@plurnk/plurnk-service 1.5.0 → 1.6.0

package/dist/core/Engine.js

@@ -1,5 +1,6 @@
+var _a;
 import { PlurnkParser, PlurnkParseError, UNKNOWN_POSITION } from "@plurnk/plurnk-contracts";
-import { RuntimeTag } from "@plurnk/plurnk-execs";
+import { RuntimeInvocation, RuntimeTag } from "@plurnk/plurnk-execs";
 import Owner from "./Owner.js";
 const TERMINAL_SEND_SIGNALS = new Set([102, 200, 202, 300, 499]);
 const comparePosition = (a, b) => a.line - b.line || a.column - b.column;
@@ -19,6 +20,7 @@ import LoopLifecycle from "./LoopLifecycle.js";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { setTimeout as delay } from "node:timers/promises";
+import { randomUUID } from "node:crypto";
 // Shared module imported by both Engine and bin/digest.ts, so wire
 // projection and digest projection are structurally one function — no
 // drift between wire and digest possible.
@@ -26,7 +28,6 @@ import PacketWire from "./packet-wire.js";
 import Results, { OperationFailureError } from "./results.js";
 import BranchReceipt from "./BranchReceipt.js";
 import TerminalResult from "./TerminalResult.js";
-import BudgetOverflow from "./BudgetOverflow.js";
 import WorkerControlAddress from "./WorkerControlAddress.js";
 import JournalTurn from "./JournalTurn.js";
 // The engine's collaborators — each owns one machine; Engine owns the loop/turn
@@ -42,7 +43,9 @@ import { observed, observedSync } from "../observe/spans.js";
 import { OPS_DISPATCHED, PROVIDER_CALLS, recordCounter } from "../observe/metrics.js";
 import { scheduleTurnOps } from "./turn-scheduler.js";
 import { readOptimisticSettlementMs } from "./optimistic-settlement.js";
-const DEFAULT_MAX_STRIKES = 3;
+import { providerRequestFromStorageRow, } from "./provider-accounting.js";
+import ModelCall, { ModelCallPersistenceError, ProviderAccountingIntegrityError, } from "./ModelCall.js";
+const DEFAULT_MAX_STRIKES = 6;
 const RECORD_STREAM_MIMETYPES = new Set(["application/jsonl", "application/x-ndjson"]);
 const baseMimetype = (mimetype) => mimetype.split(";", 1)[0].trim().toLowerCase();
 // {§exec-stream} Active streams publish only independently meaningful units.
@@ -64,7 +67,7 @@ const ENGINE_PROBLEMS = Object.freeze({
     idle_turn: {
         status: 409,
         code: "idle-turn",
-        detail: "SEND[102] was emitted without an operation to continue from.",
+        detail: "`## SEND0 [102]` was emitted without an operation to continue from.",
     },
 });
 // The prompt entry target - prompt:///<loop>/<N>, self-only ({§prompt-self-only}):
@@ -123,9 +126,50 @@ const readFilesItems = () => {
         return null;
     return normalizeFilesItems(Number.parseInt(raw, 10));
 };
-import { ProviderError, providerCostFor, providerCostUsd, validateProviderCost, scopeEnvToAlias, resolveActiveAlias } from "@plurnk/plurnk-providers";
+import { aggregateProviderAccounting, ProviderError, resolveActiveAlias, scopeEnvToAlias, } from "@plurnk/plurnk-providers";
 import { validateGbnf } from "@plurnk/gbnf";
 import ProviderInstantiate from "./ProviderInstantiate.js";
+// A generated rail may constrain only the sampled continuation while the chat
+// template contributes a prefix that llama-server preserves in its response.
+// The artifact names the alternate root that composes those bytes for evidence
+// grading; arbitrary grammars without the declaration retain their transport root.
+const grammarConstraint = (grammar) => {
+    const declarations = [...grammar.matchAll(/^# @plurnk-response-root ([A-Za-z][A-Za-z0-9-]*)$/gm)];
+    if (declarations.length === 0)
+        return { transport: grammar, response: grammar };
+    if (declarations.length !== 1)
+        throw new Error("GBNF constraint declares multiple @plurnk-response-root values");
+    const responseRoot = declarations[0][1];
+    if (!grammar.split("\n").some((line) => line.startsWith(`${responseRoot} ::=`))) {
+        throw new Error(`GBNF constraint declares missing response root ${responseRoot}`);
+    }
+    const roots = [...grammar.matchAll(/^root ::= ([A-Za-z][A-Za-z0-9-]*)$/gm)];
+    if (roots.length !== 1)
+        throw new Error("GBNF constraint must declare exactly one simple root");
+    return {
+        transport: grammar,
+        response: grammar.replace(roots[0][0], `root ::= ${responseRoot}`),
+    };
+};
+const TOKEN_BUDGET_OVERFLOW_DETAIL = "Token Budget Overflow: Token Usage exceeded Token Ceiling. Newest log items were automatically FOLDed to fit within token budget. Curate the log and/or perform more conservatively scoped or chunked retrieval operations to recover.";
+const tokenBudgetOverflowFailure = (pressure) => Results.failure("engine:context", "token-budget-overflow", 413, TOKEN_BUDGET_OVERFLOW_DETAIL, {}, { ...pressure });
+const budgetPressure = (usage, ceiling) => {
+    if (usage <= ceiling)
+        throw new Error("context-envelope admission requires positive ruler debt");
+    return { usage, ceiling, deficit: usage - ceiling };
+};
+const contextEnvelopeFailure = (pressure, admission) => Results.failure("engine:context", "context-envelope-admission-failed", 413, `The configured context envelope cannot admit this request: ${admission.detail}.`, {}, {
+    ...pressure,
+    stage: "context-envelope-admission",
+    contextAdmission: admission.reason,
+    contextCapacity: admission.capacity,
+    ...(admission.measurement === undefined ? {} : {
+        promptTokens: admission.measurement.tokens,
+        tokenKind: admission.measurement.kind,
+        tokenSource: admission.measurement.source,
+    }),
+    retryable: false,
+});
 // Runtime normalization for a disposition the engine refuses or resolves as a
 // continue after dispatch ({§send}). Every admitted emission itself ends in an
 // explicit disposition SEND ({§emission-admission}).
@@ -155,7 +199,7 @@ const DEFAULT_LOOP_TIMEOUT_MS = 86400000;
 const readLoopTimeoutMs = () => readPositiveInt("PLURNK_SERVICE_LOOP_TIMEOUT", DEFAULT_LOOP_TIMEOUT_MS);
 // The wall's abort reason — runLoop branches a mid-turn teardown to the 504 terminal on it.
 const LOOP_TIMEOUT_REASON = "loop_timeout";
-export default class Engine {
+class Engine {
     static fingerprintTurn(ops) {
         return StrikeRail.fingerprintTurn(ops);
     }
@@ -172,7 +216,7 @@ export default class Engine {
     // Boot-discovered runtime executors. Daemon builds + sets via
     // setExecutors at start(); undefined until then (and in bare tests).
     #executors;
-    // {§send-premature-terminate}/SEND[202]<T> — park deadlines by loopId, written at dispatch (the
+    // {§send-premature-terminate}/scoped SEND signal 202 — park deadlines by loopId, written at dispatch (the
     // marker's seconds; -1 = indefinite), consumed by the daemon's drain park-exit to schedule
     // the deadline wake. In-memory: a daemon restart drops pending deadlines (documented).
     parkDeadlines = new Map();
@@ -184,9 +228,6 @@ export default class Engine {
     #notices;
     #problems;
     #strikes;
-    // {§grinder-hard-413-recovery} - loops granted their one over-ceiling recovery turn. Cleared on a
-    // fitting turn so a later independent overflow can earn a fresh recovery, and at loop cleanup.
