@plurnk/plurnk-service 1.5.0 → 1.6.1

package/dist/core/PacketBuilder.js

@@ -1,6 +1,6 @@
 var _a;
 import { renderAddress, promptLoopPrefix } from "./plurnk-uri.js";
-import { rulerCount } from "./token-ruler.js";
+import { contentWeight } from "./content-weight.js";
 import { docsExcludeSet } from "./teaching.js";
 import { Policy } from "@plurnk/plurnk-execs";
 import WorkspaceSettings from "./workspace-settings.js";
@@ -13,10 +13,12 @@ import { readTeachingSource } from "./teaching-corpus.js";
 // projection and digest projection are structurally one function — no
 // drift between wire and digest possible.
 import PacketWire from "./packet-wire.js";
-import { assertPromptTokenMeasurement, scopeEnvToAlias, resolveActiveAlias } from "@plurnk/plurnk-providers";
+import LogEntryProjection from "./LogEntryProjection.js";
+import { scopeEnvToAlias, resolveActiveAlias } from "@plurnk/plurnk-providers";
 import ProviderInstantiate from "./ProviderInstantiate.js";
-import BudgetOverflow from "./BudgetOverflow.js";
 import BudgetReadout from "./BudgetReadout.js";
+import ExecutableTools from "./ExecutableTools.js";
+import LineAnchors from "../content/line-anchors.js";
 const trimHorizontal = (value) => value.replace(/^[\t ]+|[\t ]+$/gu, "");
 const tableCells = (line) => {
     if (!line.startsWith("|") || !line.endsWith("|"))
@@ -86,128 +88,75 @@ const compactDefinitionTables = (markdown) => {
         return `| ${cells.map(trimHorizontal).join(" | ")} |${carriageReturn}`;
     }).join("\n");
 };
-// {§tokenomics-window-partition} — the four partition numbers. REQUIRED (fail-hard, the
-// providers-env convention): the ceiling is DERIVED from these, never set directly
-// (PLURNK_BUDGET_CEILING is retired — a settable ceiling let policy contradict physics).
-const readPartitionIntFrom = (env, name, min) => {
+// {§tokenomics-prompt-projection-share} — the required alias-scoped share of
+// provider-derived input capacity used only for automatic prompt projection.
+const readRequiredPercentFrom = (env, name) => {
     const raw = env[name];
-    const n = Number.parseInt(raw ?? "", 10);
-    if (!Number.isFinite(n) || n < min)
-        throw new Error(`${name} must be an integer >= ${min}; got ${raw}`);
-    return n;
-};
-const readOptionalPositiveIntFrom = (env, name) => {
-    const raw = env[name];
-    if (raw === undefined || raw.length === 0)
-        return null;
-    const n = Number(raw);
-    if (!Number.isInteger(n) || n <= 0)
-        throw new Error(`${name} must be a positive integer; got ${raw}`);
-    return n;
+    const match = /^([0-9]+(?:\.[0-9]+)?)%$/.exec(raw ?? "");
+    const percent = Number(match?.[1]);
+    if (!Number.isFinite(percent) || percent <= 0 || percent >= 100) {
+        throw new Error(`${name} must be a percentage in (0, 100); got ${JSON.stringify(raw)}`);
+    }
+    return percent / 100;
 };
 // Packet assembly (SPEC {§packet-assembly}) + the budget grinder ({§grinder}):
 // builds the spec'd request packet, measures it, and reclaims window on overflow.
 class PacketBuilder {
     #db;
     #schemes;
-    #problems;
     // Boot-discovered runtime executors, late-injected on Engine after daemon
     // start() — read through a thunk so the post-construction set is visible.
     #executors;
-    // {§tokenomics-window-partition} — the partition is PER-ALIAS, resolved per provider in
-    // #partitionFor and cached by alias; no boot-time global read.
-    constructor({ db, schemes, problems, executors }) {
+    // {§tokenomics-prompt-projection-share} — prompt projection is alias-scoped
+    // through the same environment contract as provider configuration.
+    constructor({ db, schemes, executors }) {
         this.#db = db;
         this.#schemes = schemes;
-        this.#problems = problems;
         this.#executors = executors;
-        // {§tokenomics-window-partition} — the envelope rides the provider; construction only runs the retired-knob shed
-        // so a stale operator .env fails at BOOT, not first use.
