGapWarned.has(message))
+        if (_a.#railGapWarned.has(message))
             return;
-        Engine.#railGapWarned.add(message);
+        _a.#railGapWarned.add(message);
         process.stderr.write(`plurnk-engine: rail verdict unavailable — the configured grammar did not parse in @plurnk/gbnf (${message})\n`);
     }
     static #requireGrammarEvidence(response) {
@@ -330,7 +412,8 @@ export default class Engine {
             discovery: { registry: emptyRegistry(), handlers: new Map(), skipped: [] },
         });
         // {§tokenomics-agnostic-ruler} — standalone construction and the daemon
-        // use the same default; provider counting is confined to physical admission.
+        // use the same default; provider counting is confined to hard
+        // context-envelope admission.
         this.#tokenize = tokenize ?? rulerCount;
         const executors = () => this.#executors;
         const loopSignal = (loopId) => this.#loopAborts.get(loopId)?.signal;
@@ -340,7 +423,6 @@ export default class Engine {
         this.#packets = new PacketBuilder({
             db,
             schemes,
-            problems: this.#problems,
             executors,
         });
         this.#proposals = new ProposalLifecycle({
@@ -385,12 +467,16 @@ export default class Engine {
         if (this.#executors === undefined)
             throw new Error("registerRuntime: executor registry not wired yet");
         RuntimeTag.assert(tag, "module runtime");
+        const normalized = {
+            ...entry,
+            invocation: RuntimeInvocation.assert(entry.invocation, entry.namespaceOwner.name, tag),
+        };
         // Preflight both owners before either write; synchronous registration
         // then cannot leave a half-claimed namespace. {§plugin-namespace-arbitration}
-        this.#executors.assertCanRegister(tag, entry.namespaceOwner);
-        this.#schemes.assertRuntimeClaim(tag, entry.namespaceOwner);
-        this.#schemes.registerRuntimeScheme(tag, entry.executor, entry.namespaceOwner, scheme);
-        this.#executors.register(tag, entry);
+        this.#executors.assertCanRegister(tag, normalized.namespaceOwner);
+        this.#schemes.assertRuntimeClaim(tag, normalized.namespaceOwner);
+        this.#schemes.registerRuntimeScheme(tag, normalized.executor, normalized.namespaceOwner, scheme);
+        this.#executors.register(tag, normalized);
     }
     // Supply an explicitly configured local constraint; ANTLR remains the
     // language authority. {§grammar-enforcement-verified-at-boot}
@@ -414,9 +500,10 @@ export default class Engine {
             ? variant
             : fileURLToPath(import.meta.resolve(`@plurnk/plurnk-contracts/${variant}`));
         const text = await readFile(path, "utf8"); // unresolvable/unreadable throws — a configured rail never silently degrades
-        this.#gbnfCache.set(variant, text);
+        const constraint = grammarConstraint(text);
+        this.#gbnfCache.set(variant, constraint);
         process.stderr.write(`plurnk-engine: GBNF constraint: ${alias || "(bare)"} → ${variant} (${text.length} chars)\n`);
-        return text;
+        return constraint;
     }
     // A lineage's no-parent root; a root worker resolves to itself. Fail hard
     // when corruption leaves a worker without one. {§worker-primary}
@@ -426,6 +513,16 @@ export default class Engine {
             throw new Error(`resolveWorkerPrimary: worker ${workerId} has no lineage root — corrupt parent chain`);
         return root.id;
     }
+    async resolveWorkerProviderIdentity(workerId) {
+        const identity = await this.#db.engine_worker_provider_identity.get({ worker_id: workerId });
+        if (identity === undefined) {
+            throw new Error(`resolveWorkerProviderIdentity: worker ${workerId} has no lineage root — corrupt parent chain`);
+        }
+        return {
+            workerId: identity.worker_id,
+            primaryWorkerId: identity.primary_worker_id,
+        };
+    }
     promptBudgetFor(provider) {
         return this.#packets.promptBudgetFor(provider);
     }
@@ -433,6 +530,109 @@ export default class Engine {
         const tags = Meta.composeAttributions(this.#schemes.attributions(context), this.#executors?.attributions(context) ?? [], await this.#mimetypes.attributions(context), provider.attributions?.(context) ?? []);
         return [...tags];
     }
+    #providerAttributions(provider, context) {
+        return [...Meta.composeAttributions(provider.attributions?.(context) ?? [])];
+    }
+    static #providerFailure(error, signal) {
+        if (error instanceof ProviderError) {
+            return { status: error.problem.status, problem: error.problem };
+        }
+        if (signal?.aborted === true) {
+            const timedOut = signal.reason === LOOP_TIMEOUT_REASON;
+            return Results.failure("engine:provider", timedOut ? "provider-call-timeout" : "provider-call-cancelled", timedOut ? 504 : 499, timedOut
+                ? "The provider call was interrupted by the loop deadline."
+                : "The provider call was interrupted by loop cancellation.", {}, { stage: "provider-request", retryable: false });
+        }
+        console.error("Provider failed outside its Problem Details contract:", error);
+        return Results.failure("engine:provider", "provider-contract-violation", 502, "The provider failed without returning its required Problem Details.", {}, { stage: "provider-request", retryable: false });
+    }
+    async #runBareBatch({ statements, provider, turnId, modelCallSequenceStart, workspaceId, workerId, primaryWorkerId, loopSequence, turnSequence, signal, }) {
+        const prepared = [];
+        for (const [index, statement] of statements.entries()) {
+            const providerWorkerId = randomUUID();
+            const attributionContext = Object.freeze({
+                workspaceId: String(workspaceId),
+                workerId: providerWorkerId,
+                primaryWorkerId,
+                loop: loopSequence,
+                turn: turnSequence,
+                attempt: 1,
+            });
+            const attributions = this.#providerAttributions(provider, attributionContext);
+            const modelCall = await ModelCall.open(this.#db, {
+                turnId,
+                sequence: modelCallSequenceStart + index,
+                kind: "bare",
+                attributions,
+                model: provider.model,
+            });
+            prepared.push({ statement, modelCall, attributions, providerWorkerId });
+        }
+        const maxTokens = this.#packets.maxTokensFor(provider) ?? undefined;
+        const settlements = await Promise.allSettled(prepared.map(async ({ statement, modelCall, attributions, providerWorkerId }) => {
+            try {
+                const response = await observed("provider.generate", { model: provider.model, attempt: 1, kind: "bare" }, async (span) => {
+                    try {
+                        const generated = await provider.generate({
+                            messages: [{ role: "user", content: statement.body }],
+                            workerId: providerWorkerId,
+                            primaryWorkerId,
+                            signal,
+                            maxTokens,
+                            attributions: attributions.length > 0 ? attributions : undefined,
+                            workspaceId: String(workspaceId),
+                            loop: loopSequence,
+                            turn: turnSequence,
+                            observeRequest: modelCall.observeRequest,
+                            callKind: "bare",
+                        });
+                        modelCall.assertAccounting(generated.accounting);
+                        recordCounter(PROVIDER_CALLS, {
+                            model: provider.model,
+                            attempt: 1,
+                            status: "resolved",
+                        });
+                        span.setAttribute("status", "resolved");
+                        return generated;
+                    }
+                    catch (error) {
+                        if (error instanceof ProviderError) {
+                            modelCall.assertAccounting(error.accounting);
+                        }
+                        throw error;
+                    }
+                });
+                await modelCall.observeResponse(response);
+                return {
+                    statement,
+                    modelCallId: modelCall.id,
+                    result: Results.assert({
+                        status: 200,
+                        content: response.assistant.content,
+                        mimetype: "text/plain",
+                    }),
+                };
+            }
+            catch (error) {
+                if (error instanceof ModelCallPersistenceError || error instanceof ProviderAccountingIntegrityError) {
+                    throw error;
+                }
+                const failure = _a.#providerFailure(error, signal);
+                if (error instanceof ProviderError && error.attempt !== undefined) {
+                    await modelCall.observeResponse(error.attempt, failure);
+                }
+                else {
+                    await modelCall.fail(failure);
+                }
+                return { statement, modelCallId: modelCall.id, result: failure };
+            }
+        }));
+        const internalFailure = settlements.find((settlement) => settlement.status === "rejected");
+        if (internalFailure !== undefined)
+            throw internalFailure.reason;
+        signal?.throwIfAborted();
+        return settlements.map((settlement) => settlement.value);
+    }
     // {§attribution} — reporting derives from exact provider-request evidence;
     // malformed durable tags fail here instead of being silently filtered.
     async loopAttributions(loopId) {
@@ -445,24 +645,22 @@ export default class Engine {
         });
         return [...Meta.composeAttributions(tags)];
     }
-    // Loop totals are billing evidence; the latest-turn pair is the client
-    // occupancy gauge. {§tokenomics-client-gauge}, {§notifications-loop-terminated}
+    // The request ledger is cardinal evidence; its aggregate and the latest-turn
+    // occupancy gauge are derived projections. {§tokenomics-client-gauge},
+    // {§notifications-loop-terminated}, {§provider-accounting}
     async loopUsage(loopId) {
         const row = await this.#db.engine_loop_usage.get({ loop_id: loopId });
-        const parsedCosts = JSON.parse(row?.costs ?? "[]");
-        if (!Array.isArray(parsedCosts))
-            throw new TypeError(`loop ${loopId} monetary evidence is not an array`);
+        if (row === undefined)
+            throw new Error(`loopUsage: loop ${loopId} does not exist`);
+        const requests = await this.#db.engine_loop_provider_requests.all({ loop_id: loopId });
         return {
-            promptTokens: row?.prompt ?? 0,
-            completionTokens: row?.completion ?? 0,
-            costUsd: row?.cost_usd ?? null,
-            costs: parsedCosts.map((cost) => validateProviderCost(cost)),
-            // Latest provider attempt on the latest turn, not the billed total.