-    #hardOverflowRecovery = new Set();
     #packets;
     searchGate = new SearchGate();
     #proposals;
@@ -335,9 +376,9 @@ export default class Engine {
     // parse): warn once per message, never per turn; the turn records railsVerdict "unverifiable".
     static #railGapWarned = new Set();
     static #warnRailVerdictGapOnce(message) {
-        if (Engine.#railGapWarned.has(message))
+        if (_a.#railGapWarned.has(message))
             return;
-        Engine.#railGapWarned.add(message);
+        _a.#railGapWarned.add(message);
         process.stderr.write(`plurnk-engine: rail verdict unavailable — the configured grammar did not parse in @plurnk/gbnf (${message})\n`);
     }
     static #requireGrammarEvidence(response) {
@@ -371,7 +412,8 @@ export default class Engine {
             discovery: { registry: emptyRegistry(), handlers: new Map(), skipped: [] },
         });
         // {§tokenomics-agnostic-ruler} — standalone construction and the daemon
-        // use the same default; provider counting is confined to physical admission.
+        // use the same default; provider counting is confined to hard
+        // context-envelope admission.
         this.#tokenize = tokenize ?? rulerCount;
         const executors = () => this.#executors;
         const loopSignal = (loopId) => this.#loopAborts.get(loopId)?.signal;
@@ -381,7 +423,6 @@ export default class Engine {
         this.#packets = new PacketBuilder({
             db,
             schemes,
-            problems: this.#problems,
             executors,
         });
         this.#proposals = new ProposalLifecycle({
@@ -426,12 +467,16 @@ export default class Engine {
         if (this.#executors === undefined)
             throw new Error("registerRuntime: executor registry not wired yet");
         RuntimeTag.assert(tag, "module runtime");
+        const normalized = {
+            ...entry,
+            invocation: RuntimeInvocation.assert(entry.invocation, entry.namespaceOwner.name, tag),
+        };
         // Preflight both owners before either write; synchronous registration
         // then cannot leave a half-claimed namespace. {§plugin-namespace-arbitration}
-        this.#executors.assertCanRegister(tag, entry.namespaceOwner);
-        this.#schemes.assertRuntimeClaim(tag, entry.namespaceOwner);
-        this.#schemes.registerRuntimeScheme(tag, entry.executor, entry.namespaceOwner, scheme);
-        this.#executors.register(tag, entry);
+        this.#executors.assertCanRegister(tag, normalized.namespaceOwner);
+        this.#schemes.assertRuntimeClaim(tag, normalized.namespaceOwner);
+        this.#schemes.registerRuntimeScheme(tag, normalized.executor, normalized.namespaceOwner, scheme);
+        this.#executors.register(tag, normalized);
     }
     // Supply an explicitly configured local constraint; ANTLR remains the
     // language authority. {§grammar-enforcement-verified-at-boot}
@@ -455,9 +500,10 @@ export default class Engine {
             ? variant
             : fileURLToPath(import.meta.resolve(`@plurnk/plurnk-contracts/${variant}`));
         const text = await readFile(path, "utf8"); // unresolvable/unreadable throws — a configured rail never silently degrades
-        this.#gbnfCache.set(variant, text);
+        const constraint = grammarConstraint(text);
+        this.#gbnfCache.set(variant, constraint);
         process.stderr.write(`plurnk-engine: GBNF constraint: ${alias || "(bare)"} → ${variant} (${text.length} chars)\n`);
-        return text;
+        return constraint;
     }
     // A lineage's no-parent root; a root worker resolves to itself. Fail hard
     // when corruption leaves a worker without one. {§worker-primary}
@@ -467,6 +513,16 @@ export default class Engine {
             throw new Error(`resolveWorkerPrimary: worker ${workerId} has no lineage root — corrupt parent chain`);
         return root.id;
     }
+    async resolveWorkerProviderIdentity(workerId) {
+        const identity = await this.#db.engine_worker_provider_identity.get({ worker_id: workerId });
+        if (identity === undefined) {
+            throw new Error(`resolveWorkerProviderIdentity: worker ${workerId} has no lineage root — corrupt parent chain`);
+        }
+        return {
+            workerId: identity.worker_id,
+            primaryWorkerId: identity.primary_worker_id,
+        };
+    }
     promptBudgetFor(provider) {
         return this.#packets.promptBudgetFor(provider);
     }
@@ -474,6 +530,109 @@ export default class Engine {
         const tags = Meta.composeAttributions(this.#schemes.attributions(context), this.#executors?.attributions(context) ?? [], await this.#mimetypes.attributions(context), provider.attributions?.(context) ?? []);
         return [...tags];
     }
+    #providerAttributions(provider, context) {
+        return [...Meta.composeAttributions(provider.attributions?.(context) ?? [])];
+    }
+    static #providerFailure(error, signal) {
+        if (error instanceof ProviderError) {
+            return { status: error.problem.status, problem: error.problem };
+        }
+        if (signal?.aborted === true) {
+            const timedOut = signal.reason === LOOP_TIMEOUT_REASON;
+            return Results.failure("engine:provider", timedOut ? "provider-call-timeout" : "provider-call-cancelled", timedOut ? 504 : 499, timedOut
+                ? "The provider call was interrupted by the loop deadline."
+                : "The provider call was interrupted by loop cancellation.", {}, { stage: "provider-request", retryable: false });
+        }
+        console.error("Provider failed outside its Problem Details contract:", error);
+        return Results.failure("engine:provider", "provider-contract-violation", 502, "The provider failed without returning its required Problem Details.", {}, { stage: "provider-request", retryable: false });
+    }
+    async #runBareBatch({ statements, provider, turnId, modelCallSequenceStart, workspaceId, workerId, primaryWorkerId, loopSequence, turnSequence, signal, }) {
+        const prepared = [];
+        for (const [index, statement] of statements.entries()) {
+            const providerWorkerId = randomUUID();
+            const attributionContext = Object.freeze({
+                workspaceId: String(workspaceId),
+                workerId: providerWorkerId,
+                primaryWorkerId,
+                loop: loopSequence,
+                turn: turnSequence,
+                attempt: 1,
+            });
+            const attributions = this.#providerAttributions(provider, attributionContext);
+            const modelCall = await ModelCall.open(this.#db, {
+                turnId,
+                sequence: modelCallSequenceStart + index,
+                kind: "bare",
+                attributions,
+                model: provider.model,
+            });
+            prepared.push({ statement, modelCall, attributions, providerWorkerId });
+        }
+        const maxTokens = this.#packets.maxTokensFor(provider) ?? undefined;
+        const settlements = await Promise.allSettled(prepared.map(async ({ statement, modelCall, attributions, providerWorkerId }) => {
+            try {
+                const response = await observed("provider.generate", { model: provider.model, attempt: 1, kind: "bare" }, async (span) => {
+                    try {
+                        const generated = await provider.generate({
+                            messages: [{ role: "user", content: statement.body }],
+                            workerId: providerWorkerId,
+                            primaryWorkerId,
+                            signal,
+                            maxTokens,
+                            attributions: attributions.length > 0 ? attributions : undefined,
+                            workspaceId: String(workspaceId),
+                            loop: loopSequence,
+                            turn: turnSequence,
+                            observeRequest: modelCall.observeRequest,
+                            callKind: "bare",
+                        });
+                        modelCall.assertAccounting(generated.accounting);
+                        recordCounter(PROVIDER_CALLS, {
+                            model: provider.model,
+                            attempt: 1,
+                            status: "resolved",
+                        });
+                        span.setAttribute("status", "resolved");
+                        return generated;
+                    }
+                    catch (error) {
+                        if (error instanceof ProviderError) {
+                            modelCall.assertAccounting(error.accounting);
+                        }
+                        throw error;
+                    }
+                });
+                await modelCall.observeResponse(response);
+                return {
+                    statement,
+                    modelCallId: modelCall.id,
+                    result: Results.assert({
+                        status: 200,
+                        content: response.assistant.content,
+                        mimetype: "text/plain",
+                    }),
+                };
+            }
+            catch (error) {
+                if (error instanceof ModelCallPersistenceError || error instanceof ProviderAccountingIntegrityError) {
+                    throw error;
+                }
+                const failure = _a.#providerFailure(error, signal);
+                if (error instanceof ProviderError && error.attempt !== undefined) {
+                    await modelCall.observeResponse(error.attempt, failure);
+                }
+                else {
+                    await modelCall.fail(failure);
+                }
+                return { statement, modelCallId: modelCall.id, result: failure };
+            }
+        }));
+        const internalFailure = settlements.find((settlement) => settlement.status === "rejected");
+        if (internalFailure !== undefined)
+            throw internalFailure.reason;
+        signal?.throwIfAborted();
+        return settlements.map((settlement) => settlement.value);
+    }
     // {§attribution} — reporting derives from exact provider-request evidence;
     // malformed durable tags fail here instead of being silently filtered.