+        // Retired capacity knobs fail at boot rather than silently becoming inert.
         const bootAlias = resolveActiveAlias(process.env)?.alias ?? "";
-        this.#safetyFor(bootAlias);
-        this.#promptBudgetCapFor(bootAlias);
+        this.#shedRetiredCapacityKnobs();
+        this.#promptProjectionFor(bootAlias);
     }
-    // {§tokenomics-window-partition} — provider generation settings and core packet policy both resolve per alias.
-    // scopeEnvToAlias resolves PLURNK_SERVICE_*_<alias> over the bare fallback with providers' own
-    // battle-tested suffix parser. Cached per alias; the boot-global case falls back to the active
-    // alias when a provider carries no side-table entry (a test Mock).
-    // Provider context and response reserves remain provider-owned. Core owns only its virtual
-    // prompt budget and the ruler's packing-safety margin.
-    static #KNOBS = ["PLURNK_SERVICE_PROMPT_BUDGET", "PLURNK_SERVICE_SAFETY"];
-    #shedChecked = false;
-    #safetyFor(alias) {
-        // {§tokenomics-window-partition} hard shed: the three misprefixed partition knobs moved to the
-        // provider tier; a stale operator .env must never silently lose its envelope to the move.
-        if (!this.#shedChecked) {
-            this.#shedChecked = true;
-            const MOVED = {
-                CTX: "PLURNK_PROVIDERS_CONTEXT_WINDOW", CONTEXT_WINDOW: "PLURNK_PROVIDERS_CONTEXT_WINDOW",
-                REASONING: "PLURNK_PROVIDERS_REASONING_RESERVE",
-                ASSISTANT: "PLURNK_PROVIDERS_COMPLETION_RESERVE", COMPLETION: "PLURNK_PROVIDERS_COMPLETION_RESERVE",
-            };
-            for (const k of Object.keys(process.env)) {
-                const m = /^PLURNK_SERVICE_(CTX|CONTEXT_WINDOW|REASONING|ASSISTANT|COMPLETION)(_.*)?$/.exec(k);
-                if (m !== null)
-                    throw new Error(`${k} is retired: the envelope is provider-owned — the knob is ${MOVED[m[1]]}${m[2] ?? ""}.`);
-            }
+    // Prompt projection is Core policy, scoped through the same alias contract as providers.
+    static #KNOBS = ["PLURNK_SERVICE_PROMPT_PROJECTION"];
+    #shedRetiredCapacityKnobs() {
+        const retired = {
+            PLURNK_SERVICE_PROMPT_BUDGET: "provider input capacity is derived from context and output budgets",
+            PLURNK_SERVICE_SAFETY: "provider request-shaped capacity admission owns physical headroom",
+        };
+        for (const key of Object.keys(process.env)) {
+            const match = /^(PLURNK_SERVICE_PROMPT_BUDGET|PLURNK_SERVICE_SAFETY)(?:_.*)?$/u.exec(key);
+            const reason = match === null ? undefined : retired[match[1]];
+            if (reason !== undefined)
+                throw new Error(`${key} is retired: ${reason}.`);
+        }
+        const moved = {
+            CTX: "PLURNK_PROVIDERS_CONTEXT_WINDOW",
+            CONTEXT_WINDOW: "PLURNK_PROVIDERS_CONTEXT_WINDOW",
+            REASONING: "PLURNK_PROVIDERS_REASONING_BUDGET",
+            ASSISTANT: "PLURNK_PROVIDERS_OUTPUT_BUDGET",
+            COMPLETION: "PLURNK_PROVIDERS_OUTPUT_BUDGET",
+        };
+        for (const key of Object.keys(process.env)) {
+            const match = /^PLURNK_SERVICE_(CTX|CONTEXT_WINDOW|REASONING|ASSISTANT|COMPLETION)(_.*)?$/u.exec(key);
+            if (match !== null)
+                throw new Error(`${key} is retired: the provider-owned knob is ${moved[match[1]]}${match[2] ?? ""}.`);
         }
-        const view = scopeEnvToAlias(process.env, alias, _a.#KNOBS);
-        return readPartitionIntFrom(view, "PLURNK_SERVICE_SAFETY", 0);
     }
-    #promptBudgetCapFor(alias) {
+    #promptProjectionFor(alias) {
         const view = scopeEnvToAlias(process.env, alias, _a.#KNOBS);
-        return readOptionalPositiveIntFrom(view, "PLURNK_SERVICE_PROMPT_BUDGET");
-    }
-    #partitionFor(provider) {
-        const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
-        return { reasoning: provider.reasoningReserve ?? null, completion: provider.completionReserve ?? null, safety: this.#safetyFor(alias) };
+        return readRequiredPercentFrom(view, "PLURNK_SERVICE_PROMPT_PROJECTION");
     }
-    // The generation envelope — REASONING + COMPLETION, one undifferentiated pool, passed on
-    // every generate({maxTokens}): no decode is unbounded ({§tokenomics-window-partition}). Per
-    // alias: gemma's measured envelope; a cloud alias's generous default the backend clamps.
