@plurnk/plurnk-service 1.5.0 → 1.6.1

package/dist/core/Engine.js

@@ -1,96 +1,28 @@
-import { PlurnkParser, PlurnkParseError, UNKNOWN_POSITION } from "@plurnk/plurnk-contracts";
-import { RuntimeTag } from "@plurnk/plurnk-execs";
-import Owner from "./Owner.js";
-const TERMINAL_SEND_SIGNALS = new Set([102, 200, 202, 300, 499]);
-const comparePosition = (a, b) => a.line - b.line || a.column - b.column;
+import { RuntimeInvocation, RuntimeTag } from "@plurnk/plurnk-execs";
 import { Mimetypes, emptyRegistry } from "@plurnk/plurnk-mimetypes";
 import Meta from "@plurnk/plurnk-meta";
 import EntryCrud from "../schemes/_entry-crud.js";
 import SearchIndex from "../schemes/_search-index.js";
 import GitMembership from "./git-membership.js";
-import GitState from "./git-state.js";
-import WorkspaceSettings from "./workspace-settings.js";
-import { editedSpan } from "../content/index.js";
-import { promptPathname, promptLoopPrefix, renderTarget } from "./plurnk-uri.js";
-import { rulerCount } from "./token-ruler.js";
+import { promptPathname, promptLoopPrefix } from "./plurnk-uri.js";
+import { contentWeight } from "./content-weight.js";
 import SearchGate from "./search-gate.js";
 import LiveSubscriptions from "./LiveSubscriptions.js";
 import LoopLifecycle from "./LoopLifecycle.js";
-import { readFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
 import { setTimeout as delay } from "node:timers/promises";
-// Shared module imported by both Engine and bin/digest.ts, so wire
-// projection and digest projection are structurally one function — no
-// drift between wire and digest possible.
-import PacketWire from "./packet-wire.js";
-import Results, { OperationFailureError } from "./results.js";
-import BranchReceipt from "./BranchReceipt.js";
-import TerminalResult from "./TerminalResult.js";
-import BudgetOverflow from "./BudgetOverflow.js";
-import WorkerControlAddress from "./WorkerControlAddress.js";
-import JournalTurn from "./JournalTurn.js";
+import Results from "./results.js";
 // The engine's collaborators — each owns one machine; Engine owns the loop/turn
 // lifecycle and wires them together as the public facade.
 import NoticeChannel from "./NoticeChannel.js";
 import ProblemLog from "./ProblemLog.js";
 import StrikeRail from "./StrikeRail.js";
 import PacketBuilder from "./PacketBuilder.js";
-import StoredPacket from "./StoredPacket.js";
 import ProposalLifecycle from "./ProposalLifecycle.js";
 import Dispatcher from "./Dispatcher.js";
-import { observed, observedSync } from "../observe/spans.js";
-import { OPS_DISPATCHED, PROVIDER_CALLS, recordCounter } from "../observe/metrics.js";
-import { scheduleTurnOps } from "./turn-scheduler.js";
-import { readOptimisticSettlementMs } from "./optimistic-settlement.js";
-const DEFAULT_MAX_STRIKES = 3;
-const RECORD_STREAM_MIMETYPES = new Set(["application/jsonl", "application/x-ndjson"]);
-const baseMimetype = (mimetype) => mimetype.split(";", 1)[0].trim().toLowerCase();
-// {§exec-stream} Active streams publish only independently meaningful units.
-// Atomic documents wait for close; JSONL stops after its last complete record.
-const streamPublicationEnd = (content, mimetype, cursor, closed) => {
-    const type = baseMimetype(mimetype);
-    if (closed || type.startsWith("text/"))
-        return content.length;
-    if (!RECORD_STREAM_MIMETYPES.has(type))
-        return cursor;
-    return Math.max(cursor, content.lastIndexOf("\n") + 1);
-};
-const ENGINE_PROBLEMS = Object.freeze({
-    max_commands_exceeded: {
-        status: 429,
-        code: "max-commands-exceeded",
-        detail: "Later operations were not executed because the turn exceeded its operation limit.",
-    },
-    idle_turn: {
-        status: 409,
-        code: "idle-turn",
-        detail: "SEND[102] was emitted without an operation to continue from.",
-    },
-});
-// The prompt entry target - prompt:///<loop>/<N>, self-only ({§prompt-self-only}):
-// the owner rides the owner_id column, the address carries only the loop coordinate.