-            contextTokens: row?.context ?? 0,
+            accounting: aggregateProviderAccounting(requests.map(providerRequestFromStorageRow)),
+            // Latest physical request on the latest turn, not the billed total.
+            contextTokens: row.context,
             // Latest effective packet allowance; null when uncapped or unknown.
-            promptBudget: row?.context_size ?? null,
+            promptBudget: row.context_size,
             // Latest turn's opaque provider metadata. {§meta-passthrough}
-            meta: JSON.parse(row?.meta ?? "{}"),
+            meta: JSON.parse(row.meta ?? "{}"),
         };
     }
     // A mapped rail divergence is a CODE-POINT offset into the model's content;
@@ -485,11 +683,12 @@ export default class Engine {
         }
         return { line, column };
     }
-    async runLoop({ provider, messages, requirements = "", workspaceId, workerId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
+    async runLoop({ provider, childProvider = provider, messages, requirements = "", workspaceId, workerId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
         // A 202 park suspends this durable loop and a later wake re-enters runLoop.
         // Its ceiling therefore counts every prior turn, not merely this process-local
         // execution segment.
         const turnIds = await this.#lifecycle.turnIds(loopId);
+        let invalidEmissionRecoveryEntryId = null;
         // Per-loop AbortController for scheme-side cancellation propagation.
         // Chained from the caller's `signal` so an external abort cascades.
         const loopAbort = new AbortController();
@@ -520,11 +719,11 @@ export default class Engine {
             return { turnIds, result, hitMaxTurns: false, reason: "loop_timeout" };
         };
         // Cleanup splits by termination kind:
-        // - "graceful" (SEND[202] Accepted): in-flight streaming-scheme spawns
+        // - "graceful" (SEND signal 202 Accepted): in-flight streaming-scheme spawns
         //   are ALLOWED to outlive the loop — they complete naturally, write final
         //   channel state, and wake-on-completion (E.4) opens a fresh loop. 202 is
         //   the only terminal that means "keep my async work."
-        // - "forceful" (SEND[200] done, max_turns, strike, cancel, budget, 4xx/5xx):
+        // - "forceful" (SEND signal 200 done, max_turns, strike, cancel, context-envelope rejection, 4xx/5xx):
         //   fire the loop-level abort so leftover spawns tear down. "Done" reaps.
         const cleanup = (kind, reason) => {
             clearTimeout(wall);
@@ -534,7 +733,6 @@ export default class Engine {
             this.#loopAborts.delete(loopId);
             this.#strikes.delete(loopId);
             this.searchGate.cleanup(loopId);
-            this.#hardOverflowRecovery.delete(loopId);
             this.#notices.delete(loopId);
         };
         while (true) {
@@ -547,7 +745,7 @@ export default class Engine {
                 // check, {§worker-lifecycle-wake-requeue-not-terminal}). The wake's intent is KEEP
                 // RUNNING: re-claim atomically and continue — the injected prompt is already
                 // this loop's next turn. Returning it as "external" broadcast a QUEUED loop
-                // as a terminal result with status 100 — the delegation-flags flake.
+                // as a terminal result with status 100 — the delegation-flags race.
                 await this.#db.engine_reclaim_queued_loop.run({ loop_id: loopId });
                 continue; // claimed (or a racer flipped it first — the re-read decides)
             }
@@ -584,10 +782,6 @@ export default class Engine {
                 cleanup("forceful", "max_turns");
                 return { turnIds, result, hitMaxTurns: true, reason: "max_turns" };
             }
-            // PLURNK_SERVICE_EXEC_WAIT_MS — a post-EXEC breath: if a spawn from the prior turn
-            // is still in flight, give it a tunable beat to land in THIS turn's packet
-            // before we assemble it. A fixed grace beat, never a wait-for-completion;
-            // 0/unset = off. Abortable with the loop signal.
             const execHandler = this.#schemes.get("exec");
             // {§exec-hold-until-concluded} — hold matching runtime/effect
             // streams until conclusion or the fail-open cap, then resume the
@@ -600,19 +794,15 @@ export default class Engine {
                     await delay(150, undefined, { signal });
                 }
             }
-            const execWaitMs = Number(process.env.PLURNK_SERVICE_EXEC_WAIT_MS ?? "0");
-            if (execWaitMs > 0) {
-                if (execHandler?.hasActiveSpawns?.(workerId) === true)
-                    await delay(execWaitMs, undefined, { signal });
-            }
             let turn;
             const releaseWorkspace = await this.#acquireWorkspaceTurn(workspaceId, workerId);
             try {
                 turn = await observed(// {§observability-boundary}
                 "loop.turn", { workerId, "loop.id": loopId }, async (span) => {
                     const t = await this.runTurn({
-                        provider, messages, requirements, workspaceId, workerId, loopId, origin, signal, onDispatch,
+                        provider, childProvider, messages, requirements, workspaceId, workerId, loopId, origin, signal, onDispatch,
                         turnNumber: turnIds.length + 1, maxTurns,
+                        invalidEmissionRecoveryEntryId,
                     });
                     span.setAttribute("turn.id", t.turnId);
                     return t;
@@ -635,10 +825,18 @@ export default class Engine {
                 releaseWorkspace();
             }
             turnIds.push(turn.turnId);
-            // Invalid provider emissions are retried beneath this turn and never
-            // reach the strike rail. Exhausting that inner attempt budget is a
-            // terminal generation failure, not one of the engine's three strikes.
+            // {§invalid-emission-attempts} Invalid provider emissions are retried beneath this turn and never
+            // reach the strike rail. The first consecutive exhaustion has already
+            // exposed its bounded lifeline through ordinary next-turn state. A
+            // second exhaustion is terminal; an admitted turn clears the sequence.
             if (turn.emissionExhausted) {
+                if (invalidEmissionRecoveryEntryId === null) {
+                    if (turn.rejectedModelEntryId === undefined) {
+                        throw new Error("an admitted invalid-emission recovery requires its rejected model-entry identity");
+                    }
+                    invalidEmissionRecoveryEntryId = turn.rejectedModelEntryId;
+                    continue;
+                }
                 const failure = Results.failure("engine:generation", "invalid-emission-exhausted", 500, `No valid PLAN...SEND turn was received after ${turn.emissionAttempts} emission attempts.`, {}, {
                     attempts: turn.emissionAttempts,
                     stage: "emission-validation",
@@ -650,25 +848,24 @@ export default class Engine {
                 cleanup("forceful", "invalid_emission");
                 return { turnIds, result, hitMaxTurns: false, reason: "invalid_emission" };
             }
-            // SPEC {§grinder}: budget hard-stop — packet won't fit even collapsed → abandon.
+            invalidEmissionRecoveryEntryId = null;
+            // SPEC {§grinder}: the effective context envelope rejected the request.
             if (turn.budgetHardStop) {
-                if (turn.budget === undefined) {
-                    throw new Error("a budget hard-stop requires its measured overflow");
+                if (turn.budgetFailure === undefined) {
+                    throw new Error("a context-envelope hard-stop requires its exact failure");
                 }
-                const failure = BudgetOverflow.result(turn.budget.usage, turn.budget.ceiling, false);
-                const result = await this.#lifecycle.finish(loopId, failure);
+                const result = await this.#lifecycle.finish(loopId, turn.budgetFailure);
                 if (result === null)
                     throw new Error(`loop ${loopId} became terminal before budget settlement`);
-                cleanup("forceful", "budget_overflow");
-                return { turnIds, result, hitMaxTurns: false, reason: "budget_overflow" };
+                cleanup("forceful", "context_envelope");
+                return { turnIds, result, hitMaxTurns: false, reason: "context_envelope" };
             }
-            // {§engine-rails} — per-turn strike accounting (cycle detection, the
-            // grinder/steer coupling, hard-failure statuses). StrikeRail owns the
+            // {§engine-rails} — per-turn strike accounting (cycle detection,
+            // steer coupling, hard operation outcomes). StrikeRail owns the
             // bookkeeping; runLoop owns abandonment.