-    maxTokensFor(provider) {
-        const { reasoning, completion } = this.#partitionFor(provider);
-        if (reasoning === null || completion === null)
-            return null; // {§tokenomics-window-unpollable-deliberate}: unknown envelope, no cap; the backend clamps
-        return reasoning + completion;
-    }
-    // {§tokenomics-window-partition} — the natural prompt ceiling is the provider's
-    // effective context window minus its response reserves and the service's ruler
-    // safety. An optional service prompt budget may only tighten that result. It is
-    // model-facing grinder policy, never provider physics or a generation setting.
-    // The client-facing gauge, grinder ceiling, and persisted promptBudget use this one value.
-    promptBudgetFor(provider) {
-        return this.ceilingFor(provider); // ONE derivation — the gauge denominator IS the grinder ceiling
-    }
-    // {§tokenomics-agnostic-ruler} — the ceiling is the real window partition (window − reserves),
-    // NO calibration ratio: the model-facing measure is the chars/2 ruler (an over-count for
-    // typical text), so comparing ruler-weight to the real-token ceiling is itself the conservative
-    // bias - the packet reports less room than the provider usually has; authoritative
-    // provider request evidence guards the pathological tail at recovery admission.
-    ceilingFor(provider) {
-        const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
-        const operatorCap = this.#promptBudgetCapFor(alias);
-        // Unknown provider physics stays unknown; an explicit virtual ceiling still bounds
-        // PLURNK's packet without pretending to describe the backend.
-        if (provider.contextWindow === null)
-            return operatorCap;
-        const { reasoning, completion, safety } = this.#partitionFor(provider);
-        if (reasoning === null || completion === null)
-            return operatorCap;
-        const naturalBudget = provider.contextWindow - reasoning - completion - safety;
-        if (naturalBudget <= 0) {
-            // {§tokenomics-window-partition} — this contradiction has one cause: pinned absolute reserves
-            // exceeding the window the provider detected (percent reserves derive and cannot contradict).
-            throw new Error(`window partition contradiction for alias '${alias}': window ${provider.contextWindow} <= reserves ${reasoning}+${completion}+${safety}. Pinned PLURNK_PROVIDERS_{REASONING,COMPLETION}_RESERVE absolutes exceed the detected window — repin them under it, or use percent reserves, which derive from the window.`);
-        }
-        return operatorCap === null ? naturalBudget : Math.min(operatorCap, naturalBudget);
+    curationBudgetFor(provider) {
+        return provider.inputCapacity;
     }
     // {§packet-stored-shape} — assemble the system/user request before the
     // provider call; complete the same record with the provider response.
-    async buildRequestPacket({ initialMessages, requirements = "", workspaceId, workerId, loopId, currentTurnSeq, provider, gitStatus, notices = [], transientOpenLogEntryId = null, }) {
+    async buildRequestPacket({ initialMessages, requirements = "", workspaceId, workerId, loopId, currentTurnSeq, provider, gitStatus, notices = [], transientOpenLogEntryId = null, promptProjection = "automatic", }) {
         const byRole = (role) => initialMessages.filter((m) => m.role === role).map((m) => m.content).join("\n\n");
         // plurnk.md (grammar/dialects) ONLY — the definition is the hot-path grammar.