-const promptTarget = (loopSeq, turnSeq) => {
-    const storage = promptPathname(loopSeq, turnSeq);
-    return {
-        kind: "url", raw: `prompt://${storage}`,
-        scheme: "prompt", username: null, password: null,
-        hostname: null, port: null,
-        pathname: storage, query: null, fragment: null,
-    };
-};
-const assertOpenPaths = (value, source) => {
-    if (!Array.isArray(value) || value.some((path) => typeof path !== "string" || path.length === 0)) {
-        throw new TypeError(`${source}: expected an array of non-empty strings`);
-    }
-    return value;
-};
-const parsePromptAttributes = (encoded, source) => {
-    const attributes = JSON.parse(encoded);
-    if (attributes === null || typeof attributes !== "object" || Array.isArray(attributes)) {
-        throw new TypeError(`${source}: expected a JSON object`);
-    }
-    return attributes;
-};
+import TurnRunner, { LOOP_TIMEOUT_REASON } from "./TurnRunner.js";
+import { observed } from "../observe/spans.js";
+import { providerRequestFromStorageRow, } from "./provider-accounting.js";
+const DEFAULT_MAX_STRIKES = 6;
 const readMaxStrikes = () => {
     const raw = process.env.PLURNK_SERVICE_MAX_STRIKES;
     if (raw === undefined || raw.length === 0)
@@ -100,37 +32,7 @@ const readMaxStrikes = () => {
         return DEFAULT_MAX_STRIKES;
     return n;
 };
-// Per-emission action ceiling — OFF by default. `-1` (or unset/non-positive) = no cap:
-// every generated op dispatches. Runaway degeneration is a sampler concern (repetition penalty),
-// not grounds to drop already-generated work. A positive value is an operator ceiling a
-// workspace's maxCommands may tighten (min wins), never widen
-// ({§operator-config-workspace-max-commands}).
-const readMaxCommands = () => {
-    const raw = process.env.PLURNK_SERVICE_MAX_COMMANDS;
-    if (raw === undefined || raw.length === 0)
-        return Number.POSITIVE_INFINITY;
-    const n = Number.parseInt(raw, 10);
-    if (!Number.isFinite(n) || n < 1)
-        return Number.POSITIVE_INFINITY;
-    return n;
-};
-// PLURNK_SERVICE_FILES_ITEMS — the turn-0 catalog preview. null = off;
-// -1 = the ordinary markerless page; positive N explicitly caps file rows. 0 / unset = off.
-const normalizeFilesItems = (n) => (!Number.isFinite(n) || n === 0 ? null : n < 0 ? -1 : n);
-const readFilesItems = () => {
-    const raw = process.env.PLURNK_SERVICE_FILES_ITEMS;
-    if (raw === undefined || raw.length === 0)
-        return null;
-    return normalizeFilesItems(Number.parseInt(raw, 10));
-};
-import { ProviderError, providerCostFor, providerCostUsd, validateProviderCost, scopeEnvToAlias, resolveActiveAlias } from "@plurnk/plurnk-providers";
-import { validateGbnf } from "@plurnk/gbnf";
-import ProviderInstantiate from "./ProviderInstantiate.js";
-// Runtime normalization for a disposition the engine refuses or resolves as a
-// continue after dispatch ({§send}). Every admitted emission itself ends in an
-// explicit disposition SEND ({§emission-admission}).
-const TURN_STATUS_IMPLICIT_CONTINUE = 102;
-const INVALID_EMISSION_RECOVERY_MESSAGE = "Your previous response contained an unrecoverable syntax error. No operations were performed. Try again.";
+import { aggregateProviderAccounting } from "@plurnk/plurnk-providers";
 const DEFAULT_MIN_CYCLES = 3;
 const DEFAULT_MAX_CYCLE_PERIOD = 4;
 const readPositiveInt = (envVar, fallback) => {
@@ -142,19 +44,10 @@ const readPositiveInt = (envVar, fallback) => {
         return fallback;
     return n;
 };
-const readEmissionAttempts = () => {
-    const raw = process.env.PLURNK_SERVICE_EMISSION_ATTEMPTS;
-    const value = Number.parseInt(raw ?? "", 10);
-    if (!Number.isInteger(value) || value < 1) {
-        throw new Error(`PLURNK_SERVICE_EMISSION_ATTEMPTS must be a positive integer; got ${raw}`);
-    }
-    return value;
-};
 // {§operator-config-loop-timeout} — the loop's wall-clock budget (PLURNK_SERVICE_LOOP_TIMEOUT).
 const DEFAULT_LOOP_TIMEOUT_MS = 86400000;
 const readLoopTimeoutMs = () => readPositiveInt("PLURNK_SERVICE_LOOP_TIMEOUT", DEFAULT_LOOP_TIMEOUT_MS);
 // The wall's abort reason — runLoop branches a mid-turn teardown to the 504 terminal on it.