             const verdict = this.#strikes.assess(loopId, {
                 fingerprint: turn.fingerprint,
-                statuses: turn.statuses,
-                budgetStruck: turn.budgetStruck,
+                outcomes: turn.outcomes,
                 steerStruck: turn.steerStruck,
                 minCycles, maxCyclePeriod, maxStrikes,
             });
@@ -691,7 +888,11 @@ export default class Engine {
             }
         }
     }
-    async runTurn({ provider, messages, requirements = "", workspaceId, workerId, loopId, origin = "model", signal, onDispatch, turnNumber = 1, maxTurns = 50, }) {
+    async runTurn({ provider, childProvider = provider, messages, requirements = "", workspaceId, workerId, loopId, origin = "model", signal, onDispatch, turnNumber = 1, maxTurns = 50, invalidEmissionRecoveryEntryId, }) {
+        const allowInvalidEmissionRecovery = invalidEmissionRecoveryEntryId === null;
+        const transientOpenLogEntryId = typeof invalidEmissionRecoveryEntryId === "number"
+            ? invalidEmissionRecoveryEntryId
+            : null;
         // === Turn-as-container model ===
         //
         // Turn rows are created at runTurn OPEN (status=102, placeholder
@@ -748,14 +949,14 @@ export default class Engine {
         // Model ops dispatch after these pre-model rows.
         let nextActionIndex = 1;
         const turnOpenPaths = [];
-        // {§model-entry} — the worker's first turn opens with the model's own turn-0, mirrored OPEN: a
-        // worked turn PLAN → the environment FINDs the foist ACTUALLY dispatches → SEND[102]. Built
+        // {§worker-initialization-entry} — the worker's first turn opens with a kernel-authored initialization: a
+        // worked turn PLAN → the environment FINDs the foist ACTUALLY dispatches → SEND signal 102. Built
         // from the real ops below (not a static print — we lean into the genuine echo paradigm) and
-        // written at sequence 1, so it reads first as the emission with the foisted results following.
+        // written at sequence 1, so it reads first with the foisted results following.
         const turnZeroMoves = [];
         if (seq === 1) {
             if (workerFirstLoop)
-                nextActionIndex = 2; // reserve sequence 1 for the turn-0 echo
+                nextActionIndex = 2; // reserve sequence 1 for initialization
             // Operator doc READs (PLURNK_SERVICE_MD_<ALIAS>, {§actor-boundary-doc-injection}). The docs were materialized
             // as worker://plurnk/<entry> entries by the plurnk worker (LoopDocs, via the
             // {§actor-boundary} keystone); foist a READ of each into THIS turn-0 so the model
@@ -788,7 +989,6 @@ export default class Engine {
                 const promptPath = promptTarget(promptLoopSeq, seq);
                 const entry = {
                     channels: { body: { content: promptRow.prompt, mimetype: "text/markdown" } },
-                    tags: [],
                     attributes: { openPaths },
                 };
                 await EntryCrud.writeEntry(promptPath.pathname, entry, systemCtx, "prompt", workerId);
@@ -859,102 +1059,81 @@ export default class Engine {
         // The warm materialized membership before deriving. This second pass is the
         // ordinary cheap change detector and captures any drift that landed meanwhile.
         const fsDivergences = await GitMembership.indexGitMembership(systemCtx);
-        await this.#logFsFictions(workspaceId, fsDivergences);
+        // {§packet-git-status} — one post-reconciliation snapshot supplies both
+        // the compact packet summary and each causal file event's exact XY state.
+        const gitStatus = await GitState.status(this.#db, workspaceId, this.#loopAborts.get(loopId)?.signal);
+        await this.#logFsFictions(workspaceId, fsDivergences, gitStatus);
         // The refresh above may have changed bodies (including model/client edits
         // since the startup warm). Re-derive to completion before packet/model
         // construction. Membership is already current, so this pass does not
         // consume the filesystem divergences a second time.
         await this.#queueWorkspaceWarm(systemCtx, true, false);
         // Turn-0 catalog preview (PLURNK_SERVICE_FILES_ITEMS, {§actor-boundary-catalog-preview}):
-        // FIND surveys foisted into the worker's first model turn so it opens with its catalog.
-        // Folder-capable surfaces reveal one level with `*`; each deeper directory is an
-        // actionable `dir/**` aggregate. The curated kernel docs remain recursive, so the
-        // opening packet demonstrates both navigation forms. Empty results are orientation.
+        // Four FIND surveys foisted into the worker's first model turn establish the project,
+        // commons, private, and documentation surfaces in that order. Their `init`
+        // classification lets the model curate this opening survey as one log set.
         if (seq === 1) {
             // {§operator-config-workspace-files-items} — workspace filesItems replaces the env default.
             const { filesItems: workspaceMI } = await WorkspaceSettings.read(this.#db, workspaceId);
             const filesItems = workspaceMI !== null ? normalizeFilesItems(workspaceMI) : readFilesItems();
             if (filesItems !== null && workerFirstLoop) { // {§actor-boundary-catalog-preview} — once per worker
-                // engine_scheme_catalog_summary is the workspace-bounded scheme source: ordered,
-                // one row per stored entry scheme. log:// is absent —
-                // it lives in log_entries, not the catalog (present-mode, the # Log section).
                 const catalogSchemes = await this.#db.engine_scheme_catalog_summary.all({ workspace_id: workspaceId });
-                // Entry-bearing plugin schemes foist alongside the four structural surveys below.
-                const foistSchemes = catalogSchemes
-                    .filter((catalog) => catalog.scheme !== "prompt" && catalog.scheme !== "worker")
-                    .map(({ scheme, shallow_items }) => ({ scheme, shallow_items }));
-                // Commons + project files always foist. An empty result establishes that the
-                // surface exists and currently contains nothing.
-                foistSchemes.push({
-                    scheme: "worker",
-                    shallow_items: catalogSchemes.find((c) => c.scheme === "worker")?.shallow_items ?? 0,
-                });
-                if (!foistSchemes.some((c) => c.scheme === "file"))
-                    foistSchemes.push({ scheme: "file", shallow_items: 0 }); // Empty project surface still receives its orienting FIND.
-                for (const { scheme, shallow_items: shallowItems } of foistSchemes) {
-                    const isFile = scheme === "file";
-                    const pattern = this.#schemes.manifestFor(scheme)?.folderScopes === true ? "*" : "**";
-                    // Only the file map takes PLURNK_SERVICE_FILES_ITEMS as a first-N cap;
-                    // other schemes always render their complete one-level map. An empty file
-                    // survey has no range: `<1,0>` would turn useful orientation into an error.
-                    const cap = isFile && filesItems > 0 && shallowItems > 0 ? Math.min(filesItems, shallowItems) : null;
-                    // The file survey foists as the BARE relative glob — the path shape plurnk.md
-                    // teaches (`*`, `src/**`, `**/notes.md`; bare = project-relative) — so the turn-0
-                    // exemplar and the log rows the model reads never train a leading-slash or
-                    // file:/// habit the rest of the teaching contradicts.
-                    const catalogFind = {
-                        op: "FIND", suffix: "", signal: null,
-                        target: isFile ? { kind: "local", raw: pattern } : {
-                            kind: "url",
-                            raw: `${scheme}:///${pattern}`,
-                            scheme,
-                            username: null, password: null, hostname: null, port: null,
-                            pathname: `/${pattern}`,
-                            query: null, fragment: null,
+                const fileItems = catalogSchemes.find(({ scheme }) => scheme === "file")?.shallow_items ?? 0;
+                const fileCap = filesItems > 0 && fileItems > 0 ? Math.min(filesItems, fileItems) : null;
+                await Owner.kernelId(this.#db, workspaceId);
+                const surveys = [
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init"],
+                            target: { kind: "local", raw: "*" },
+                            body: null,
+                            lineMarker: fileCap === null ? null : { marks: [1, fileCap] },
+                            position: UNKNOWN_POSITION,
                         },
-                        body: null,
-                        lineMarker: cap === null ? null : { marks: [1, cap] },
-                        position: UNKNOWN_POSITION,
-                    };
-                    await this.dispatch({
-                        statement: catalogFind, workspaceId, workerId, loopId, turnId,
-                        sequence: nextActionIndex, origin: "plurnk", onDispatch,
-                    });
+                        exemplar: `## FIND0 [+init] (*)${fileCap === null ? "" : ` <1,${fileCap}>`}`,
+                    },
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init"],
+                            target: { kind: "url", raw: "worker:///*", scheme: "worker", username: null, password: null, hostname: null, port: null, pathname: "/*", query: null, fragment: null },
+                            body: null, lineMarker: null, position: UNKNOWN_POSITION,
+                        },
+                        exemplar: "## FIND0 [+init] (worker:///*)",
+                    },
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init"],
+                            target: { kind: "url", raw: "worker://~/*", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: "/*", query: null, fragment: null },
+                            body: null, lineMarker: null, position: UNKNOWN_POSITION,
+                        },
+                        exemplar: "## FIND0 [+init] (worker://~/*)",
+                    },
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init", "+docs"],
+                            target: { kind: "url", raw: "worker://plurnk/docs/**", scheme: "worker", username: null, password: null, hostname: "plurnk", port: null, pathname: "/docs/**", query: null, fragment: null },
+                            body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                        },
+                        exemplar: "## FIND0 [+init,+docs] (worker://plurnk/docs/**) <1,-1>",
+                    },
+                ];
+                for (const { statement, exemplar } of surveys) {
+                    await this.dispatch({ statement, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
                     nextActionIndex++;
-                    // {§model-entry} — the same FIND, rendered back to DSL for the turn-0 echo (the model's
-                    // own survey, mirrored OPEN). The <L> cap rides as `<1,N>`, exactly as the model would type it.