-        // The scheme catalogue is its own `schemes` section below tools ({§schemes-directory}),
+        // The resource catalogue is its own `schemes` section below tools ({§schemes-directory}),
         // NOT appended here: the language teaching is scheme-agnostic, so the service advertises
         // the installed scheme set at packet-time via SchemeRegistry.teach().
         const system_definition = compactDefinitionTables(byRole("system"));
@@ -239,12 +188,18 @@ class PacketBuilder {
         // {§emission-admission}: the definition remains the complete language authority.
         const log = await this.#buildLog(workerId, transientOpenLogEntryId);
         const failures = await this.buildFailurePointers(loopId, currentTurnSeq);
-        const countTokens = rulerCount; // {§tokenomics-agnostic-ruler} — the ONE model-facing ruler (chars/2), not the provider
+        const weighContent = contentWeight;
         // {§tools-loop-affinity}: teaching and dispatch resolve the same loop flags.
         const activeSchemes = this.#schemes.resolveForLoop(await LoopFlagsReader.read(this.#db, loopId));
         const tools = this.#collectTools(await this.#workspaceEnabled(workspaceId), await WorkspaceSettings.questionsEnabled(this.#db, workspaceId), activeSchemes);
-        const ceiling = this.ceilingFor(provider);
-        const budgetReadout = BudgetReadout.draft(ceiling);
+        const curationBudget = this.curationBudgetFor(provider);
+        const alias = ProviderInstantiate.aliasOf(provider) ?? resolveActiveAlias(process.env)?.alias ?? "";
+        const promptProjectionWeight = promptProjection === "withheld"
+            ? 0
+            : curationBudget === null
+                ? null
+                : Math.floor(curationBudget * this.#promptProjectionFor(alias));
+        const budgetReadout = BudgetReadout.draft(curationBudget);
         // The canonical default order, trust boundary, and cache-locality bias are
         // specified at {§packet-cache-monotone}. Budget placeholders resolve only
         // after trusted whole-list transforms establish the packet being measured.
@@ -267,17 +222,23 @@ class PacketBuilder {
             .map((r) => ({ status: r.status, path: `worker://${r.name}` }));
         const defaults = [
             { name: "definition", slot: "system", header: null, content: system_definition },
-            { name: "tools", slot: "system", header: "Registered Executable Tools", content: tools.executors },
+            // Stable privileged policy leads loop-dependent capabilities for
+            // prefix-cache locality. Empty policy sections simply disappear.
+            { name: "system-policy", slot: "system", header: "Policy", content: systemPolicy ?? "" },
+            { name: "project-policy", slot: "system", header: "Project Policy", content: projectPolicy ?? "" },
+            { name: "tools", slot: "system", header: "Registered Tools", content: tools.executors },
             ...(tools.optionalOperations.length > 0
                 ? [{ name: "optional-operations", slot: "system", header: "Enabled Optional Operations", content: tools.optionalOperations }]
                 : []),
-            { name: "schemes", slot: "system", header: "Schemes", content: this.#schemes.teach() },
+            { name: "schemes", slot: "system", header: "Resources", content: this.#schemes.teach() },
             ...(inject !== null ? [{ name: "inject", slot: "system", header: "Operator Notes", content: inject }] : []),
-            // policy: the client's privileged rules — ~/.plurnk/AGENTS.md (system) then <root>/AGENTS.md (project) — below grammar/tools/schemes, above budget-the-law. AGENTS is POLICY here, never a curatable READable entry. Empty content ⇒ section omitted.
-            { name: "system-policy", slot: "system", header: "Policy", content: systemPolicy ?? "" },
-            { name: "project-policy", slot: "system", header: "Project Policy", content: projectPolicy ?? "" },
             // The append-mostly log leads volatile user status ({§packet-cache-monotone}).
-            { name: "log", slot: "user", header: "Log", content: PacketWire.renderLog(log, countTokens) },
+            {
+                name: "log",
+                slot: "user",
+                header: "Log",
+                content: PacketWire.renderLog(log, weighContent, promptProjectionWeight === null ? {} : { promptProjectionWeight }),
+            },
             // The per-turn status clump follows the log ({§packet-cache-monotone}).