-const LOOP_TIMEOUT_REASON = "loop_timeout";
 export default class Engine {
     static fingerprintTurn(ops) {
         return StrikeRail.fingerprintTurn(ops);
@@ -168,11 +61,11 @@ export default class Engine {
     #mimetypes;
     // {§tokenomics-agnostic-ruler} — the stable model-independent ruler used
     // for write-time, catalog, receipt, and packet weights.
-    #tokenize;
+    #weighContent;
     // Boot-discovered runtime executors. Daemon builds + sets via
     // setExecutors at start(); undefined until then (and in bare tests).
     #executors;
-    // {§send-premature-terminate}/SEND[202]<T> — park deadlines by loopId, written at dispatch (the
+    // {§send-premature-terminate}/scoped SEND signal 202 — park deadlines by loopId, written at dispatch (the
     // marker's seconds; -1 = indefinite), consumed by the daemon's drain park-exit to schedule
     // the deadline wake. In-memory: a daemon restart drops pending deadlines (documented).
     parkDeadlines = new Map();
@@ -184,13 +77,11 @@ export default class Engine {
     #notices;
     #problems;
     #strikes;
-    // {§grinder-hard-413-recovery} - loops granted their one over-ceiling recovery turn. Cleared on a
-    // fitting turn so a later independent overflow can earn a fresh recovery, and at loop cleanup.
-    #hardOverflowRecovery = new Set();
     #packets;
     searchGate = new SearchGate();
     #proposals;
     #dispatcher;
+    #turnRunner;
     #liveSubscriptions = new LiveSubscriptions();
     // Per-loop AbortController for cancellation propagation into scheme
     // ctx.signal. runLoop creates one at entry, cleans up at end. Engine
@@ -329,33 +220,7 @@ export default class Engine {
     #wakeWorkerNotify;
     #acquireWorkspaceTurn;
     #workspaceTurnCompleted;
-    // Configured grammar text is cached by variant after its first load.
-    #gbnfCache = new Map();
-    // {§rail-truth-engine-verdict} — the verify GAP (a configured grammar @plurnk/gbnf can't
-    // parse): warn once per message, never per turn; the turn records railsVerdict "unverifiable".
-    static #railGapWarned = new Set();
-    static #warnRailVerdictGapOnce(message) {
-        if (Engine.#railGapWarned.has(message))
-            return;
-        Engine.#railGapWarned.add(message);
-        process.stderr.write(`plurnk-engine: rail verdict unavailable — the configured grammar did not parse in @plurnk/gbnf (${message})\n`);
-    }
-    static #requireGrammarEvidence(response) {
-        const evidence = response.grammarEvidence;
-        if (evidence === undefined) {
-            throw new Error("provider contract violation: configured GBNF response omitted grammar evidence");
-        }
-        const input = [...evidence.input];
-        if (!Number.isInteger(evidence.contentStart)
-            || evidence.contentStart < 0
-            || evidence.contentStart > input.length
-            || typeof evidence.transported !== "boolean"
-            || input.slice(evidence.contentStart).join("") !== response.assistant.content) {
-            throw new Error("provider contract violation: grammar evidence does not map exactly to assistant.content");
-        }
-        return evidence;
-    }
-    constructor({ db, schemes, mimetypes, streamEventNotify, wakeWorkerNotify, injectWorker, branchWorker, branchCompletionGate, cancelWorker, cancelDescendants, acquireWorkspaceTurn, workspaceTurnCompleted, noticeNotify, tokenize }) {
+    constructor({ db, schemes, mimetypes, streamEventNotify, wakeWorkerNotify, injectWorker, branchWorker, branchCompletionGate, cancelWorker, cancelDescendants, acquireWorkspaceTurn, workspaceTurnCompleted, noticeNotify, weigh }) {
         this.#db = db;
         this.#lifecycle = new LoopLifecycle(db);
         this.#schemes = schemes;
@@ -371,28 +236,28 @@ export default class Engine {
             discovery: { registry: emptyRegistry(), handlers: new Map(), skipped: [] },
         });
         // {§tokenomics-agnostic-ruler} — standalone construction and the daemon
-        // use the same default; provider counting is confined to physical admission.
-        this.#tokenize = tokenize ?? rulerCount;
+        // use the same default; provider request counting remains confined to
+        // provider-owned capacity assessment.