-                    turnZeroMoves.push(`<<FIND(${isFile ? pattern : `${scheme}:///${pattern}`})${cap === null ? "" : `<1,${cap}>`}::FIND`);
+                    turnZeroMoves.push(exemplar);
                 }
-                // The kernel's self-documenting surface — FIND(worker://plurnk/docs/**), uncapped,
-                // always ({§schemes-directory}, published under {§entry-owner}).
-                await Owner.kernelId(this.#db, workspaceId); // the row exists even before docs materialize — the empty survey is orienting, never 404
-                const kernelDocsFind = {
-                    op: "FIND", suffix: "", signal: null,
-                    target: { kind: "url", raw: "worker://plurnk/docs/**", scheme: "worker", username: null, password: null, hostname: "plurnk", port: null, pathname: "/docs/**", query: null, fragment: null },
-                    body: null, lineMarker: null, position: UNKNOWN_POSITION,
-                };
-                await this.dispatch({ statement: kernelDocsFind, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
-                nextActionIndex++;
-                turnZeroMoves.push("<<FIND(worker://plurnk/docs/**)::FIND");
-                // {§worker-scheme} — the building worker's own scratch gets the same complete
-                // one-level map in its perspective alone. It always executes: an empty private
-                // space is useful orientation, not grounds to hide the surface.
-                const ownFind = {
-                    op: "FIND", suffix: "", signal: null,
-                    target: { kind: "url", raw: "worker://~/*", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: "/*", query: null, fragment: null },
-                    body: null, lineMarker: null, position: UNKNOWN_POSITION,
-                };
-                await this.dispatch({ statement: ownFind, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
-                nextActionIndex++;
-                turnZeroMoves.push("<<FIND(worker://~/*)::FIND"); // {§model-entry} — the own-space survey, into the turn-0 echo
             }
-            // {§model-entry} — mirror the model's turn-0 OPEN at sequence 1: PLAN → the FINDs actually
-            // foisted above (real, their results already in the log) → SEND[102]. Dynamic — it reflects
+            // {§worker-initialization-entry} — write the kernel's turn-0 initialization OPEN at sequence 1: PLAN → the FINDs actually
+            // foisted above (real, their results already in the log) → SEND signal 102. Dynamic — it reflects
             // the true survey, never a frozen print — and OPEN: the worked example the model orients on,
-            // so the grammar can stay thin. Subsequent turns mirror the model's real output, folded.
+            // so the grammar can stay thin.
             if (workerFirstLoop) {
-                const emission = ["<<PLAN:Initialize:PLAN", ...turnZeroMoves, "<<SEND[102]:Next, address the prompt from the initialized context.:SEND"].join("\n");
-                await this.#dispatcher.writeModelEntry({ verbatim: emission, workerId, loopId, turnId, sequence: 1, folded: false, origin: "plurnk" });
+                const initialization = [
+                    "# PLAN0\n* Initialization complete.\n* Next: address the prompt.",
+                    ...turnZeroMoves,
+                    "## SEND0 [102]\nNext, address the prompt.",
+                ].join("\n\n");
+                await this.#dispatcher.writeInitializationEntry({ verbatim: initialization, workerId, loopId, turnId, sequence: 1 });
             }
         }
         // {§methods-loop-run-open-paths}: selected workspace paths belong to
@@ -986,10 +1165,8 @@ export default class Engine {
         await this.#reapTurnScopedStreams(workerId);
         nextActionIndex += await this.#materializeEnvironmentDeltas({ workspaceId, workerId, loopId, turnId, fromSequence: nextActionIndex });
         nextActionIndex += await this.#materializeStreamDeltas({ workerId, loopId, turnId, fromSequence: nextActionIndex });
-        // Git working-tree state is read once for the packet and threaded
-        // (a service-side `git status` shell-out) and threaded into the budget
-        // rebuild too so it isn't re-shelled on overflow.
-        const gitStatus = await GitState.status(this.#db, workspaceId, this.#loopAborts.get(loopId)?.signal);
+        // The post-reconciliation Git snapshot above is threaded into the packet
+        // and every budget rebuild; overflow never shells again.
         // Notices are non-terminal observations, never operation-failure truth.
         // Drain once and thread the same set through every grinder rebuild.
         const notices = this.#notices.drain(loopId)
@@ -999,95 +1176,56 @@ export default class Engine {
         // written (if turn 1) is part of that query result.
         let requestPacket = await this.#packets.buildRequestPacket({
             initialMessages: messages, requirements, workspaceId, workerId, loopId,
-            currentTurnSeq: seq, provider, gitStatus, notices,
+            currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
         });
         // SPEC {§grinder} — budget grinder, pre-LLM: reclaim window on actual overflow.
         const enforced = await this.#packets.enforceBudget({
-            packet: requestPacket, provider, workerId, loopId, turnId,
-            // The overflow error row is minted at the turn's running sequence (nextActionIndex), pre-generate;
-            // runTurn advances the counter past it below so the post-generate dispatch rows never collide.
-            mintSequence: nextActionIndex,
-            // Rebuilds re-derive durable errors and retain the one drained notice
-            // set; neither path can duplicate or swallow a product failure.
+            packet: requestPacket, provider, loopId, turnId,
+            recordOverflow: async (pressure) => {
+                await this.#problems.record({
+                    workerId,
+                    loopId,
+                    turnId,
+                    sequence: nextActionIndex++,
+                    origin: "plurnk",
+                    source: "engine",
+                    result: tokenBudgetOverflowFailure(pressure),
+                });
+            },
             rebuild: () => this.#packets.buildRequestPacket({
                 initialMessages: messages, requirements, workspaceId, workerId, loopId,
-                currentTurnSeq: seq, provider, gitStatus, notices,
+                currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
             }),
         });
-        if (enforced.recorded)
-            nextActionIndex += 1; // a fold-to-fit Problem consumed the reserved sequence
         requestPacket = enforced.packet;
-        let operationConstraint;
         if (!enforced.fit) {
-            // {§grinder-hard-413-recovery}/{§grinder-hard-413-abort} — admit
-            // one physically sendable constrained recovery turn; a physical
-            // overflow or consecutive policy overflow terminates immediately.
-            let physicalAdmission = await this.#packets.physicalAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
-            if (physicalAdmission.admitted && !this.#hardOverflowRecovery.has(loopId)) {
+            // {§tokenomics-context-envelope-admission}: the overflow Problem is
+            // already durable. Remaining ruler debt may still be admitted; only
+            // the effective total context envelope can terminally reject the turn.
+            const contextAdmission = await this.#packets.contextEnvelopeAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
+            if (!contextAdmission.admitted) {
                 const ceiling = this.#packets.ceilingFor(provider);
                 if (ceiling === null) {
-                    throw new Error("an unbounded prompt budget cannot enter budget recovery");
+                    throw new Error("an unbounded prompt budget cannot enter context-envelope admission");
                 }
+                const failure = contextEnvelopeFailure(budgetPressure(requestPacket.tokens, ceiling), contextAdmission);
                 await this.#problems.record({
                     workerId,
                     loopId,
                     turnId,
                     sequence: nextActionIndex++,
-                    origin: "model",
+                    origin: "plurnk",
                     source: "engine",
-                    result: BudgetOverflow.result(requestPacket.tokens, ceiling, true),
+                    result: failure,
                 });
-                // Rebuild so the recovery-steer row just minted renders in THIS packet's log +
-                // errors sections (the same re-derive contract the soft grind uses).
+                // Preserve the exact terminal evidence in the stored request. It is
+                // never sent because admission has already failed.
                 requestPacket = await this.#packets.buildRequestPacket({
                     initialMessages: messages, requirements, workspaceId, workerId, loopId,
-                    currentTurnSeq: seq, provider, gitStatus, notices,
+                    currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
                 });
-                physicalAdmission = await this.#packets.physicalAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
-                if (physicalAdmission.admitted) {
-                    this.#hardOverflowRecovery.add(loopId);
-                    operationConstraint = {
-                        code: "budget-recovery",
-                        detail: "budget recovery is active",
-                        allowedOperations: BudgetOverflow.recoveryOperations,
-                    };
-                }
-            }
-            if (operationConstraint === undefined) {
-                // Hard 413: physically unsendable, or still over after the constrained recovery turn.