     async loopAttributions(loopId) {
@@ -486,29 +645,22 @@ export default class Engine {
         });
         return [...Meta.composeAttributions(tags)];
     }
-    // Loop totals are billing evidence; the latest-turn pair is the client
-    // occupancy gauge. {§tokenomics-client-gauge}, {§notifications-loop-terminated}
+    // The request ledger is cardinal evidence; its aggregate and the latest-turn
+    // occupancy gauge are derived projections. {§tokenomics-client-gauge},
+    // {§notifications-loop-terminated}, {§provider-accounting}
     async loopUsage(loopId) {
         const row = await this.#db.engine_loop_usage.get({ loop_id: loopId });
         if (row === undefined)
             throw new Error(`loopUsage: loop ${loopId} does not exist`);
-        const parsedCosts = JSON.parse(row?.costs ?? "[]");
-        if (!Array.isArray(parsedCosts))
-            throw new TypeError(`loop ${loopId} monetary evidence is not an array`);
-        const costs = parsedCosts.map((cost) => validateProviderCost(cost));
+        const requests = await this.#db.engine_loop_provider_requests.all({ loop_id: loopId });
         return {
-            promptTokens: row?.prompt ?? 0,
-            completionTokens: row?.completion ?? 0,
-            reasoningTokens: row?.reasoning ?? 0,
-            cachedTokens: row?.cached ?? 0,
-            costUsd: row?.cost_usd ?? null,
-            costs,
-            // Latest provider attempt on the latest turn, not the billed total.
-            contextTokens: row?.context ?? 0,
+            accounting: aggregateProviderAccounting(requests.map(providerRequestFromStorageRow)),
+            // Latest physical request on the latest turn, not the billed total.
+            contextTokens: row.context,
             // Latest effective packet allowance; null when uncapped or unknown.
-            promptBudget: row?.context_size ?? null,
+            promptBudget: row.context_size,
             // Latest turn's opaque provider metadata. {§meta-passthrough}
-            meta: JSON.parse(row?.meta ?? "{}"),
+            meta: JSON.parse(row.meta ?? "{}"),
         };
     }
     // A mapped rail divergence is a CODE-POINT offset into the model's content;
@@ -531,7 +683,7 @@ export default class Engine {
         }
         return { line, column };
     }
-    async runLoop({ provider, messages, requirements = "", workspaceId, workerId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
+    async runLoop({ provider, childProvider = provider, messages, requirements = "", workspaceId, workerId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
         // A 202 park suspends this durable loop and a later wake re-enters runLoop.
         // Its ceiling therefore counts every prior turn, not merely this process-local
         // execution segment.
@@ -567,11 +719,11 @@ export default class Engine {
             return { turnIds, result, hitMaxTurns: false, reason: "loop_timeout" };
         };
         // Cleanup splits by termination kind:
-        // - "graceful" (SEND[202] Accepted): in-flight streaming-scheme spawns
+        // - "graceful" (SEND signal 202 Accepted): in-flight streaming-scheme spawns
         //   are ALLOWED to outlive the loop — they complete naturally, write final
         //   channel state, and wake-on-completion (E.4) opens a fresh loop. 202 is
         //   the only terminal that means "keep my async work."
-        // - "forceful" (SEND[200] done, max_turns, strike, cancel, budget, 4xx/5xx):
+        // - "forceful" (SEND signal 200 done, max_turns, strike, cancel, context-envelope rejection, 4xx/5xx):
         //   fire the loop-level abort so leftover spawns tear down. "Done" reaps.
         const cleanup = (kind, reason) => {
             clearTimeout(wall);
@@ -581,7 +733,6 @@ export default class Engine {
             this.#loopAborts.delete(loopId);
             this.#strikes.delete(loopId);
             this.searchGate.cleanup(loopId);
-            this.#hardOverflowRecovery.delete(loopId);
             this.#notices.delete(loopId);
         };
         while (true) {
@@ -649,7 +800,7 @@ export default class Engine {
                 turn = await observed(// {§observability-boundary}
                 "loop.turn", { workerId, "loop.id": loopId }, async (span) => {
                     const t = await this.runTurn({
-                        provider, messages, requirements, workspaceId, workerId, loopId, origin, signal, onDispatch,
+                        provider, childProvider, messages, requirements, workspaceId, workerId, loopId, origin, signal, onDispatch,
                         turnNumber: turnIds.length + 1, maxTurns,
                         invalidEmissionRecoveryEntryId,
                     });
@@ -698,25 +849,23 @@ export default class Engine {
                 return { turnIds, result, hitMaxTurns: false, reason: "invalid_emission" };
             }
             invalidEmissionRecoveryEntryId = null;
-            // SPEC {§grinder}: budget hard-stop — packet won't fit even collapsed → abandon.
+            // SPEC {§grinder}: the effective context envelope rejected the request.
             if (turn.budgetHardStop) {
-                if (turn.budget === undefined) {
-                    throw new Error("a budget hard-stop requires its measured overflow");
+                if (turn.budgetFailure === undefined) {
+                    throw new Error("a context-envelope hard-stop requires its exact failure");
                 }
-                const failure = BudgetOverflow.result(turn.budget.usage, turn.budget.ceiling, false);
-                const result = await this.#lifecycle.finish(loopId, failure);
+                const result = await this.#lifecycle.finish(loopId, turn.budgetFailure);
                 if (result === null)
                     throw new Error(`loop ${loopId} became terminal before budget settlement`);
-                cleanup("forceful", "budget_overflow");
-                return { turnIds, result, hitMaxTurns: false, reason: "budget_overflow" };
+                cleanup("forceful", "context_envelope");
+                return { turnIds, result, hitMaxTurns: false, reason: "context_envelope" };
             }
-            // {§engine-rails} — per-turn strike accounting (cycle detection, the
-            // grinder/steer coupling, hard operation outcomes). StrikeRail owns the
+            // {§engine-rails} — per-turn strike accounting (cycle detection,
+            // steer coupling, hard operation outcomes). StrikeRail owns the
             // bookkeeping; runLoop owns abandonment.