             // child-orientation: what this worker holds live — streams then child workers — just above errors. Terse
             // pointers (the path is the actionable address the model READs/OPENs/KILLs), never advice. {§child-orientation}
@@ -286,7 +247,8 @@ class PacketBuilder {
             { name: "errors", slot: "user", header: "Errors", content: PacketWire.renderFailurePointers(failures) },
             { name: "notices", slot: "user", header: "Notices", content: PacketWire.renderNotices(notices) },
             { name: "git", slot: "user", header: "Git Status", content: PacketWire.renderGit(gitStatus, branchAssignment?.branch ?? null) },
-            // budget — LAW (a hard ceiling the model must obey).
+            // Familiar token language is a deliberate final model projection;
+            // internally this is curation weight, never provider admission.
             { name: "budget", slot: "user", header: "Budget", content: budgetReadout },
             // The prompts section closes the status clump as a paths-only list;
             // bodies arrive through first-class prompt rows.
@@ -297,21 +259,21 @@ class PacketBuilder {
         // default list — add, remove, reorder — in-process, before measurement.
         let drafts = await this.#schemes.transformSections(defaults);
         const budgetSection = drafts.find((section) => section.name === "budget");
-        if (budgetSection !== undefined && ceiling !== null) {
-            const content = BudgetReadout.resolve(budgetSection.content, ceiling, (candidate) => {
+        if (budgetSection !== undefined && curationBudget !== null) {
+            const content = BudgetReadout.resolve(budgetSection.content, curationBudget, (candidate) => {
                 const candidateDrafts = drafts.map((section) => section === budgetSection ? { ...section, content: candidate } : section);
-                return countTokens(PacketWire.renderSlot(candidateDrafts, "system"))
-                    + countTokens(PacketWire.renderSlot(candidateDrafts, "user"));
+                return weighContent(PacketWire.renderSlot(candidateDrafts, "system"))
+                    + weighContent(PacketWire.renderSlot(candidateDrafts, "user"));
             });
             drafts = drafts.map((section) => section === budgetSection ? { ...section, content } : section);
         }
         // Core alone turns validated drafts into measured durable sections.
         const sections = drafts.map((section) => ({
             ...section,
-            tokens: countTokens(PacketWire.renderSection(section)),
+            weight: weighContent(PacketWire.renderSection(section)),
         }));
-        const packetTokens = countTokens(PacketWire.renderSlot(sections, "system")) + countTokens(PacketWire.renderSlot(sections, "user"));
-        return { tokens: packetTokens, sections, attributions: [] };
+        const renderWeight = weighContent(PacketWire.renderSlot(sections, "system")) + weighContent(PacketWire.renderSlot(sections, "user"));
+        return { weight: renderWeight, sections, attributions: [] };
     }
     // {§operator-config-workspace-execs} — the capability sheet and executor
     // documents share one workspace predicate with dispatch.
@@ -321,25 +283,24 @@ class PacketBuilder {
             return () => true;
         return (tag) => Policy.isEnabled(tag, execs);
     }
-    // The ## Registered Executable Tools capability sheet. Each available executor
-    // tag contributes its self-documenting example; the closed heading distinguishes
-    // registered selectors from the open-ended general examples above it. {§tools-capability-sheet}
+    // The complete ## Registered Tools contract table. {§tools-capability-sheet}
     #collectTools(workspaceEnabled, questionsOn = false, activeSchemes) {
-        // Registered executors and optional operations remain distinct fenced sheets.
+        // Registered executors and optional operations remain distinct sheets.
+        // The former is a contract table; only the latter is an operation example fence.
         // {§tools-capability-sheet} {§packet-operation-fences}
-        const executorOps = [];
+        const executorTools = [];
         const notices = [];
         // {§send-300-choices} — the one-liner rides ONLY where questions are enabled (allowed +
         // client-requested); the fuller questions.md doc injects through docEntries the same way.