-                const ceiling = this.#packets.ceilingFor(provider);
-                if (ceiling === null) {
-                    throw new Error("an unbounded prompt budget cannot hard-stop");
-                }
-                if (!enforced.recorded || !physicalAdmission.admitted) {
-                    await this.#problems.record({
-                        workerId,
-                        loopId,
-                        turnId,
-                        sequence: nextActionIndex++,
-                        origin: "plurnk",
-                        source: "engine",
-                        result: BudgetOverflow.result(requestPacket.tokens, ceiling, false, physicalAdmission.admitted
-                            ? undefined
-                            : {
-                                reason: physicalAdmission.reason,
-                                detail: physicalAdmission.detail,
-                                capacity: physicalAdmission.capacity,
-                                tokens: physicalAdmission.measurement?.tokens,
-                                tokenKind: physicalAdmission.measurement?.kind,
-                                tokenSource: physicalAdmission.measurement?.source,
-                            }),
-                    });
-                    requestPacket = await this.#packets.buildRequestPacket({
-                        initialMessages: messages, requirements, workspaceId, workerId, loopId,
-                        currentTurnSeq: seq, provider, gitStatus, notices,
-                    });
-                }
-                // Skip the LLM, close the turn, and let runLoop abandon.
                 await this.#db.engine_close_turn.run({
                     id: turnId, status: 413, packet: StoredPacket.stringify(requestPacket),
-                    usage_prompt: 0, usage_completion: 0, usage_reasoning: 0, usage_cached: 0,
-                    usage_cost: "[]", usage_cost_usd: 0,
                     // The attempted turn retains its effective allowance even
                     // when no provider exchange completed. {§tokenomics-client-gauge}
                     usage_prompt_budget: this.#packets.promptBudgetFor(provider),
@@ -1096,22 +1234,16 @@ export default class Engine {
                 return {
                     turnId,
                     status: 413,
-                    statuses: [],
+                    outcomes: [],
                     fingerprint: "",
-                    budgetStruck: enforced.struck,
                     budgetHardStop: true,
                     steerStruck: false,
                     emissionAttempts: 0,
                     emissionExhausted: false,
-                    budget: BudgetOverflow.measure(requestPacket.tokens, ceiling),
+                    budgetFailure: failure,
                 };
             }
         }
-        else {
-            // A fitting turn clears the recovery grant; a later independent overflow can earn
-            // a fresh recovery turn (chronic overflow still strikes out via the rail).
-            this.#hardOverflowRecovery.delete(loopId);
-        }
         const modelMessages = PacketWire.packetToWireMessages(requestPacket);
         // Packet pressure and provider generation are independent. The grinder governs
         // only the request packet; maxTokens comes only from the provider envelope and
@@ -1119,54 +1251,38 @@ export default class Engine {
         let response;
         let splitResponse;
         let railGrammar;
+        let railResponseGrammar;
         let railEvidence;
         let emissionAttempts = 0;
-        const usage = { prompt: 0, completion: 0, reasoning: 0, cached: 0 };
-        let usageCostUsd = 0;
-        const providerCosts = [];
         let providerCallInFlight = false;
         let providerAttemptSequence = 0;
+        let providerAttemptId = null;
+        let providerModelCall = null;
         let providerAttemptAttributions = [];
         const providerSignal = this.#loopAborts.get(loopId)?.signal ?? signal;
         // {§client-metadata}
         const { client } = await WorkspaceSettings.read(this.#db, workspaceId);
-        const recordProviderAttempt = async (attemptResponse, attemptSplit, sequence, accepted, attributions) => {
-            const attemptUsage = attemptSplit.callMetadata.usage;
-            const attemptCost = providerCostFor(provider, attemptUsage, attemptResponse.charge);
-            const attemptCostUsd = providerCostUsd(attemptCost);
-            await this.#db.engine_record_turn_attempt.run({
-                turn_id: turnId,
-                sequence,
+        const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
+        const providerIdentity = await this.resolveWorkerProviderIdentity(workerId);
+        const { workerId: providerWorkerId, primaryWorkerId } = providerIdentity;
+        const classifyProviderAttempt = async (id, attemptSplit, sequence, accepted) => {
+            const result = await this.#db.engine_classify_turn_attempt_response.run({
+                id,
                 accepted: accepted ? 1 : 0,
-                response: JSON.stringify(attemptResponse),
                 parse_errors: JSON.stringify(attemptSplit.parseErrors),
-                attributions: JSON.stringify(attributions),
-                usage_prompt: attemptUsage.prompt,
-                usage_completion: attemptUsage.completion,
-                usage_reasoning: attemptUsage.reasoning,
-                usage_cached: attemptUsage.cached,
-                usage_cost: JSON.stringify(attemptCost),
-                usage_cost_usd: attemptCostUsd,
-                finish_reason: attemptSplit.callMetadata.finishReason,
-                model: attemptSplit.callMetadata.model,
             });
-            usage.prompt += attemptUsage.prompt;
-            usage.completion += attemptUsage.completion;
-            usage.reasoning += attemptUsage.reasoning;
-            usage.cached += attemptUsage.cached;
-            providerCosts.push(attemptCost);
-            usageCostUsd = usageCostUsd === null || attemptCostUsd === null
-                ? null
-                : usageCostUsd + attemptCostUsd;
+            if (result.changes !== 1) {
+                throw new Error(`emission attempt ${id} was not awaiting classification`);
+            }
             emissionAttempts = sequence;
         };
         try {
             // {§turn-lifecycle}: bracket the complete provider-attempt window with liveness notices.
             if (!signal?.aborted)
                 this.#notices.push(workspaceId, loopId, { source: "engine:turn", kind: "turn_awaiting_model", level: "info", message: "awaiting model response" });
-            const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
-            railGrammar = await this.#grammarConstraint(provider);
-            const primaryWorkerId = String(await this.resolveWorkerPrimary(workerId));
+            const railConstraint = await this.#grammarConstraint(provider);
+            railGrammar = railConstraint?.transport;
+            railResponseGrammar = railConstraint?.response;
             const attemptLimit = readEmissionAttempts();
             const maxTokens = this.#packets.maxTokensFor(provider) ?? undefined;
             const strikeStreak = this.#strikes.streak(loopId);
@@ -1178,7 +1294,7 @@ export default class Engine {
                 providerAttemptSequence = attempt;
                 const attributionContext = Object.freeze({
                     workspaceId: String(workspaceId),
-                    workerId: String(workerId),
+                    workerId: providerWorkerId,
                     primaryWorkerId,
                     loop: loopSeq,
                     turn: seq,
@@ -1186,40 +1302,67 @@ export default class Engine {
                 });
                 providerAttemptAttributions = await this.#attemptAttributions(provider, attributionContext);
                 requestPacket = { ...requestPacket, attributions: providerAttemptAttributions };
+                providerModelCall = await ModelCall.open(this.#db, {
+                    turnId,
+                    sequence: attempt,
+                    kind: "emission",
+                    attributions: providerAttemptAttributions,
+                    model: provider.model,
+                });
+                const attemptRow = await this.#db.engine_open_turn_attempt.get({
+                    model_call_id: providerModelCall.id,
+                });
+                if (attemptRow === undefined) {
+                    throw new Error(`Engine.runTurn: provider attempt ${attempt} did not open`);
+                }
+                providerAttemptId = attemptRow.id;
                 providerCallInFlight = true;
+                const currentModelCall = providerModelCall;
                 const completedResponse = await observed(// {§observability-boundary}
                 "provider.generate", { model: provider.model, attempt }, async (span) => {
-                    const generated = await provider.generate({
-                        messages: modelMessages,
-                        workerId: String(workerId),
-                        primaryWorkerId,
-                        signal: providerSignal,
-                        grammar: railGrammar,
-                        maxTokens,
-                        strikes: strikeStreak,
-                        attributions: providerAttemptAttributions.length > 0
-                            ? providerAttemptAttributions
-                            : undefined,
-                        client: client ?? undefined,
-                        workspaceId: String(workspaceId),
-                        loop: loopSeq,
-                        turn: seq,
-                    }); // {§provider-surface-generate} {§provider-guarantees-signal-wired} {§provider-guarantees-serial-attempts} {§attribution} {§client-metadata}
-                    recordCounter(PROVIDER_CALLS, {
-                        model: provider.model,
-                        attempt,
-                        status: "resolved",
-                    });
-                    span.setAttribute("status", "resolved");
-                    return generated;
+                    try {
+                        const generated = await provider.generate({
+                            messages: modelMessages,
+                            workerId: providerWorkerId,
+                            primaryWorkerId,
+                            signal: providerSignal,
+                            grammar: railGrammar,
+                            maxTokens,
+                            strikes: strikeStreak,
+                            attributions: providerAttemptAttributions.length > 0
+                                ? providerAttemptAttributions
+                                : undefined,
+                            client: client ?? undefined,
+                            workspaceId: String(workspaceId),
+                            loop: loopSeq,
+                            turn: seq,
+                            observeRequest: currentModelCall.observeRequest,
+                            callKind: "emission",
+                        }); // {§provider-surface-generate} {§provider-guarantees-signal-wired} {§provider-guarantees-serial-attempts} {§attribution} {§client-metadata}
+                        currentModelCall.assertAccounting(generated.accounting);
+                        providerCallInFlight = false;
+                        recordCounter(PROVIDER_CALLS, {
+                            model: provider.model,
+                            attempt,
+                            status: "resolved",
+                        });
+                        span.setAttribute("status", "resolved");
+                        return generated;
+                    }
+                    catch (error) {
+                        if (error instanceof ProviderError) {
+                            currentModelCall.assertAccounting(error.accounting);
+                        }
+                        throw error;
+                    }
                 });
                 response = completedResponse;
-                providerCallInFlight = false;
+                await currentModelCall.observeResponse(completedResponse);
                 railEvidence = railGrammar === undefined
                     ? undefined
-                    : Engine.#requireGrammarEvidence(completedResponse);
+                    : _a.#requireGrammarEvidence(completedResponse);
                 splitResponse = this.#splitResponse(completedResponse);
-                await recordProviderAttempt(completedResponse, splitResponse, attempt, splitResponse.emissionValid, providerAttemptAttributions);
+                await classifyProviderAttempt(attemptRow.id, splitResponse, attempt, splitResponse.emissionValid);
                 if (splitResponse.emissionValid)
                     break;
             }
@@ -1229,22 +1372,27 @@ export default class Engine {
         catch (err) {
             // This handler owns only provider-call failures. Parser, cost, SQL,
             // and engine-contract failures retain their original source.