             const verdict = this.#strikes.assess(loopId, {
                 fingerprint: turn.fingerprint,
                 outcomes: turn.outcomes,
-                budgetStruck: turn.budgetStruck,
                 steerStruck: turn.steerStruck,
                 minCycles, maxCyclePeriod, maxStrikes,
             });
@@ -739,7 +888,7 @@ export default class Engine {
             }
         }
     }
-    async runTurn({ provider, messages, requirements = "", workspaceId, workerId, loopId, origin = "model", signal, onDispatch, turnNumber = 1, maxTurns = 50, invalidEmissionRecoveryEntryId, }) {
+    async runTurn({ provider, childProvider = provider, messages, requirements = "", workspaceId, workerId, loopId, origin = "model", signal, onDispatch, turnNumber = 1, maxTurns = 50, invalidEmissionRecoveryEntryId, }) {
         const allowInvalidEmissionRecovery = invalidEmissionRecoveryEntryId === null;
         const transientOpenLogEntryId = typeof invalidEmissionRecoveryEntryId === "number"
             ? invalidEmissionRecoveryEntryId
@@ -800,14 +949,14 @@ export default class Engine {
         // Model ops dispatch after these pre-model rows.
         let nextActionIndex = 1;
         const turnOpenPaths = [];
-        // {§model-entry} — the worker's first turn opens with the model's own turn-0, mirrored OPEN: a
-        // worked turn PLAN → the environment FINDs the foist ACTUALLY dispatches → SEND[102]. Built
+        // {§worker-initialization-entry} — the worker's first turn opens with a kernel-authored initialization: a
+        // worked turn PLAN → the environment FINDs the foist ACTUALLY dispatches → SEND signal 102. Built
         // from the real ops below (not a static print — we lean into the genuine echo paradigm) and
-        // written at sequence 1, so it reads first as the emission with the foisted results following.
+        // written at sequence 1, so it reads first with the foisted results following.
         const turnZeroMoves = [];
         if (seq === 1) {
             if (workerFirstLoop)
-                nextActionIndex = 2; // reserve sequence 1 for the turn-0 echo
+                nextActionIndex = 2; // reserve sequence 1 for initialization
             // Operator doc READs (PLURNK_SERVICE_MD_<ALIAS>, {§actor-boundary-doc-injection}). The docs were materialized
             // as worker://plurnk/<entry> entries by the plurnk worker (LoopDocs, via the
             // {§actor-boundary} keystone); foist a READ of each into THIS turn-0 so the model
@@ -840,7 +989,6 @@ export default class Engine {
                 const promptPath = promptTarget(promptLoopSeq, seq);
                 const entry = {
                     channels: { body: { content: promptRow.prompt, mimetype: "text/markdown" } },
-                    tags: [],
                     attributes: { openPaths },
                 };
                 await EntryCrud.writeEntry(promptPath.pathname, entry, systemCtx, "prompt", workerId);
@@ -921,97 +1069,71 @@ export default class Engine {
         // consume the filesystem divergences a second time.
         await this.#queueWorkspaceWarm(systemCtx, true, false);
         // Turn-0 catalog preview (PLURNK_SERVICE_FILES_ITEMS, {§actor-boundary-catalog-preview}):
-        // FIND surveys foisted into the worker's first model turn so it opens with its catalog.
-        // Folder-capable surfaces reveal one level with `*`; each deeper directory is an
-        // actionable `dir/**` aggregate. The curated kernel docs remain recursive, so the
-        // opening packet demonstrates both navigation forms. Empty results are orientation.
+        // Four FIND surveys foisted into the worker's first model turn establish the project,
+        // commons, private, and documentation surfaces in that order. Their `init`
+        // classification lets the model curate this opening survey as one log set.
         if (seq === 1) {
             // {§operator-config-workspace-files-items} — workspace filesItems replaces the env default.
             const { filesItems: workspaceMI } = await WorkspaceSettings.read(this.#db, workspaceId);
             const filesItems = workspaceMI !== null ? normalizeFilesItems(workspaceMI) : readFilesItems();
             if (filesItems !== null && workerFirstLoop) { // {§actor-boundary-catalog-preview} — once per worker
-                // engine_scheme_catalog_summary is the workspace-bounded scheme source: ordered,
-                // one row per stored entry scheme. log:// is absent —
-                // it lives in log_entries, not the catalog (present-mode, the # Log section).
                 const catalogSchemes = await this.#db.engine_scheme_catalog_summary.all({ workspace_id: workspaceId });
-                // Entry-bearing plugin schemes foist alongside the four structural surveys below.
-                const foistSchemes = catalogSchemes
-                    .filter((catalog) => catalog.scheme !== "prompt" && catalog.scheme !== "worker")
-                    .map(({ scheme, shallow_items }) => ({ scheme, shallow_items }));
-                // Commons + project files always foist. An empty result establishes that the
-                // surface exists and currently contains nothing.
-                foistSchemes.push({
-                    scheme: "worker",
-                    shallow_items: catalogSchemes.find((c) => c.scheme === "worker")?.shallow_items ?? 0,
-                });
-                if (!foistSchemes.some((c) => c.scheme === "file"))
-                    foistSchemes.push({ scheme: "file", shallow_items: 0 }); // Empty project surface still receives its orienting FIND.
-                for (const { scheme, shallow_items: shallowItems } of foistSchemes) {
-                    const isFile = scheme === "file";
-                    const pattern = this.#schemes.manifestFor(scheme)?.folderScopes === true ? "*" : "**";
-                    // Only the file map takes PLURNK_SERVICE_FILES_ITEMS as an explicit first-N
-                    // cap. Every other ordinary survey uses FIND's markerless first page.
-                    const cap = isFile && filesItems > 0 && shallowItems > 0 ? Math.min(filesItems, shallowItems) : null;
-                    const catalogMarker = cap === null ? null : { marks: [1, cap] };
-                    // The file survey foists as the BARE relative glob — the path shape plurnk.md
-                    // teaches (`*`, `src/**`, `**/notes.md`; bare = project-relative) — so the turn-0
-                    // exemplar and the log rows the model reads never train a leading-slash or
-                    // file:/// habit the rest of the teaching contradicts.
-                    const catalogFind = {
-                        op: "FIND", suffix: "", signal: null,
-                        target: isFile ? { kind: "local", raw: pattern } : {
-                            kind: "url",
-                            raw: `${scheme}:///${pattern}`,
-                            scheme,
-                            username: null, password: null, hostname: null, port: null,
-                            pathname: `/${pattern}`,
-                            query: null, fragment: null,
+                const fileItems = catalogSchemes.find(({ scheme }) => scheme === "file")?.shallow_items ?? 0;
+                const fileCap = filesItems > 0 && fileItems > 0 ? Math.min(filesItems, fileItems) : null;
+                await Owner.kernelId(this.#db, workspaceId);
+                const surveys = [
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init"],
+                            target: { kind: "local", raw: "*" },
+                            body: null,
+                            lineMarker: fileCap === null ? null : { marks: [1, fileCap] },
+                            position: UNKNOWN_POSITION,
                         },
-                        body: null,
-                        lineMarker: catalogMarker,
-                        position: UNKNOWN_POSITION,
-                    };
-                    await this.dispatch({
-                        statement: catalogFind, workspaceId, workerId, loopId, turnId,
-                        sequence: nextActionIndex, origin: "plurnk", onDispatch,
-                    });
+                        exemplar: `## FIND0 [+init] (*)${fileCap === null ? "" : ` <1,${fileCap}>`}`,
+                    },
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init"],
+                            target: { kind: "url", raw: "worker:///*", scheme: "worker", username: null, password: null, hostname: null, port: null, pathname: "/*", query: null, fragment: null },
+                            body: null, lineMarker: null, position: UNKNOWN_POSITION,
+                        },
+                        exemplar: "## FIND0 [+init] (worker:///*)",
+                    },
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init"],
+                            target: { kind: "url", raw: "worker://~/*", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: "/*", query: null, fragment: null },
+                            body: null, lineMarker: null, position: UNKNOWN_POSITION,
+                        },
+                        exemplar: "## FIND0 [+init] (worker://~/*)",
+                    },
+                    {
+                        statement: {
+                            op: "FIND", suffix: "", signal: ["+init", "+docs"],
+                            target: { kind: "url", raw: "worker://plurnk/docs/**", scheme: "worker", username: null, password: null, hostname: "plurnk", port: null, pathname: "/docs/**", query: null, fragment: null },
+                            body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
+                        },
+                        exemplar: "## FIND0 [+init,+docs] (worker://plurnk/docs/**) <1,-1>",
+                    },
+                ];
+                for (const { statement, exemplar } of surveys) {
+                    await this.dispatch({ statement, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
                     nextActionIndex++;
-                    // {§model-entry} — the same FIND, rendered back to DSL for the turn-0 echo
-                    // (the model's own survey, mirrored OPEN). An explicit file cap rides as
-                    // `<1,N>`; ordinary surveys teach the safe markerless default by example.