+        this.#weighContent = weigh ?? contentWeight;
         const executors = () => this.#executors;
         const loopSignal = (loopId) => this.#loopAborts.get(loopId)?.signal;
         this.#notices = new NoticeChannel({ notify: noticeNotify });
-        this.#problems = new ProblemLog(db);
+        this.#problems = new ProblemLog(db, this.#weighContent);
         this.#strikes = new StrikeRail();
         this.#packets = new PacketBuilder({
             db,
             schemes,
-            problems: this.#problems,
             executors,
         });
         this.#proposals = new ProposalLifecycle({
             db, schemes, notices: this.#notices,
             streamEventNotify, wakeWorkerNotify,
-            tokenize: this.#tokenize, mimetypes: this.#mimetypes, executors, loopSignal,
+            weigh: this.#weighContent, mimetypes: this.#mimetypes, executors, loopSignal,
             liveSubscriptions: this.#liveSubscriptions,
         });
         this.#dispatcher = new Dispatcher({ searchGate: this.searchGate,
             db, schemes, mimetypes: this.#mimetypes,
-            tokenize: this.#tokenize,
+            weigh: this.#weighContent,
             notices: this.#notices, proposals: this.#proposals,
             executors, loopSignal,
             streamEventNotify, wakeWorkerNotify, injectWorker, branchWorker, branchCompletionGate, cancelWorker, cancelDescendants,
@@ -400,11 +265,30 @@ export default class Engine {
             joinTargets: this.joinTargets,
             liveSubscriptions: this.#liveSubscriptions,
         });
+        this.#turnRunner = new TurnRunner({
+            db,
+            schemes,
+            mimetypes: this.#mimetypes,
+            weigh: this.#weighContent,
+            notices: this.#notices,
+            problems: this.#problems,
+            strikes: this.#strikes,
+            packets: this.#packets,
+            dispatcher: this.#dispatcher,
+            liveSubscriptions: this.#liveSubscriptions,
+            streamEventNotify,
+            wakeWorkerNotify,
+            executors,
+            loopSignal,
+            warmWorkspace: (context, invalidate, materialize) => this.#queueWorkspaceWarm(context, invalidate, materialize),
+            dispatch: (context) => this.dispatch(context),
+            resolveWorkerProviderIdentity: (workerId) => this.resolveWorkerProviderIdentity(workerId),
+        });
         schemes.bindCore({
             db,
             mimetypes: this.#mimetypes,
             executors,
-            tokenize: this.#tokenize,
+            weigh: this.#weighContent,
             streamEventNotify,
             wakeWorkerNotify,
             injectWorker,
@@ -426,38 +310,16 @@ export default class Engine {
         if (this.#executors === undefined)
             throw new Error("registerRuntime: executor registry not wired yet");
         RuntimeTag.assert(tag, "module runtime");
+        const normalized = {
+            ...entry,
+            invocation: RuntimeInvocation.assert(entry.invocation, entry.namespaceOwner.name, tag),
+        };
         // Preflight both owners before either write; synchronous registration
         // then cannot leave a half-claimed namespace. {§plugin-namespace-arbitration}
-        this.#executors.assertCanRegister(tag, entry.namespaceOwner);
-        this.#schemes.assertRuntimeClaim(tag, entry.namespaceOwner);
-        this.#schemes.registerRuntimeScheme(tag, entry.executor, entry.namespaceOwner, scheme);
-        this.#executors.register(tag, entry);
-    }
-    // Supply an explicitly configured local constraint; ANTLR remains the
-    // language authority. {§grammar-enforcement-verified-at-boot}
-    async #grammarConstraint(provider) {
-        // Resolve through the registered or active alias; ambiguity and load
-        // failures never degrade to unconstrained generation.
-        // {§grammar-enforcement-verified-at-boot}
-        const registered = ProviderInstantiate.aliasOf(provider);
-        const fallback = registered === undefined ? resolveActiveAlias(process.env)?.alias : undefined;
-        if (registered === undefined && fallback === undefined && Object.keys(process.env).some((k) => k.startsWith("PLURNK_PROVIDERS_GBNF_"))) {
-            throw new Error("GBNF constraint: provider has no registered alias and no active alias resolves, while per-alias PLURNK_PROVIDERS_GBNF_* constraints are configured");
-        }
-        const alias = registered ?? fallback ?? "";
-        const variant = scopeEnvToAlias(process.env, alias, ["PLURNK_PROVIDERS_GBNF"]).PLURNK_PROVIDERS_GBNF;
-        if (variant === undefined || variant === "" || variant === "0")
-            return undefined;
-        const hit = this.#gbnfCache.get(variant);
-        if (hit !== undefined)
-            return hit;
-        const path = variant.startsWith("/") || variant.startsWith(".")