         const optionalOperations = questionsOn
-            ? "```plurnk\n<<SEND[300]:Deploy where?;staging;production:SEND\n```"
+            ? "```plurnk\n## SEND0 [300]\nDeploy where?;staging;production\n```"
             : "";
         const executors = this.#executors();
         if (executors !== undefined) {
             const excluded = docsExcludeSet();
             const runtimes = executors.availableRuntimes();
-            // {§tools-capability-sheet} The sheet's lines are EXEC-usage examples, keyed on the 'exec' scheme
-            // (the op face, excludedInAsk). When inactive, say so POSITIVELY (a prose notice): plurnk.md
+            // {§tools-capability-sheet} The table is keyed on the exec scheme (the op face,
+            // excludedInAsk). When inactive, say so positively: plurnk.md
             // still teaches EXEC as language, and silent absence measurably invites confabulated runtimes.
             const execActive = activeSchemes === undefined || activeSchemes.has("exec");
             if (runtimes.length > 0 && !execActive) {
@@ -348,25 +309,24 @@ class PacketBuilder {
             else {
                 for (const tag of runtimes) {
                     if (excluded.has(tag))
-                        continue; // {§tools-capability-sheet} — exclude drops the example and doc
+                        continue; // {§tools-capability-sheet} — exclude drops the row and doc
                     if (!workspaceEnabled(tag))
                         continue; // {§operator-config-workspace-execs}
                     const entry = executors.entry(tag);
-                    // {§tools-capability-sheet} — the example is the bare op fenced below; the fuller doc
-                    // materializes at worker://plurnk/docs/<tag>.md. No example → no line.
-                    if (entry?.example)
-                        executorOps.push(entry.example);
+                    if (entry !== undefined)
+                        executorTools.push({ runtime: tag, invocation: entry.invocation });
                 }
             }
         }
         const parts = [...notices];
-        if (executorOps.length > 0)
-            parts.push(`\`\`\`plurnk\n${executorOps.join("\n")}\n\`\`\``);
+        const directory = ExecutableTools.render(executorTools);
+        if (directory !== "")
+            parts.push(directory);
         return { executors: parts.join("\n\n"), optionalOperations };
     }
     // #note12 — the plugin-provided reference docs (schemes' + execs' `documentation`),
     // materialized at worker://plurnk/docs/<name>.md by LoopDocs (like operator
-    // docs) so the catalog can expose each doc's token weight.
+    // docs) so the catalog can expose each doc's curation weight.
     async docEntries(workspaceId) {
         const out = await this.#schemes.docs(); // scheme docs already drop PLURNK_SERVICE_DOCS_EXCLUDE names
         // {§send-300-choices} {§teaching-corpus} — the conditional teaching: questions.md
@@ -394,96 +354,29 @@ class PacketBuilder {
         return out;
     }
     // SPEC {§grinder} — the budget grinder. Runs pre-LLM (in runTurn, after the packet
-    // is built, before provider.generate); fires only on actual overflow. One rule:
-    // fold the NEWEST turn boundary's open rows (errors exempt) — never history —
-    // strike, rebuild, re-measure. Folds (never deletes). The strike it raises and
-    // the hard-stop it can signal are returned to runLoop, which owns abandonment.
+    // is built, before provider.generate); fires only when curation weight exceeds
+    // the provider-derived curation budget. One
+    // reversible rule: roll back context introduced by the NEWEST turn boundary —
+    // rows born there plus exact older rows it transitioned folded→open — then
+    // rebuild and re-measure.
     // {§grinder-overflow-only} — fires only on actual overflow, never speculatively
-    async enforceBudget({ packet, provider, workerId, loopId, turnId, mintSequence, rebuild }) {
-        const ceiling = this.ceilingFor(provider);
-        const measure = (p) => p.tokens;
-        // {§tokenomics-window-unpollable-deliberate} — a null policy ceiling never triggers grinding. If a virtual ceiling
-        // does trigger recovery while provider physics is unknown, physical admission
-        // separately fails closed under {§tokenomics-physical-admission}.
-        if (ceiling === null || measure(packet) <= ceiling) {
-            return { packet, fit: true, struck: false, recorded: false };
+    async enforceBudget({ packet, provider, loopId, turnId, recordOverflow, rebuild }) {
+        const budget = this.curationBudgetFor(provider);
+        const measure = (p) => p.weight;
+        if (budget === null || measure(packet) <= budget) {
+            return { packet, fit: true, boundaryRolledBack: false };
         }
-        // ONE rule, every turn — turn 1 and turn 101 alike ({§grinder-layer1-rollback}): fold the
-        // NEWEST turn boundary's still-open rows (the prior turn's emissions + this turn's
-        // pre-model rows; errors exempt) in one set-op, strike once, rebuild, re-measure.