-                    const target = isFile ? pattern : `${scheme}:///${pattern}`;
-                    turnZeroMoves.push(`<<FIND(${target})${cap === null ? "" : `<1,${cap}>`}::FIND`);
+                    turnZeroMoves.push(exemplar);
                 }
-                // The kernel's self-documenting surface — FIND(worker://plurnk/docs/**), uncapped,
-                // always ({§schemes-directory}, published under {§entry-owner}).
-                await Owner.kernelId(this.#db, workspaceId); // the row exists even before docs materialize — the empty survey is orienting, never 404
-                const kernelDocsFind = {
-                    op: "FIND", suffix: "", signal: null,
-                    target: { kind: "url", raw: "worker://plurnk/docs/**", scheme: "worker", username: null, password: null, hostname: "plurnk", port: null, pathname: "/docs/**", query: null, fragment: null },
-                    body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
-                };
-                await this.dispatch({ statement: kernelDocsFind, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
-                nextActionIndex++;
-                turnZeroMoves.push("<<FIND(worker://plurnk/docs/**)<1,-1>::FIND");
-                // {§worker-scheme} — the building worker's own scratch gets the same markerless
-                // one-level survey in its perspective alone. It always executes: an empty private
-                // space is useful orientation, not grounds to hide the surface.
-                const ownFind = {
-                    op: "FIND", suffix: "", signal: null,
-                    target: { kind: "url", raw: "worker://~/*", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: "/*", query: null, fragment: null },
-                    body: null, lineMarker: null, position: UNKNOWN_POSITION,
-                };
-                await this.dispatch({ statement: ownFind, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
-                nextActionIndex++;
-                turnZeroMoves.push("<<FIND(worker://~/*)::FIND"); // {§model-entry} — the own-space survey, into the turn-0 echo
             }
-            // {§model-entry} — mirror the model's turn-0 OPEN at sequence 1: PLAN → the FINDs actually
-            // foisted above (real, their results already in the log) → SEND[102]. Dynamic — it reflects
+            // {§worker-initialization-entry} — write the kernel's turn-0 initialization OPEN at sequence 1: PLAN → the FINDs actually
+            // foisted above (real, their results already in the log) → SEND signal 102. Dynamic — it reflects
             // the true survey, never a frozen print — and OPEN: the worked example the model orients on,
-            // so the grammar can stay thin. Subsequent turns mirror the model's real output, folded.
+            // so the grammar can stay thin.
             if (workerFirstLoop) {
-                const emission = ["<<PLAN:Survey context, then address the prompt.:PLAN", ...turnZeroMoves, "<<SEND[102]:Next, address the prompt using the survey.:SEND"].join("\n");
-                await this.#dispatcher.writeModelEntry({ verbatim: emission, workerId, loopId, turnId, sequence: 1, folded: false, origin: "plurnk" });
+                const initialization = [
+                    "# PLAN0\n* Initialization complete.\n* Next: address the prompt.",
+                    ...turnZeroMoves,
+                    "## SEND0 [102]\nNext, address the prompt.",
+                ].join("\n\n");
+                await this.#dispatcher.writeInitializationEntry({ verbatim: initialization, workerId, loopId, turnId, sequence: 1 });
             }
         }
         // {§methods-loop-run-open-paths}: selected workspace paths belong to
@@ -1058,83 +1180,50 @@ export default class Engine {
         });
         // SPEC {§grinder} — budget grinder, pre-LLM: reclaim window on actual overflow.
         const enforced = await this.#packets.enforceBudget({
-            packet: requestPacket, provider, workerId, loopId, turnId,
-            // The overflow error row is minted at the turn's running sequence (nextActionIndex), pre-generate;
-            // runTurn advances the counter past it below so the post-generate dispatch rows never collide.
-            mintSequence: nextActionIndex,
-            // Rebuilds re-derive durable errors and retain the one drained notice
-            // set; neither path can duplicate or swallow a product failure.
+            packet: requestPacket, provider, loopId, turnId,
+            recordOverflow: async (pressure) => {
+                await this.#problems.record({
+                    workerId,
+                    loopId,
+                    turnId,
+                    sequence: nextActionIndex++,
+                    origin: "plurnk",
+                    source: "engine",
+                    result: tokenBudgetOverflowFailure(pressure),
+                });
+            },
             rebuild: () => this.#packets.buildRequestPacket({
                 initialMessages: messages, requirements, workspaceId, workerId, loopId,
                 currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
             }),
         });
-        if (enforced.recorded)
-            nextActionIndex += 1; // a fold-to-fit Problem consumed the reserved sequence
         requestPacket = enforced.packet;
         if (!enforced.fit) {
-            // {§grinder-hard-413-recovery}/{§grinder-hard-413-abort} — admit
-            // one physically sendable informed recovery turn; a physical
-            // overflow or consecutive policy overflow terminates immediately.
-            let physicalAdmission = await this.#packets.physicalAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
-            let recoveryAdmitted = false;
-            if (physicalAdmission.admitted && !this.#hardOverflowRecovery.has(loopId)) {
+            // {§tokenomics-context-envelope-admission}: the overflow Problem is
+            // already durable. Remaining ruler debt may still be admitted; only
+            // the effective total context envelope can terminally reject the turn.
+            const contextAdmission = await this.#packets.contextEnvelopeAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
+            if (!contextAdmission.admitted) {
                 const ceiling = this.#packets.ceilingFor(provider);
                 if (ceiling === null) {
-                    throw new Error("an unbounded prompt budget cannot enter budget recovery");
+                    throw new Error("an unbounded prompt budget cannot enter context-envelope admission");
                 }
+                const failure = contextEnvelopeFailure(budgetPressure(requestPacket.tokens, ceiling), contextAdmission);
                 await this.#problems.record({
                     workerId,
                     loopId,
                     turnId,
                     sequence: nextActionIndex++,
-                    origin: "model",
+                    origin: "plurnk",
                     source: "engine",
-                    result: BudgetOverflow.result(requestPacket.tokens, ceiling, true),
+                    result: failure,
                 });
-                // Rebuild so the recovery-steer row just minted renders in THIS packet's log +
-                // errors sections (the same re-derive contract the soft grind uses).