-            ? variant
-            : fileURLToPath(import.meta.resolve(`@plurnk/plurnk-contracts/${variant}`));
-        const text = await readFile(path, "utf8"); // unresolvable/unreadable throws — a configured rail never silently degrades
-        this.#gbnfCache.set(variant, text);
-        process.stderr.write(`plurnk-engine: GBNF constraint: ${alias || "(bare)"} → ${variant} (${text.length} chars)\n`);
-        return text;
+        this.#executors.assertCanRegister(tag, normalized.namespaceOwner);
+        this.#schemes.assertRuntimeClaim(tag, normalized.namespaceOwner);
+        this.#schemes.registerRuntimeScheme(tag, normalized.executor, normalized.namespaceOwner, scheme);
+        this.#executors.register(tag, normalized);
     }
     // A lineage's no-parent root; a root worker resolves to itself. Fail hard
     // when corruption leaves a worker without one. {§worker-primary}
@@ -467,12 +329,18 @@ export default class Engine {
             throw new Error(`resolveWorkerPrimary: worker ${workerId} has no lineage root — corrupt parent chain`);
         return root.id;
     }
-    promptBudgetFor(provider) {
-        return this.#packets.promptBudgetFor(provider);
+    async resolveWorkerProviderIdentity(workerId) {
+        const identity = await this.#db.engine_worker_provider_identity.get({ worker_id: workerId });
+        if (identity === undefined) {
+            throw new Error(`resolveWorkerProviderIdentity: worker ${workerId} has no lineage root — corrupt parent chain`);
+        }
+        return {
+            workerId: identity.worker_id,
+            primaryWorkerId: identity.primary_worker_id,
+        };
     }
-    async #attemptAttributions(provider, context) {
-        const tags = Meta.composeAttributions(this.#schemes.attributions(context), this.#executors?.attributions(context) ?? [], await this.#mimetypes.attributions(context), provider.attributions?.(context) ?? []);
-        return [...tags];
+    curationBudgetFor(provider) {
+        return this.#packets.curationBudgetFor(provider);
     }
     // {§attribution} — reporting derives from exact provider-request evidence;
     // malformed durable tags fail here instead of being silently filtered.
@@ -486,52 +354,29 @@ export default class Engine {
         });
         return [...Meta.composeAttributions(tags)];
     }
-    // Loop totals are billing evidence; the latest-turn pair is the client
-    // occupancy gauge. {§tokenomics-client-gauge}, {§notifications-loop-terminated}
+    // The request ledger is cardinal evidence; its aggregate and the latest-turn
+    // occupancy gauge are derived projections. {§tokenomics-client-gauge},
+    // {§notifications-loop-terminated}, {§provider-accounting}
     async loopUsage(loopId) {
         const row = await this.#db.engine_loop_usage.get({ loop_id: loopId });
         if (row === undefined)
             throw new Error(`loopUsage: loop ${loopId} does not exist`);
-        const parsedCosts = JSON.parse(row?.costs ?? "[]");
-        if (!Array.isArray(parsedCosts))
-            throw new TypeError(`loop ${loopId} monetary evidence is not an array`);
-        const costs = parsedCosts.map((cost) => validateProviderCost(cost));
+        const requests = await this.#db.engine_loop_provider_requests.all({ loop_id: loopId });
         return {
-            promptTokens: row?.prompt ?? 0,
-            completionTokens: row?.completion ?? 0,
-            reasoningTokens: row?.reasoning ?? 0,
-            cachedTokens: row?.cached ?? 0,
-            costUsd: row?.cost_usd ?? null,
-            costs,
-            // Latest provider attempt on the latest turn, not the billed total.
-            contextTokens: row?.context ?? 0,
-            // Latest effective packet allowance; null when uncapped or unknown.
-            promptBudget: row?.context_size ?? null,
+            accounting: aggregateProviderAccounting(requests.map(providerRequestFromStorageRow)),
+            // Latest assembled request's stable model-independent weight.
+            curationWeight: row.curation_weight,
+            // Latest provider-derived calibration used only for curation.
+            curationBudget: row.curation_budget,
+            // Latest emission call's last physical request, not the billed total.
+            contextTokens: row.context_tokens,
+            // Request-shaped physical capacity from that same latest emission call.
+            contextCapacity: row.context_capacity,
             // Latest turn's opaque provider metadata. {§meta-passthrough}
-            meta: JSON.parse(row?.meta ?? "{}"),
+            meta: JSON.parse(row.meta ?? "{}"),
         };
     }
-    // A mapped rail divergence is a CODE-POINT offset into the model's content;
-    // the snippet/notices surface speaks the parser-point convention. {§parser-position}
-    // Convert over code points (not UTF-16 units) so an astral char doesn't skew the line,
-    // clamping out-of-range offsets to the content's end.