+            if (err instanceof ModelCallPersistenceError || err instanceof ProviderAccountingIntegrityError)
+                throw err;
             if (!providerCallInFlight)
                 throw err;
+            providerCallInFlight = false;
+            if (providerAttemptId === null || providerModelCall === null) {
+                throw new Error("provider call failed without durable model-call and attempt identities", { cause: err });
+            }
+            const failure = _a.#providerFailure(err, providerSignal);
             // {§provider-interrupted-attempt} — a provider-declared interruption
             // carries response evidence without becoming a completed exchange.
             // Persist it as an unaccepted attempt before settling the failure.
             if (err instanceof ProviderError && err.attempt !== undefined) {
                 response = err.attempt;
+                await providerModelCall.observeResponse(response, failure);
                 splitResponse = this.#splitResponse(response);
-                await recordProviderAttempt(response, splitResponse, providerAttemptSequence, false, providerAttemptAttributions);
+                await classifyProviderAttempt(providerAttemptId, splitResponse, providerAttemptSequence, false);
             }
             else {
-                providerCosts.push({
-                    kind: "unknown",
-                    reason: "provider call failed without response-bearing charge evidence",
-                });
-                usageCostUsd = null;
+                await providerModelCall.fail(failure);
+                emissionAttempts = providerAttemptSequence;
             }
             // {§turn-never-blank} — a ProviderError means no completed exchange exists.
             // Persist its exact RFC 9457 result before propagating it. Grammar evidence
@@ -1258,12 +1406,6 @@ export default class Engine {
                     id: turnId,
                     status: providerSignal.reason === LOOP_TIMEOUT_REASON ? 504 : 499,
                     packet: StoredPacket.stringify(requestPacket),
-                    usage_prompt: usage.prompt,
-                    usage_completion: usage.completion,
-                    usage_reasoning: usage.reasoning,
-                    usage_cached: usage.cached,
-                    usage_cost: JSON.stringify(providerCosts),
-                    usage_cost_usd: usageCostUsd,
                     usage_prompt_budget: this.#packets.promptBudgetFor(provider),
                     finish_reason: splitResponse?.callMetadata.finishReason ?? null,
                     model: splitResponse?.callMetadata.model ?? provider.model,
@@ -1271,15 +1413,6 @@ export default class Engine {
                 });
                 throw err;
             }
-            const failure = err instanceof ProviderError
-                ? { status: err.problem.status, problem: err.problem }
-                : (() => {
-                    console.error("Provider failed outside its Problem Details contract:", err);
-                    return Results.failure("engine:provider", "provider-contract-violation", 502, "The provider failed without returning its required Problem Details.", {}, {
-                        stage: "provider-request",
-                        retryable: false,
-                    });
-                })();
             const recorded = await this.#problems.record({
                 workerId,
                 loopId,
@@ -1296,12 +1429,6 @@ export default class Engine {
                 id: turnId,
                 status: recorded.result.status,
                 packet: StoredPacket.stringify(requestPacket),
-                usage_prompt: usage.prompt,
-                usage_completion: usage.completion,
-                usage_reasoning: usage.reasoning,
-                usage_cached: usage.cached,
-                usage_cost: JSON.stringify(providerCosts),
-                usage_cost_usd: usageCostUsd,
                 usage_prompt_budget: this.#packets.promptBudgetFor(provider),
                 finish_reason: splitResponse?.callMetadata.finishReason ?? null,
                 model: splitResponse?.callMetadata.model ?? provider.model,
@@ -1309,20 +1436,36 @@ export default class Engine {
             });
             throw new OperationFailureError(recorded.result, { cause: err });
         }
-        if (response === undefined || splitResponse === undefined) {
+        if (response === undefined || splitResponse === undefined || providerModelCall === null) {
             throw new Error("provider attempt loop completed without a response");
         }
+        const emissionModelCallId = providerModelCall.id;
         if (!splitResponse.emissionValid) {
+            // {§invalid-emission-attempts} The first consecutive exhaustion
+            // publishes only the raw final response and generic recovery fact.
+            let rejectedModelEntryId;
+            if (allowInvalidEmissionRecovery) {
+                rejectedModelEntryId = await this.#dispatcher.writeModelEntry({
+                    verbatim: splitResponse.packetAssistant.content,
+                    workerId,
+                    loopId,
+                    turnId,
+                    sequence: nextActionIndex,
+                    folded: true,
+                    modelCallId: emissionModelCallId,
+                    admission: "rejected",
+                });
+                this.#notices.push(workspaceId, loopId, {
+                    source: "engine:grammar",
+                    kind: "invalid_emission",
+                    level: "error",
+                    message: INVALID_EMISSION_RECOVERY_MESSAGE,
+                });
+            }
             await this.#db.engine_close_turn.run({
                 id: turnId,
-                status: 500,
+                status: allowInvalidEmissionRecovery ? TURN_STATUS_IMPLICIT_CONTINUE : 500,
                 packet: StoredPacket.stringify(requestPacket),
-                usage_prompt: usage.prompt,
-                usage_completion: usage.completion,
-                usage_reasoning: usage.reasoning,
-                usage_cached: usage.cached,
-                usage_cost: JSON.stringify(providerCosts),
-                usage_cost_usd: usageCostUsd,
                 usage_prompt_budget: this.#packets.promptBudgetFor(provider),
                 finish_reason: splitResponse.callMetadata.finishReason,
                 model: splitResponse.callMetadata.model,
@@ -1330,14 +1473,14 @@ export default class Engine {
             });
             return {
                 turnId,
-                status: 500,
-                statuses: [],
+                status: allowInvalidEmissionRecovery ? TURN_STATUS_IMPLICIT_CONTINUE : 500,
+                outcomes: [],
                 fingerprint: "",
-                budgetStruck: enforced.struck,
                 budgetHardStop: false,
                 steerStruck: false,
                 emissionAttempts,
                 emissionExhausted: true,
+                ...(rejectedModelEntryId === undefined ? {} : { rejectedModelEntryId }),
             };
         }
         // {§packet-stored-shape} — admitted emission data extends the packet;
@@ -1348,7 +1491,7 @@ export default class Engine {
         }
         // Non-fatal provider transport notices on an accepted turn. Forward each
         // Notice with a content-offset `line:col`;
-        // the model resolves it against its own emission — READ the folded `model` mirror row at the
+        // the model resolves it against its own emission — READ the folded model-emission row at the
         // cited lines ({§model-entry}) — not an embedded snippet that would duplicate the emission.
         for (const notice of response.notices ?? []) {
             const located = typeof notice.position === "number"
@@ -1370,12 +1513,14 @@ export default class Engine {
         if (railGrammar !== undefined) {
             if (railEvidence === undefined)
                 throw new Error("configured GBNF response has no final grammar evidence");
+            if (railResponseGrammar === undefined)
+                throw new Error("configured GBNF has no response grammar");
             let verdict = null;
             try {
-                verdict = validateGbnf(railGrammar, railEvidence.input);
+                verdict = validateGbnf(railResponseGrammar, railEvidence.input);
             }
             catch (cause) {
-                Engine.#warnRailVerdictGapOnce(cause.message);
+                _a.#warnRailVerdictGapOnce(cause.message);
             }
             railKeys = {
                 railsAttached: railEvidence.transported ? "client" : "withheld",
@@ -1442,12 +1587,6 @@ export default class Engine {
             id: turnId,
             status: turnStatus,
             packet: StoredPacket.stringify(packet),
-            usage_prompt: usage.prompt,
-            usage_completion: usage.completion,
-            usage_reasoning: usage.reasoning,
-            usage_cached: usage.cached,
-            usage_cost: JSON.stringify(providerCosts),
-            usage_cost_usd: usageCostUsd,
             usage_prompt_budget: this.#packets.promptBudgetFor(provider), // {§tokenomics-client-gauge}
             finish_reason: callMetadata.finishReason,
             model: callMetadata.model,
@@ -1471,22 +1610,19 @@ export default class Engine {
         // (the PLAN/SEND ops, zero actions), which is its only coherent meaning.
         let realCommands = 0;
         const admittedOps = packetAssistant.ops.filter((op) => {
-            const constrained = operationConstraint !== undefined
-                && !operationConstraint.allowedOperations.includes(op.op);
             return op.op === "PLAN"
                 || op === sendOp
-                || constrained
                 || realCommands++ < maxCommands;
         });
         const opsToDispatch = scheduleTurnOps(admittedOps);
-        await this.#dispatcher.prepareEditBatches(opsToDispatch.filter((statement) => statement.op === "EDIT"
-            && (operationConstraint === undefined
-                || operationConstraint.allowedOperations.includes(statement.op))), {
+        await this.#dispatcher.prepareEditBatches(opsToDispatch.filter((statement) => statement.op === "EDIT"), {
             workspaceId, workerId, loopId, turnId,
             origin, onDispatch,
         });
         const droppedCount = opsCount - opsToDispatch.length;
-        const statuses = [];
+        const bareStatements = opsToDispatch.filter((statement) => statement.op === "BARE");
+        let bareResults = null;
+        const outcomes = [];
         // Running counter — a multi-file READ writes N rows from one statement (rowsWritten),
         // so the next op's sequence picks up after them. Collapses to nextActionIndex+i when
         // every op writes one row (the common case).