-        // The model owns history visibility. The grinder never reaches back; it folds only the
-        // newest boundary required to produce a physically valid packet. Continued overflow
-        // follows the explicit recovery/hard-stop contract ({§grinder-fold-strikes}).
-        const usage = measure(packet);
+        const weight = measure(packet);
+        await recordOverflow({ weight, budget, excess: weight - budget });
+        // ONE rule, every turn ({§grinder-layer1-rollback}): atomically fold/tag
+        // context introduced by the newest boundary. Other older history remains
+        // model-owned; remaining curation debt is neither failure nor strike.
         await this.#db.engine_grinder_fold_newest_turn({ loop_id: loopId, turn_id: turnId });
-        let current = await rebuild();
-        if (measure(current) > ceiling) {
-            // Engine owns the hard-overflow branch and records its one occurrence with
-            // the enforced recovery constraint (or terminal physics), so this layer does
-            // not mint a second, weaker account of the same failure.
-            return { packet: current, fit: false, struck: true, recorded: false };
-        }
-        // The fold recovered the request. Preserve the triggering measurements on one
-        // actionless row and rebuild once so its Problem surfaces in this same packet.
-        await this.#problems.record({
-            workerId,
-            loopId,
-            turnId,
-            sequence: mintSequence,
-            origin: "plurnk",
-            source: "rail",
-            result: BudgetOverflow.foldedResult(usage, ceiling),
-        });
-        current = await rebuild();
-        return {
-            packet: current,
-            fit: measure(current) <= ceiling,
-            struck: true,
-            recorded: true,
-        };
+        const current = await rebuild();
+        return { packet: current, fit: measure(current) <= budget, boundaryRolledBack: true };
     }
-    // {§tokenomics-physical-admission}: one request-shaped physical predicate.
-    // The exact PacketWire messages used for dispatch are the measurement input;
-    // empirical estimates cannot authorize recovery against a hard window.
-    async physicalAdmission(packet, provider, signal) {
-        if (provider.contextWindow === null) {
-            return {
-                admitted: false,
-                reason: "unknown_context_window",
-                detail: `provider ${JSON.stringify(provider.model)} reports no physical context window`,
-                capacity: null,
-            };
-        }
-        const maxTokens = this.maxTokensFor(provider);
-        if (maxTokens === null) {
-            return {
-                admitted: false,
-                reason: "unknown_output_envelope",
-                detail: `provider ${JSON.stringify(provider.model)} reports no resolved output envelope`,
-                capacity: null,
-            };
-        }
-        const capacity = provider.contextWindow - maxTokens;
-        const measurement = assertPromptTokenMeasurement(await provider.countPromptTokens(PacketWire.packetToWireMessages(packet), signal), `provider ${JSON.stringify(provider.model)}`);
-        if (measurement.kind === "estimate") {
-            return {
-                admitted: false,
-                reason: "estimate",
-                detail: `${measurement.source} is an empirical estimate and cannot authorize physical recovery: ${measurement.detail}`,
-                capacity,
-                measurement,
-            };
-        }
-        if (measurement.tokens > capacity) {
-            return {
-                admitted: false,
-                reason: "over_capacity",
-                detail: `${measurement.kind} prompt measurement ${measurement.tokens} exceeds physical prompt capacity ${capacity}`,
-                capacity,
-                measurement,
-            };
-        }
-        return { admitted: true, capacity, measurement };
+    async rollbackNewestBoundary(loopId, turnId) {
+        await this.#db.engine_grinder_fold_newest_turn({ loop_id: loopId, turn_id: turnId });
     }
     // Every prior-turn operation failure is durable before packet assembly.
     // The model-facing Errors section is only a terse projection of those rows;
@@ -492,7 +385,7 @@ class PacketBuilder {
         const rows = await this.#db.engine_render_errors.all({ loop_id: loopId, current_turn_seq: currentTurnSeq });
         return rows.map((r) => ({
             status: r.status_rx,
-            coordinate: `${r.loop_seq}/${r.turn_seq}/${r.sequence}/${r.op}`,
+            coordinate: LogEntryProjection.coordinate(`${r.loop_seq}/${r.turn_seq}/${r.sequence}`, r),
         }));
     }
     // SPEC {§packet} the log section — chronological action-entries for the loop.