-    #offsetToLineColumn(content, offset) {
-        const cps = Array.from(content);
-        const clamped = Math.max(0, Math.min(offset, cps.length));
-        let line = 1;
-        let column = 0;
-        for (let i = 0; i < clamped; i++) {
-            if (cps[i] === "\n") {
-                line++;
-                column = 0;
-            }
-            else {
-                column++;
-            }
-        }
-        return { line, column };
-    }
-    async runLoop({ provider, messages, requirements = "", workspaceId, workerId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
+    async runLoop({ provider, childProvider = provider, messages, requirements = "", workspaceId, workerId, loopId, maxTurns = 50, maxStrikes = readMaxStrikes(), minCycles = readPositiveInt("PLURNK_SERVICE_MIN_CYCLES", DEFAULT_MIN_CYCLES), maxCyclePeriod = readPositiveInt("PLURNK_SERVICE_MAX_CYCLE_PERIOD", DEFAULT_MAX_CYCLE_PERIOD), origin = "model", signal, onDispatch, }) {
         // A 202 park suspends this durable loop and a later wake re-enters runLoop.
         // Its ceiling therefore counts every prior turn, not merely this process-local
         // execution segment.
@@ -567,11 +412,11 @@ export default class Engine {
             return { turnIds, result, hitMaxTurns: false, reason: "loop_timeout" };
         };
         // Cleanup splits by termination kind:
-        // - "graceful" (SEND[202] Accepted): in-flight streaming-scheme spawns
+        // - "graceful" (SEND signal 202 Accepted): in-flight streaming-scheme spawns
         //   are ALLOWED to outlive the loop — they complete naturally, write final
         //   channel state, and wake-on-completion (E.4) opens a fresh loop. 202 is
         //   the only terminal that means "keep my async work."
-        // - "forceful" (SEND[200] done, max_turns, strike, cancel, budget, 4xx/5xx):
+        // - "forceful" (SEND signal 200 done, max_turns, strike, cancel, context-envelope rejection, 4xx/5xx):
         //   fire the loop-level abort so leftover spawns tear down. "Done" reaps.
         const cleanup = (kind, reason) => {
             clearTimeout(wall);
@@ -581,7 +426,6 @@ export default class Engine {
             this.#loopAborts.delete(loopId);
             this.#strikes.delete(loopId);
             this.searchGate.cleanup(loopId);
-            this.#hardOverflowRecovery.delete(loopId);
             this.#notices.delete(loopId);
         };
         while (true) {
@@ -649,7 +493,7 @@ export default class Engine {
                 turn = await observed(// {§observability-boundary}
                 "loop.turn", { workerId, "loop.id": loopId }, async (span) => {
                     const t = await this.runTurn({
-                        provider, messages, requirements, workspaceId, workerId, loopId, origin, signal, onDispatch,
+                        provider, childProvider, messages, requirements, workspaceId, workerId, loopId, origin, signal, onDispatch,
                         turnNumber: turnIds.length + 1, maxTurns,
                         invalidEmissionRecoveryEntryId,
                     });
@@ -698,25 +542,23 @@ export default class Engine {
                 return { turnIds, result, hitMaxTurns: false, reason: "invalid_emission" };
             }
             invalidEmissionRecoveryEntryId = null;
-            // SPEC {§grinder}: budget hard-stop — packet won't fit even collapsed → abandon.
-            if (turn.budgetHardStop) {
-                if (turn.budget === undefined) {
-                    throw new Error("a budget hard-stop requires its measured overflow");
+            // SPEC {§grinder}: the provider rejected the changed request for capacity.
+            if (turn.capacityHardStop) {
+                if (turn.capacityFailure === undefined) {
+                    throw new Error("a provider-capacity stop requires its exact failure");
                 }
-                const failure = BudgetOverflow.result(turn.budget.usage, turn.budget.ceiling, false);
-                const result = await this.#lifecycle.finish(loopId, failure);
+                const result = await this.#lifecycle.finish(loopId, turn.capacityFailure);
                 if (result === null)
-                    throw new Error(`loop ${loopId} became terminal before budget settlement`);
-                cleanup("forceful", "budget_overflow");
-                return { turnIds, result, hitMaxTurns: false, reason: "budget_overflow" };
+                    throw new Error(`loop ${loopId} became terminal before provider-capacity settlement`);
+                cleanup("forceful", "provider_capacity");
+                return { turnIds, result, hitMaxTurns: false, reason: "provider_capacity" };
             }
-            // {§engine-rails} — per-turn strike accounting (cycle detection, the
-            // grinder/steer coupling, hard operation outcomes). StrikeRail owns the
+            // {§engine-rails} — per-turn strike accounting (cycle detection,
+            // steer coupling, hard operation outcomes). StrikeRail owns the
             // bookkeeping; runLoop owns abandonment.