@@ -1513,7 +1649,7 @@ export default class Engine {
                         retryable: false,
                     }),
                 });
-                statuses.push(recorded.result.status);
+                outcomes.push({ op: null, status: recorded.result.status });
                 onDispatch?.(recorded.id);
             }
         };
@@ -1522,20 +1658,59 @@ export default class Engine {
                 && typeof statement.signal === "number"
                 && TERMINAL_SEND_SIGNALS.has(statement.signal)) {
                 await recordRecoverableParseErrors();
+                // {§worker-optimistic-settlement} — SEND judges the refreshed
+                // lifecycle after this turn's own fast streams receive one
+                // bounded opportunity to conclude. This is not a sleep and
+                // does not delay a later turn for older monitored streams.
+                const execHandler = this.#schemes.get("exec");
+                await execHandler?.settleTurnSpawns?.(workerId, turnId, readOptimisticSettlementMs(), providerSignal);
             }
             const result = await observed(// {§observability-boundary}
             "op.dispatch", { op: statement.op }, async (span) => {
-                const dispatchResult = await this.#dispatcher.dispatch({
-                    statement, workspaceId, workerId, loopId, turnId,
-                    sequence: rowSeq,
-                    ...(operationConstraint === undefined ? {} : { operationConstraint }),
-                    origin, onDispatch,
-                });
+                let dispatchResult;
+                if (statement.op === "BARE") {
+                    if (bareResults === null) {
+                        const batch = await this.#runBareBatch({
+                            statements: bareStatements,
+                            provider: childProvider,
+                            turnId,
+                            modelCallSequenceStart: providerAttemptSequence + 1,
+                            workspaceId,
+                            workerId,
+                            primaryWorkerId,
+                            loopSequence: loopSeq,
+                            turnSequence: seq,
+                            signal: providerSignal,
+                        });
+                        bareResults = new Map(batch.map((item) => [item.statement, item]));
+                    }
+                    const bare = bareResults.get(statement);
+                    if (bare === undefined) {
+                        throw new Error("BARE statement reached dispatch without its batch result");
+                    }
+                    dispatchResult = await this.#dispatcher.recordBareResult({
+                        statement,
+                        workspaceId,
+                        workerId,
+                        loopId,
+                        turnId,
+                        sequence: rowSeq,
+                        origin,
+                        onDispatch,
+                    }, bare.result, bare.modelCallId);
+                }
+                else {
+                    dispatchResult = await this.#dispatcher.dispatch({
+                        statement, workspaceId, workerId, loopId, turnId,
+                        sequence: rowSeq,
+                        origin, onDispatch,
+                    });
+                }
                 span.setAttribute("status", dispatchResult.status);
                 recordCounter(OPS_DISPATCHED, { op: statement.op, status: dispatchResult.status });
                 return dispatchResult;
             });
-            statuses.push(result.status);
+            outcomes.push({ op: statement.op, status: result.status });
             for (const normalization of result.scopeNormalizations ?? []) {
                 this.#notices.push(workspaceId, loopId, {
                     source: "engine:slicer",
@@ -1591,7 +1766,7 @@ export default class Engine {
                 }
                 : {
                     stage: "turn",
-                    recovery: "Perform an operation before continuing with SEND[102].",
+                    recovery: "Perform an operation before continuing with `## SEND0 [102]`.",
                     retryable: false,
                 };
             await this.#problems.record({
@@ -1617,14 +1792,22 @@ export default class Engine {
             ? response.assistant.reasoningEncrypted
             : undefined;
         if (packetAssistant.content.trim().length > 0 || reasoningItems !== undefined) {
-            await this.#dispatcher.writeModelEntry({ verbatim: packetAssistant.content, workerId, loopId, turnId, sequence: errSeq++, folded: true, ...(reasoningItems !== undefined ? { reasoningItems } : {}) });
+            await this.#dispatcher.writeModelEntry({
+                verbatim: packetAssistant.content,
+                workerId,
+                loopId,
+                turnId,
+                sequence: errSeq++,
+                folded: true,
+                modelCallId: emissionModelCallId,
+                ...(reasoningItems !== undefined ? { reasoningItems } : {}),
+            });
         }
         return {
             turnId,
             status: turnStatus,
-            statuses,
+            outcomes,
             fingerprint: StrikeRail.fingerprintTurn(packetAssistant.ops),
-            budgetStruck: enforced.struck,
             budgetHardStop: false,
             steerStruck,
             emissionAttempts,
@@ -1633,7 +1816,8 @@ export default class Engine {
     }
     // Split the wire-level ProviderResponse into the two destinations:
     // packet.assistant gets the model's emission (content, ops, reasoning);
-    // Turn columns get the call-metadata (usage, finishReason, model).
+    // Turn columns get accepted-call metadata (finishReason, model). Physical
+    // request usage and cost have their own cardinal persistence path.
     // {§provider-surface} Text-fragment scraping policy lives
     // here — engine owns the parse and the scraping rule, providers stay
     // grammar-unaware.
@@ -1647,10 +1831,8 @@ export default class Engine {
         const preParsedOps = assistant.ops;
         const ops = [];
         // PLAN is an ordinary op — emitted by the model, dispatched, and passed to the
-        // client as a log entry. No special hoisting into the reasoning field (that
-        // only structured operations are executable). Interstitial free text is DROPPED — the prior
-        // #free-text-capture synthesis of SEND[103] log ops was retired as tech debt
-        // (grammar 0.70 forbids free text between ops, so a prose-only turn strikes 422).
+        // client as a log entry. No special hoisting into the reasoning field. Only
+        // structured operations are executable; interstitial text is not an operation.
         // Full PlurnkParseError context is preserved on rejected attempt evidence;
         // warnings remain admissible Notices. {§parse-diagnostics}
         const parseErrors = [];
@@ -1671,7 +1853,6 @@ export default class Engine {
                 if (item.kind === "statement") {
                     ops.push(item.statement);
                 }
-                // Free text (kind "text") is dropped — #free-text-capture retired (above).