@@ -508,29 +401,62 @@ class PacketBuilder {
         // runTurn. They surface naturally in this query without synthetic
         // EDIT/READ delivery rows.
         const rows = await this.#db.engine_render_log.all({ worker_id: workerId });
-        return rows.map((r) => ({
-            coordinate: `${r.loop_seq}/${r.turn_seq}/${r.sequence}`,
-            origin: r.origin,
-            op: r.op,
-            suffix: r.suffix,
-            signal: r.signal === null ? null : JSON.parse(r.signal),
-            target: {
-                scheme: r.scheme,
-                username: r.username, password: r.password,
-                hostname: r.hostname, port: r.port,
-                pathname: r.pathname,
-                query: r.query,
-                fragment: r.fragment,
-            },
-            status: r.status_rx,
-            rx: r.mimetype_rx === "application/json" ? JSON.parse(r.rx) : r.rx,
-            mimetype_rx: r.mimetype_rx,
-            tx: r.mimetype_tx === "application/json" ? JSON.parse(r.tx) : r.tx,
-            mimetype_tx: r.mimetype_tx,
-            folded: r.expanded === 0 && r.id !== transientOpenLogEntryId,
-            source: r.source,
-            attrs: r.attrs === null ? null : JSON.parse(r.attrs),
-        }));
+        return rows.map((r) => {
+            const tx = r.mimetype_tx === "application/json" ? JSON.parse(r.tx) : r.tx;
+            const rx = r.mimetype_rx === "application/json" ? JSON.parse(r.rx) : r.rx;
+            const rawLineAnchors = LogEntryProjection.op(r) === "READ"
+                && r.status_rx === 200
+                && rx !== null
+                && typeof rx === "object"
+                && Object.hasOwn(rx, "lineAnchors")
+                ? rx.lineAnchors
+                : undefined;
+            if (rawLineAnchors !== undefined && !Array.isArray(rawLineAnchors)) {
+                throw new TypeError("A READ result's lineAnchors field must be an array.");
+            }
+            const lineAnchors = rawLineAnchors;
+            const rawLineNumberWidth = LogEntryProjection.op(r) === "READ"
+                && r.status_rx === 200
+                && rx !== null
+                && typeof rx === "object"
+                && Object.hasOwn(rx, "lineNumberWidth")
+                ? rx.lineNumberWidth
+                : undefined;
+            if (rawLineNumberWidth !== undefined
+                && !LineAnchors.isLineNumberWidth(rawLineNumberWidth)) {
+                throw new TypeError("A READ result's lineNumberWidth field must be a valid decimal line width.");
+            }
+            if ((lineAnchors === undefined) !== (rawLineNumberWidth === undefined)) {
+                throw new TypeError("A READ result's lineAnchors and lineNumberWidth fields must appear together.");
+            }
+            const lineNumberWidth = rawLineNumberWidth;
+            return {
+                coordinate: `${r.loop_seq}/${r.turn_seq}/${r.sequence}`,
+                origin: r.origin,
+                op: r.op,
+                suffix: r.suffix,
+                signal: r.signal === null ? null : JSON.parse(r.signal),
+                target: {
+                    scheme: r.scheme,
+                    username: r.username, password: r.password,
+                    hostname: r.hostname, port: r.port,
+                    pathname: r.pathname,
+                    query: r.query,
+                    fragment: r.fragment,
+                },
+                status: r.status_rx,
+                rx,
+                mimetype_rx: r.mimetype_rx,
+                tx,
+                mimetype_tx: r.mimetype_tx,
+                folded: r.expanded === 0 && r.id !== transientOpenLogEntryId,
+                source: r.source,
+                attrs: r.attrs === null ? null : JSON.parse(r.attrs),
+                tags: JSON.parse(r.tags),
+                ...(lineAnchors === undefined ? {} : { lineAnchors }),
+                ...(lineNumberWidth === undefined ? {} : { lineNumberWidth }),
+            };
+        });
     }
 }
 _a = PacketBuilder;