+                // Preserve the exact terminal evidence in the stored request. It is
+                // never sent because admission has already failed.
                 requestPacket = await this.#packets.buildRequestPacket({
                     initialMessages: messages, requirements, workspaceId, workerId, loopId,
                     currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
                 });
-                physicalAdmission = await this.#packets.physicalAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
-                if (physicalAdmission.admitted) {
-                    this.#hardOverflowRecovery.add(loopId);
-                    recoveryAdmitted = true;
-                }
-            }
-            if (!recoveryAdmitted) {
-                // Hard 413: physically unsendable, or still over after the informed recovery turn.
-                const ceiling = this.#packets.ceilingFor(provider);
-                if (ceiling === null) {
-                    throw new Error("an unbounded prompt budget cannot hard-stop");
-                }
-                if (!enforced.recorded || !physicalAdmission.admitted) {
-                    await this.#problems.record({
-                        workerId,
-                        loopId,
-                        turnId,
-                        sequence: nextActionIndex++,
-                        origin: "plurnk",
-                        source: "engine",
-                        result: BudgetOverflow.result(requestPacket.tokens, ceiling, false, physicalAdmission.admitted
-                            ? undefined
-                            : {
-                                reason: physicalAdmission.reason,
-                                detail: physicalAdmission.detail,
-                                capacity: physicalAdmission.capacity,
-                                tokens: physicalAdmission.measurement?.tokens,
-                                tokenKind: physicalAdmission.measurement?.kind,
-                                tokenSource: physicalAdmission.measurement?.source,
-                            }),
-                    });
-                    requestPacket = await this.#packets.buildRequestPacket({
-                        initialMessages: messages, requirements, workspaceId, workerId, loopId,
-                        currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
-                    });
-                }
-                // Skip the LLM, close the turn, and let runLoop abandon.
                 await this.#db.engine_close_turn.run({
                     id: turnId, status: 413, packet: StoredPacket.stringify(requestPacket),
                     // The attempted turn retains its effective allowance even
@@ -1147,20 +1236,14 @@ export default class Engine {
                     status: 413,
                     outcomes: [],
                     fingerprint: "",
-                    budgetStruck: enforced.struck,
                     budgetHardStop: true,
                     steerStruck: false,
                     emissionAttempts: 0,
                     emissionExhausted: false,
-                    budget: BudgetOverflow.measure(requestPacket.tokens, ceiling),
+                    budgetFailure: failure,
                 };
             }
         }
-        else {
-            // A fitting turn clears the recovery grant; a later independent overflow can earn
-            // a fresh recovery turn (chronic overflow still strikes out via the rail).
-            this.#hardOverflowRecovery.delete(loopId);
-        }
         const modelMessages = PacketWire.packetToWireMessages(requestPacket);
         // Packet pressure and provider generation are independent. The grinder governs
         // only the request packet; maxTokens comes only from the provider envelope and
@@ -1168,53 +1251,38 @@ export default class Engine {
         let response;
         let splitResponse;
         let railGrammar;
+        let railResponseGrammar;
         let railEvidence;
         let emissionAttempts = 0;
         let providerCallInFlight = false;
         let providerAttemptSequence = 0;
         let providerAttemptId = null;
+        let providerModelCall = null;
         let providerAttemptAttributions = [];
         const providerSignal = this.#loopAborts.get(loopId)?.signal ?? signal;
         // {§client-metadata}
         const { client } = await WorkspaceSettings.read(this.#db, workspaceId);
-        const observeProviderAttempt = async (id, attemptResponse) => {
-            const attemptUsage = attemptResponse.assistant.usage;
-            await this.#db.engine_observe_turn_attempt_response.run({
-                id,
-                response: JSON.stringify(attemptResponse),
-                usage_prompt: attemptUsage.prompt,
-                usage_completion: attemptUsage.completion,
-                usage_reasoning: attemptUsage.reasoning,
-                usage_cached: attemptUsage.cached,
-                usage_cost: JSON.stringify({
-                    kind: "unknown",
-                    reason: "provider response retained before monetary classification",
-                }),
-                finish_reason: attemptResponse.assistant.finishReason,
-                model: attemptResponse.assistant.model,
-            });
-        };
-        const classifyProviderAttempt = async (id, attemptResponse, attemptSplit, sequence, accepted, failure = null) => {
-            const attemptUsage = attemptSplit.callMetadata.usage;
-            const attemptCost = providerCostFor(provider, attemptUsage, attemptResponse.charge);
-            const attemptCostUsd = providerCostUsd(attemptCost);
-            await this.#db.engine_classify_turn_attempt_response.run({
+        const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
+        const providerIdentity = await this.resolveWorkerProviderIdentity(workerId);
+        const { workerId: providerWorkerId, primaryWorkerId } = providerIdentity;
+        const classifyProviderAttempt = async (id, attemptSplit, sequence, accepted) => {
+            const result = await this.#db.engine_classify_turn_attempt_response.run({
                 id,
                 accepted: accepted ? 1 : 0,
                 parse_errors: JSON.stringify(attemptSplit.parseErrors),
-                failure: failure === null ? null : JSON.stringify(failure),
-                usage_cost: JSON.stringify(attemptCost),
-                usage_cost_usd: attemptCostUsd,
             });
+            if (result.changes !== 1) {
+                throw new Error(`emission attempt ${id} was not awaiting classification`);
+            }
             emissionAttempts = sequence;
         };
         try {
             // {§turn-lifecycle}: bracket the complete provider-attempt window with liveness notices.
             if (!signal?.aborted)
                 this.#notices.push(workspaceId, loopId, { source: "engine:turn", kind: "turn_awaiting_model", level: "info", message: "awaiting model response" });
-            const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
-            railGrammar = await this.#grammarConstraint(provider);
-            const primaryWorkerId = String(await this.resolveWorkerPrimary(workerId));
+            const railConstraint = await this.#grammarConstraint(provider);
+            railGrammar = railConstraint?.transport;
+            railResponseGrammar = railConstraint?.response;
             const attemptLimit = readEmissionAttempts();
             const maxTokens = this.#packets.maxTokensFor(provider) ?? undefined;
             const strikeStreak = this.#strikes.streak(loopId);
@@ -1226,7 +1294,7 @@ export default class Engine {
                 providerAttemptSequence = attempt;
                 const attributionContext = Object.freeze({
                     workspaceId: String(workspaceId),
-                    workerId: String(workerId),
+                    workerId: providerWorkerId,
                     primaryWorkerId,
                     loop: loopSeq,
                     turn: seq,
@@ -1234,51 +1302,67 @@ export default class Engine {
                 });
                 providerAttemptAttributions = await this.#attemptAttributions(provider, attributionContext);
                 requestPacket = { ...requestPacket, attributions: providerAttemptAttributions };
-                const attemptRow = await this.#db.engine_open_turn_attempt.get({
-                    turn_id: turnId,
+                providerModelCall = await ModelCall.open(this.#db, {
+                    turnId,
                     sequence: attempt,
-                    attributions: JSON.stringify(providerAttemptAttributions),
+                    kind: "emission",
+                    attributions: providerAttemptAttributions,
                     model: provider.model,
                 });
+                const attemptRow = await this.#db.engine_open_turn_attempt.get({