             const verdict = this.#strikes.assess(loopId, {
                 fingerprint: turn.fingerprint,
                 outcomes: turn.outcomes,
-                budgetStruck: turn.budgetStruck,
                 steerStruck: turn.steerStruck,
                 minCycles, maxCyclePeriod, maxStrikes,
             });
@@ -739,1148 +581,15 @@ export default class Engine {
             }
         }
     }
-    async runTurn({ provider, messages, requirements = "", workspaceId, workerId, loopId, origin = "model", signal, onDispatch, turnNumber = 1, maxTurns = 50, invalidEmissionRecoveryEntryId, }) {
-        const allowInvalidEmissionRecovery = invalidEmissionRecoveryEntryId === null;
-        const transientOpenLogEntryId = typeof invalidEmissionRecoveryEntryId === "number"
-            ? invalidEmissionRecoveryEntryId
-            : null;
-        // === Turn-as-container model ===
-        //
-        // Turn rows are created at runTurn OPEN (status=102, placeholder
-        // packet) so things can be written into the turn before the model
-        // is called: the user prompt on turn 1; later, system signals or
-        // injected Notices on any turn. The turn is CLOSED at
-        // the end with the final packet + status + usage stats.
-        //
-        // sequence is "ordinal of stuff in this turn." Pre-model
-        // writes consume low indices; model ops continue from there.
-        const seqRow = await this.#db.engine_next_turn_sequence.get({ loop_id: loopId });
-        const seq = seqRow.next;
-        // loops.sequence is the loop's ordinal within the worker. Turn-0 foists that belong to the
-        // WORKER (manifest preview, AGENTS, operator docs) gate on the worker's first loop, not every loop's
-        // first turn ({§actor-boundary-catalog-preview}); per-loop foists such as
-        // {§prompt-entry} still fire each loop. Read once, turn-1 only.
-        const loopRow = seq === 1
-            ? await this.#db.engine_get_loop_prompt.get({ loop_id: loopId })
-            : undefined;
-        const workerFirstLoop = (loopRow?.sequence ?? 0) === 1;
-        const openRow = await this.#db.engine_open_turn.get({
-            loop_id: loopId, sequence: seq,
-        });
-        if (openRow === undefined)
-            throw new Error("Engine.runTurn: turn open returned no row");
-        const turnId = openRow.id;
-        // {§env-delta-log-pull} — establish a fresh worker's observation
-        // baseline immediately after its first turn opens. A fork already has
-        // its parent's cursor, so the NULL-guarded statement leaves it intact.
-        // Events committed after this statement belong to this or a later
-        // closed pull window; pre-existing state is read through the ordinary
-        // shared-world projections in this first packet.
-        await this.#db.engine_initialize_ambient_cursor.get({ workspace_id: workspaceId, worker_id: workerId });
-        // Threaded per turn, never engine state, so concurrent loops on
-        // different providers each read their own honest tokenizer values.
-        const systemCtx = {
-            db: this.#db, workspaceId, workerId, loopId, turnId,
-            writer: "plurnk",
-            signal: this.#loopAborts.get(loopId)?.signal,
-            streamEventNotify: this.#streamEventNotify,
-            wakeWorkerNotify: this.#wakeWorkerNotify,
-            tokenize: this.#tokenize,
-            mimetypes: this.#mimetypes,
-            defaultChannelFor: (s) => this.#schemes.defaultChannelFor(s),
-            pushNotice: (notice) => this.#notices.push(workspaceId, loopId, notice),
-        };
-        // Pre-model writes. Each prompt the model has not seen yet becomes an
-        // actionless `prompt` log row whose target is its durable prompt:// entry:
-        //   - Turn 1: loop.prompt is the initial user prompt.
-        //   - Turn N>1: only if Engine.inject (or wake-on-completion via
-        //     daemon.inject) wrote a prompt entry for this turn slot
-        //     between turn N-1 and N. Inject writes directly to entries;
-        //     we DON'T re-foist here for N>1.
-        // Model ops dispatch after these pre-model rows.
-        let nextActionIndex = 1;
-        const turnOpenPaths = [];
-        // {§model-entry} — the worker's first turn opens with the model's own turn-0, mirrored OPEN: a
-        // worked turn PLAN → the environment FINDs the foist ACTUALLY dispatches → SEND[102]. Built
-        // from the real ops below (not a static print — we lean into the genuine echo paradigm) and
-        // written at sequence 1, so it reads first as the emission with the foisted results following.