                 else if (item.kind === "error") {
                     const err = item.error;
                     if (err instanceof PlurnkParseError) {
@@ -1726,7 +1907,7 @@ export default class Engine {
         const reasoning = assistant.reasoning ?? null;
         return {
             packetAssistant: { content: assistant.content, ops, reasoning },
-            callMetadata: { usage: assistant.usage, finishReason: assistant.finishReason, model: assistant.model },
+            callMetadata: { finishReason: assistant.finishReason, model: assistant.model },
             parseErrors,
             recoverableParseErrors: emissionValid ? recoverableParseErrors : [],
             parseNotices,
@@ -1758,11 +1939,36 @@ export default class Engine {
                 || r.op === null || r.status_rx === null)
                 continue;
             const termination = r.kind === "loop_termination";
-            const rx = termination
-                ? BranchReceipt.append(markTerminal(r.terminated_by, r.rx) ?? `loop "${r.prompt ?? ""}" ended (${r.status_rx})`, await BranchReceipt.render(this.#db, r.producer_worker_id))
-                : r.rx;
-            if (rx === null)
+            if (r.rx === null)
                 throw new Error(`ambient event ${r.event_id} has no materializable result`);
+            const terminal = termination
+                ? TerminalResult.parse(r.rx, `ambient loop-termination event ${r.event_id}`)
+                : null;
+            if (terminal !== null && terminal.status !== r.status_rx) {
+                throw new Error(`ambient loop-termination event ${r.event_id} status ${r.status_rx} does not match its terminal result status ${terminal.status}`);
+            }
+            let attrs = r.attrs ?? "{}";
+            const parsedTags = JSON.parse(r.tags ?? "[]");
+            if (!Array.isArray(parsedTags) || !parsedTags.every((tag) => typeof tag === "string" && tag.length > 0)) {
+                throw new TypeError(`ambient event ${r.event_id} tags must be an array of nonempty strings`);
+            }
+            const tags = [...new Set(parsedTags)].toSorted();
+            if (tags.length !== parsedTags.length || tags.some((tag, index) => tag !== parsedTags[index])) {
+                throw new TypeError(`ambient event ${r.event_id} tags must be unique and sorted`);
+            }
+            if (terminal !== null) {
+                const inherited = JSON.parse(attrs);
+                if (inherited === null || typeof inherited !== "object" || Array.isArray(inherited)) {
+                    throw new TypeError(`ambient loop-termination event ${r.event_id} attrs must be an object`);
+                }
+                const receipt = await BranchReceipt.render(this.#db, r.producer_worker_id);
+                attrs = JSON.stringify({
+                    ...inherited,
+                    kind: "loop_termination",
+                    ...(r.terminated_by === null ? {} : { terminatedBy: r.terminated_by }),
+                    ...(receipt === null ? {} : { receipt }),
+                });
+            }
             const inserted = await this.#db.engine_insert_ambient_delta.get({
                 worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
                 event_id: r.event_id,
@@ -1771,12 +1977,21 @@ export default class Engine {
                 scheme: r.scheme,
                 hostname: r.hostname,
                 pathname: r.pathname,
-                rx,
-                mimetype_rx: termination ? "text/markdown" : "application/json",
+                rx: r.rx,
+                mimetype_rx: "application/json",
                 status: r.status_rx,
-                expanded: termination && r.status_rx >= 200 && r.status_rx < 300 ? 1 : 0,
-                attrs: r.attrs ?? "{}",
+                expanded: terminal !== null && terminal.status >= 200 && terminal.status < 300 ? 1 : 0,
+                attrs,
             });
+            const materialized = inserted ?? await this.#db.engine_ambient_delta_id.get({
+                worker_id: workerId,
+                event_id: r.event_id,
+            });
+            if (materialized === undefined)
+                throw new Error(`ambient event ${r.event_id} has no observer log row after materialization`);
+            for (const tag of tags) {
+                await this.#db.log_write_tag.run({ log_entry_id: materialized.id, tag });
+            }
             if (inserted !== undefined)
                 written++;
         }
@@ -1801,11 +2016,10 @@ export default class Engine {
         return this.#liveSubscriptions.cancel(subscriptionId);
     }
     // {§env-delta} — exec streams as an instance of the ambient-observe machine:
-    // each turn, emit each owned channel's unshown byte-delta as a foisted READ row. It is 200
-    // while the channel streams and preserves the exact terminal result when closed. Ongoing
-    // deltas fold; the terminal delta auto-OPENs. The cursor is the
-    // streamEnd recorded on the channel's prior delta — no exec-specific surfacing, just the
-    // env-observe loop with a byte cursor where env-delta uses a timestamp. {§exec-stream}
+    // each turn, emit each owned channel's next publishable content as a foisted READ row. It is
+    // 200 while the channel streams and preserves the exact terminal result when closed. Ongoing
+    // observations fold; the terminal observation auto-OPENs. The cursor is the streamEnd recorded
+    // on the channel's prior observation. {§exec-stream}
     async #materializeStreamDeltas(args) {
         const { workerId, loopId, turnId, fromSequence } = args;
         const channels = await this.#db.engine_worker_stream_channels.all({ worker_id: workerId });
@@ -1847,14 +2061,15 @@ export default class Engine {
                 }
                 return result;
             };
-            if (ch.content.length <= cursor) {
-                // The cursor-terminal race (owner's dogfood find): a channel written in one final
+            const publishEnd = streamPublicationEnd(ch.content, ch.mimetype, cursor, closed);
+            if (publishEnd <= cursor) {
+                // The cursor-terminal race: a channel written in one final
                 // burst gets fully shown FOLDED while still active; the close then has zero new
-                // bytes and the auto-OPEN terminal delta never fired — the model was never shown
+                // content and the auto-OPEN terminal observation never fired — the model was never shown
                 // the conclusion of a stream whose result it already holds folded. The same
-                // observation is required when the stream produced zero bytes: completion is
-                // information independently of payload. Emit the terminal marker ONCE: open,
-                // terse, carrying the close status ({§tokenomics-fetch-fits-free}).
+                // observation is required when the channel produced no publishable content:
+                // completion is information independently of payload. Text streams retain their
+                // terse marker; structured channels emit a bodyless typed conclusion.
                 if (closed && priorAttrs.terminal !== true) {
                     const streamTarget = renderTarget({
                         scheme: ch.runtime,
@@ -1867,12 +2082,15 @@ export default class Engine {
                         ? `full output already delivered above; READ ${streamTarget} to revisit`
                         : "stream produced no output";
                     const sequence = fromSequence + written;
+                    const content = baseMimetype(ch.mimetype).startsWith("text/")
+                        ? `[ stream closed (${ch.close_status ?? 200}) - ${pointer} ]`
+                        : "";
                     await this.#db.engine_insert_stream_delta.run({
                         worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence,
                         scheme: ch.runtime, pathname: ch.coord, fragment: visibleFragment,
                         rx: JSON.stringify(await terminalResult({
-                            content: `[ stream closed (${ch.close_status ?? 200}) - ${pointer} ]`,
-                            mimetype: "text/stream",
+                            content,
+                            mimetype: ch.mimetype,
                         }, sequence)),
                         status: terminal?.status ?? 200,
                         attrs: JSON.stringify({ streamEnd: ch.content.length, terminal: true }),
@@ -1886,16 +2104,19 @@ export default class Engine {
             // into one sequence (lines N..M, then M+1..), not N independent "1:" restarts. {§exec-stream}
             const startLine = (ch.content.slice(0, cursor).match(/\n/g)?.length ?? 0) + 1;
             const sequence = fromSequence + written;
-            const result = closed
-                ? await terminalResult({ content: ch.content.slice(cursor), mimetype: "text/stream", startLine }, sequence)
-                : { status: 200, content: ch.content.slice(cursor), mimetype: "text/stream", startLine };
+            const content = ch.content.slice(cursor, publishEnd);
+            const terminalDelivery = closed && publishEnd === ch.content.length;
+            const fields = { content, mimetype: ch.mimetype, startLine };
+            const result = terminalDelivery
+                ? await terminalResult(fields, sequence)
+                : { status: 200, ...fields };
             await this.#db.engine_insert_stream_delta.run({
                 worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence,
                 scheme: ch.runtime, pathname: ch.coord, fragment: visibleFragment,
                 rx: JSON.stringify(result),
                 status: result.status,
-                attrs: JSON.stringify({ streamEnd: ch.content.length, terminal: closed }),
-                expanded: closed ? 1 : 0, // {§exec-stream} — terminal delta auto-OPENs; ongoing folds
+                attrs: JSON.stringify({ streamEnd: publishEnd, terminal: terminalDelivery }),
+                expanded: terminalDelivery ? 1 : 0, // {§exec-stream} — terminal observation auto-OPENs; ongoing folds
             });
             written++;
         }
@@ -1903,9 +2124,10 @@ export default class Engine {
     }
     // {§env-delta-filesystem-narration} {§membership-emi-divergence-signal}
     // — journal project-file divergence once through the reserved actor.
-    async #logFsFictions(workspaceId, divergences) {
+    async #logFsFictions(workspaceId, divergences, gitStatus) {
         if (divergences.length === 0)
             return;
+        const gitByPath = new Map(gitStatus?.files.map(({ path, status }) => [path, status]) ?? []);
         const worker = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name: "plurnk" })
             ?? await this.#db.envelope_insert_worker.get({ workspace_id: workspaceId, name: "plurnk", origin: "plurnk" });
         if (worker === undefined)
@@ -1919,14 +2141,18 @@ export default class Engine {
             const span = editedSpan(d.before, d.after);
             await this.#db.engine_insert_log_entry.get({
                 worker_id: worker.id, loop_id: loop.id, turn_id: turn.id, sequence: sequence++,
-                origin: "plurnk", source: "file", op: "EDIT", suffix: "", signal: null,
+                origin: "plurnk", source: "file", model_call_id: null,
+                op: "EDIT", suffix: "", signal: null,
                 // Match Dispatcher.#extractTarget: a bare file address has NULL scheme
                 // only in log target metadata; its entry identity remains `file`.
                 scheme: null, username: null, password: null, hostname: null, port: null,
                 pathname: d.pathname, query: null, fragment: null, lineMarker: null,
                 tx: "", mimetype_tx: "text/plain",
                 rx: JSON.stringify({ status: 200, entryId: d.entryId, channel: d.channel, span }), mimetype_rx: "application/json",
-                status_rx: 200, tokens: 0, state: "resolved", outcome: null, attrs: "{}",
+                status_rx: 200, tokens: 0, state: "resolved", outcome: null,
+                attrs: gitByPath.has(d.pathname)
+                    ? JSON.stringify({ git: gitByPath.get(d.pathname) })
+                    : "{}",
             });
         }
     }
@@ -1957,6 +2183,7 @@ export default class Engine {
             sequence,
             origin: "plurnk",
             source: null,
+            model_call_id: null,
             op: "prompt",
             suffix: "",
             signal: null,
@@ -2083,11 +2310,12 @@ export default class Engine {
         };
         const entry = {
             channels: { body: { content: prompt, mimetype: "text/markdown" } },
-            tags: [],
             attributes: { openPaths },
         };
         await EntryCrud.writeEntry(pathname, entry, ctx, "prompt", workerId);
         return { loopId, turnSeq };
     }
 }
+_a = Engine;
+export default Engine;
 //# sourceMappingURL=Engine.js.map