+                    model_call_id: providerModelCall.id,
+                });
                 if (attemptRow === undefined) {
                     throw new Error(`Engine.runTurn: provider attempt ${attempt} did not open`);
                 }
                 providerAttemptId = attemptRow.id;
                 providerCallInFlight = true;
+                const currentModelCall = providerModelCall;
                 const completedResponse = await observed(// {§observability-boundary}
                 "provider.generate", { model: provider.model, attempt }, async (span) => {
-                    const generated = await provider.generate({
-                        messages: modelMessages,
-                        workerId: String(workerId),
-                        primaryWorkerId,
-                        signal: providerSignal,
-                        grammar: railGrammar,
-                        maxTokens,
-                        strikes: strikeStreak,
-                        attributions: providerAttemptAttributions.length > 0
-                            ? providerAttemptAttributions
-                            : undefined,
-                        client: client ?? undefined,
-                        workspaceId: String(workspaceId),
-                        loop: loopSeq,
-                        turn: seq,
-                    }); // {§provider-surface-generate} {§provider-guarantees-signal-wired} {§provider-guarantees-serial-attempts} {§attribution} {§client-metadata}
-                    providerCallInFlight = false;
-                    recordCounter(PROVIDER_CALLS, {
-                        model: provider.model,
-                        attempt,
-                        status: "resolved",
-                    });
-                    span.setAttribute("status", "resolved");
-                    return generated;
+                    try {
+                        const generated = await provider.generate({
+                            messages: modelMessages,
+                            workerId: providerWorkerId,
+                            primaryWorkerId,
+                            signal: providerSignal,
+                            grammar: railGrammar,
+                            maxTokens,
+                            strikes: strikeStreak,
+                            attributions: providerAttemptAttributions.length > 0
+                                ? providerAttemptAttributions
+                                : undefined,
+                            client: client ?? undefined,
+                            workspaceId: String(workspaceId),
+                            loop: loopSeq,
+                            turn: seq,
+                            observeRequest: currentModelCall.observeRequest,
+                            callKind: "emission",
+                        }); // {§provider-surface-generate} {§provider-guarantees-signal-wired} {§provider-guarantees-serial-attempts} {§attribution} {§client-metadata}
+                        currentModelCall.assertAccounting(generated.accounting);
+                        providerCallInFlight = false;
+                        recordCounter(PROVIDER_CALLS, {
+                            model: provider.model,
+                            attempt,
+                            status: "resolved",
+                        });
+                        span.setAttribute("status", "resolved");
+                        return generated;
+                    }
+                    catch (error) {
+                        if (error instanceof ProviderError) {
+                            currentModelCall.assertAccounting(error.accounting);
+                        }
+                        throw error;
+                    }
                 });
                 response = completedResponse;
-                await observeProviderAttempt(attemptRow.id, completedResponse);
+                await currentModelCall.observeResponse(completedResponse);
                 railEvidence = railGrammar === undefined
                     ? undefined
-                    : Engine.#requireGrammarEvidence(completedResponse);
+                    : _a.#requireGrammarEvidence(completedResponse);
                 splitResponse = this.#splitResponse(completedResponse);
-                await classifyProviderAttempt(attemptRow.id, completedResponse, splitResponse, attempt, splitResponse.emissionValid);
+                await classifyProviderAttempt(attemptRow.id, splitResponse, attempt, splitResponse.emissionValid);
                 if (splitResponse.emissionValid)
                     break;
             }
@@ -1288,44 +1372,26 @@ export default class Engine {
         catch (err) {
             // This handler owns only provider-call failures. Parser, cost, SQL,
             // and engine-contract failures retain their original source.
+            if (err instanceof ModelCallPersistenceError || err instanceof ProviderAccountingIntegrityError)
+                throw err;
             if (!providerCallInFlight)
                 throw err;
             providerCallInFlight = false;
-            if (providerAttemptId === null) {
-                throw new Error("provider call failed without a durable attempt identity", { cause: err });
+            if (providerAttemptId === null || providerModelCall === null) {
+                throw new Error("provider call failed without durable model-call and attempt identities", { cause: err });
             }
-            const failure = err instanceof ProviderError
-                ? { status: err.problem.status, problem: err.problem }
-                : providerSignal?.aborted === true
-                    ? Results.failure("engine:provider", providerSignal.reason === LOOP_TIMEOUT_REASON ? "provider-call-timeout" : "provider-call-cancelled", providerSignal.reason === LOOP_TIMEOUT_REASON ? 504 : 499, providerSignal.reason === LOOP_TIMEOUT_REASON
-                        ? "The provider call was interrupted by the loop deadline."
-                        : "The provider call was interrupted by loop cancellation.", {}, { stage: "provider-request", retryable: false })
-                    : (() => {
-                        console.error("Provider failed outside its Problem Details contract:", err);
-                        return Results.failure("engine:provider", "provider-contract-violation", 502, "The provider failed without returning its required Problem Details.", {}, {
-                            stage: "provider-request",
-                            retryable: false,
-                        });
-                    })();
+            const failure = _a.#providerFailure(err, providerSignal);
             // {§provider-interrupted-attempt} — a provider-declared interruption
             // carries response evidence without becoming a completed exchange.
             // Persist it as an unaccepted attempt before settling the failure.
             if (err instanceof ProviderError && err.attempt !== undefined) {
                 response = err.attempt;
-                await observeProviderAttempt(providerAttemptId, response);
+                await providerModelCall.observeResponse(response, failure);
                 splitResponse = this.#splitResponse(response);
-                await classifyProviderAttempt(providerAttemptId, response, splitResponse, providerAttemptSequence, false, failure);
+                await classifyProviderAttempt(providerAttemptId, splitResponse, providerAttemptSequence, false);
             }
             else {
-                const unknownCost = {
-                    kind: "unknown",
-                    reason: "provider call failed without response-bearing charge evidence",
-                };
-                await this.#db.engine_fail_turn_attempt.run({
-                    id: providerAttemptId,
-                    failure: JSON.stringify(failure),
-                    usage_cost: JSON.stringify(unknownCost),
-                });
+                await providerModelCall.fail(failure);
                 emissionAttempts = providerAttemptSequence;
             }
             // {§turn-never-blank} — a ProviderError means no completed exchange exists.
@@ -1370,9 +1436,10 @@ export default class Engine {
             });
             throw new OperationFailureError(recorded.result, { cause: err });
         }
-        if (response === undefined || splitResponse === undefined) {
+        if (response === undefined || splitResponse === undefined || providerModelCall === null) {
             throw new Error("provider attempt loop completed without a response");
         }
+        const emissionModelCallId = providerModelCall.id;
         if (!splitResponse.emissionValid) {
             // {§invalid-emission-attempts} The first consecutive exhaustion
             // publishes only the raw final response and generic recovery fact.
@@ -1385,6 +1452,7 @@ export default class Engine {
                     turnId,
                     sequence: nextActionIndex,
                     folded: true,
+                    modelCallId: emissionModelCallId,
                     admission: "rejected",
                 });
                 this.#notices.push(workspaceId, loopId, {
@@ -1408,7 +1476,6 @@ export default class Engine {
                 status: allowInvalidEmissionRecovery ? TURN_STATUS_IMPLICIT_CONTINUE : 500,
                 outcomes: [],
                 fingerprint: "",
-                budgetStruck: enforced.struck,
                 budgetHardStop: false,
                 steerStruck: false,
                 emissionAttempts,
@@ -1446,12 +1513,14 @@ export default class Engine {
         if (railGrammar !== undefined) {
             if (railEvidence === undefined)
                 throw new Error("configured GBNF response has no final grammar evidence");
+            if (railResponseGrammar === undefined)
+                throw new Error("configured GBNF has no response grammar");
             let verdict = null;
             try {
-                verdict = validateGbnf(railGrammar, railEvidence.input);
+                verdict = validateGbnf(railResponseGrammar, railEvidence.input);
             }
             catch (cause) {
-                Engine.#warnRailVerdictGapOnce(cause.message);
+                _a.#warnRailVerdictGapOnce(cause.message);
             }
             railKeys = {
                 railsAttached: railEvidence.transported ? "client" : "withheld",
@@ -1551,6 +1620,8 @@ export default class Engine {
             origin, onDispatch,
         });
         const droppedCount = opsCount - opsToDispatch.length;
+        const bareStatements = opsToDispatch.filter((statement) => statement.op === "BARE");
+        let bareResults = null;
         const outcomes = [];
         // Running counter — a multi-file READ writes N rows from one statement (rowsWritten),
         // so the next op's sequence picks up after them. Collapses to nextActionIndex+i when
@@ -1596,11 +1667,45 @@ export default class Engine {
             }
             const result = await observed(// {§observability-boundary}
             "op.dispatch", { op: statement.op }, async (span) => {
-                const dispatchResult = await this.#dispatcher.dispatch({
-                    statement, workspaceId, workerId, loopId, turnId,
-                    sequence: rowSeq,
-                    origin, onDispatch,
-                });
+                let dispatchResult;
+                if (statement.op === "BARE") {
+                    if (bareResults === null) {
+                        const batch = await this.#runBareBatch({
+                            statements: bareStatements,
+                            provider: childProvider,
+                            turnId,
+                            modelCallSequenceStart: providerAttemptSequence + 1,
+                            workspaceId,
+                            workerId,
+                            primaryWorkerId,
+                            loopSequence: loopSeq,
+                            turnSequence: seq,
+                            signal: providerSignal,
+                        });
+                        bareResults = new Map(batch.map((item) => [item.statement, item]));
+                    }
+                    const bare = bareResults.get(statement);
+                    if (bare === undefined) {
+                        throw new Error("BARE statement reached dispatch without its batch result");
+                    }
+                    dispatchResult = await this.#dispatcher.recordBareResult({
+                        statement,
+                        workspaceId,
+                        workerId,
+                        loopId,
+                        turnId,
+                        sequence: rowSeq,
+                        origin,
+                        onDispatch,
+                    }, bare.result, bare.modelCallId);
+                }
+                else {
+                    dispatchResult = await this.#dispatcher.dispatch({
+                        statement, workspaceId, workerId, loopId, turnId,
+                        sequence: rowSeq,
+                        origin, onDispatch,
+                    });
+                }
                 span.setAttribute("status", dispatchResult.status);
                 recordCounter(OPS_DISPATCHED, { op: statement.op, status: dispatchResult.status });
                 return dispatchResult;
@@ -1661,7 +1766,7 @@ export default class Engine {
                 }
                 : {
                     stage: "turn",
-                    recovery: "Perform an operation before continuing with SEND[102].",
+                    recovery: "Perform an operation before continuing with `## SEND0 [102]`.",
                     retryable: false,
                 };
             await this.#problems.record({
@@ -1687,14 +1792,22 @@ export default class Engine {
             ? response.assistant.reasoningEncrypted
             : undefined;
         if (packetAssistant.content.trim().length > 0 || reasoningItems !== undefined) {
-            await this.#dispatcher.writeModelEntry({ verbatim: packetAssistant.content, workerId, loopId, turnId, sequence: errSeq++, folded: true, ...(reasoningItems !== undefined ? { reasoningItems } : {}) });
+            await this.#dispatcher.writeModelEntry({
+                verbatim: packetAssistant.content,
+                workerId,
+                loopId,
+                turnId,
+                sequence: errSeq++,
+                folded: true,
+                modelCallId: emissionModelCallId,
+                ...(reasoningItems !== undefined ? { reasoningItems } : {}),
+            });
         }
         return {
             turnId,
             status: turnStatus,
             outcomes,
             fingerprint: StrikeRail.fingerprintTurn(packetAssistant.ops),
-            budgetStruck: enforced.struck,
             budgetHardStop: false,
             steerStruck,
             emissionAttempts,
@@ -1703,7 +1816,8 @@ export default class Engine {
     }
     // Split the wire-level ProviderResponse into the two destinations:
     // packet.assistant gets the model's emission (content, ops, reasoning);
-    // Turn columns get the call-metadata (usage, finishReason, model).
+    // Turn columns get accepted-call metadata (finishReason, model). Physical
+    // request usage and cost have their own cardinal persistence path.
     // {§provider-surface} Text-fragment scraping policy lives
     // here — engine owns the parse and the scraping rule, providers stay
     // grammar-unaware.
@@ -1793,7 +1907,7 @@ export default class Engine {
         const reasoning = assistant.reasoning ?? null;
         return {
             packetAssistant: { content: assistant.content, ops, reasoning },
-            callMetadata: { usage: assistant.usage, finishReason: assistant.finishReason, model: assistant.model },
+            callMetadata: { finishReason: assistant.finishReason, model: assistant.model },
             parseErrors,
             recoverableParseErrors: emissionValid ? recoverableParseErrors : [],
             parseNotices,
@@ -1834,6 +1948,14 @@ export default class Engine {
                 throw new Error(`ambient loop-termination event ${r.event_id} status ${r.status_rx} does not match its terminal result status ${terminal.status}`);
             }
             let attrs = r.attrs ?? "{}";
+            const parsedTags = JSON.parse(r.tags ?? "[]");
+            if (!Array.isArray(parsedTags) || !parsedTags.every((tag) => typeof tag === "string" && tag.length > 0)) {
+                throw new TypeError(`ambient event ${r.event_id} tags must be an array of nonempty strings`);
+            }
+            const tags = [...new Set(parsedTags)].toSorted();
+            if (tags.length !== parsedTags.length || tags.some((tag, index) => tag !== parsedTags[index])) {
+                throw new TypeError(`ambient event ${r.event_id} tags must be unique and sorted`);
+            }
             if (terminal !== null) {
                 const inherited = JSON.parse(attrs);
                 if (inherited === null || typeof inherited !== "object" || Array.isArray(inherited)) {
@@ -1861,6 +1983,15 @@ export default class Engine {
                 expanded: terminal !== null && terminal.status >= 200 && terminal.status < 300 ? 1 : 0,
                 attrs,
             });
+            const materialized = inserted ?? await this.#db.engine_ambient_delta_id.get({
+                worker_id: workerId,
+                event_id: r.event_id,
+            });
+            if (materialized === undefined)
+                throw new Error(`ambient event ${r.event_id} has no observer log row after materialization`);
+            for (const tag of tags) {
+                await this.#db.log_write_tag.run({ log_entry_id: materialized.id, tag });
+            }
             if (inserted !== undefined)
                 written++;
         }
@@ -2010,7 +2141,8 @@ export default class Engine {
             const span = editedSpan(d.before, d.after);
             await this.#db.engine_insert_log_entry.get({
                 worker_id: worker.id, loop_id: loop.id, turn_id: turn.id, sequence: sequence++,
-                origin: "plurnk", source: "file", op: "EDIT", suffix: "", signal: null,
+                origin: "plurnk", source: "file", model_call_id: null,
+                op: "EDIT", suffix: "", signal: null,
                 // Match Dispatcher.#extractTarget: a bare file address has NULL scheme
                 // only in log target metadata; its entry identity remains `file`.
                 scheme: null, username: null, password: null, hostname: null, port: null,
@@ -2051,6 +2183,7 @@ export default class Engine {
             sequence,
             origin: "plurnk",
             source: null,
+            model_call_id: null,
             op: "prompt",
             suffix: "",
             signal: null,
@@ -2177,11 +2310,12 @@ export default class Engine {
         };
         const entry = {
             channels: { body: { content: prompt, mimetype: "text/markdown" } },
-            tags: [],
             attributes: { openPaths },
         };
         await EntryCrud.writeEntry(pathname, entry, ctx, "prompt", workerId);
         return { loopId, turnSeq };
     }
 }
+_a = Engine;
+export default Engine;
 //# sourceMappingURL=Engine.js.map