-        const turnZeroMoves = [];
-        if (seq === 1) {
-            if (workerFirstLoop)
-                nextActionIndex = 2; // reserve sequence 1 for the turn-0 echo
-            // Operator doc READs (PLURNK_SERVICE_MD_<ALIAS>, {§actor-boundary-doc-injection}). The docs were materialized
-            // as worker://plurnk/<entry> entries by the plurnk worker (LoopDocs, via the
-            // {§actor-boundary} keystone); foist a READ of each into THIS turn-0 so the model
-            // reads them inline. It sees only the READ — the materializing EDIT
-            // lives in the plurnk worker's log, never the model's.
-            // {§operator-config-workspace-md-docs} — env docs union the workspace's client docs; foist a READ of
-            // each materialized worker://plurnk/<alias>.md (LoopDocs materialized the same set).
-            const { mdDocs } = await WorkspaceSettings.read(this.#db, workspaceId);
-            // {§actor-boundary-doc-injection} — operator docs appear on the worker's first loop.
-            for (const doc of workerFirstLoop ? await WorkspaceSettings.resolveDocs(mdDocs) : []) {
-                const docTarget = {
-                    kind: "url", raw: `worker://plurnk/${doc.entryName}`, scheme: "worker",
-                    username: null, password: null, hostname: "plurnk", port: null,
-                    pathname: `/${doc.entryName}`, query: null, fragment: null,
-                };
-                const docRead = {
-                    op: "READ", suffix: "", signal: null, target: docTarget,
-                    lineMarker: null, body: null, position: UNKNOWN_POSITION,
-                };
-                await this.dispatch({
-                    statement: docRead, workspaceId, workerId, loopId, turnId,
-                    sequence: nextActionIndex, origin: "plurnk", onDispatch,
-                });
-                nextActionIndex++;
-            }
-            const promptRow = loopRow; // {§prompt-entry} — per-loop; fires every loop's turn 1
-            if (promptRow !== undefined && typeof promptRow.prompt === "string" && promptRow.prompt.length > 0) {
-                const openPaths = assertOpenPaths(JSON.parse(promptRow.open_paths), `Loop ${loopId} open_paths`);
-                const promptLoopSeq = promptRow.sequence; // the loop's per-worker sequence — model-facing, matching log coordinates (owner: the db id read as prompt/2/1)
-                const promptPath = promptTarget(promptLoopSeq, seq);
-                const entry = {
-                    channels: { body: { content: promptRow.prompt, mimetype: "text/markdown" } },
-                    tags: [],
-                    attributes: { openPaths },
-                };
-                await EntryCrud.writeEntry(promptPath.pathname, entry, systemCtx, "prompt", workerId);
-                turnOpenPaths.push(...openPaths);
-                const promptLogId = await this.#writePromptLog({
-                    workerId,
-                    loopId,
-                    turnId,
-                    sequence: nextActionIndex,
-                    target: promptPath,
-                    content: promptRow.prompt,
-                });
-                onDispatch?.(promptLogId);
-                nextActionIndex++;
-            }
-        }
-        // {§prompt-loop-containment}: the loop contains every prompt that arrived
-        // while it ran. Publish each undelivered frame as a prompt row, oldest
-        // first, so rapid arrivals reach the model together exactly once.
-        {
-            const loopSeqRow = await this.#db.engine_loop_sequence.get({ loop_id: loopId });
-            const loopSeq = loopSeqRow?.sequence ?? loopId;
-            const prefix = promptLoopPrefix(loopSeq);
-            const undelivered = (await this.#db.drain_undelivered_prompts_for_loop.all({
-                owner_id: workerId,
-                pattern: `${prefix}%`,
-                prefix_len: prefix.length,
-                loop_id: loopId,
-            }))
-                .filter((r) => typeof r.content === "string" && r.content.length > 0);
-            for (const injectedRow of undelivered) {
-                const attributes = parsePromptAttributes(injectedRow.attributes, `Prompt ${injectedRow.pathname} attributes`);
-                const encodedOpenPaths = attributes.openPaths;
-                if (encodedOpenPaths !== undefined) {
-                    turnOpenPaths.push(...assertOpenPaths(encodedOpenPaths, `Prompt ${injectedRow.pathname} openPaths`));
-                }
-                const ordinal = Number(injectedRow.pathname.split("/").filter(Boolean).at(-1));
-                const injTarget = promptTarget(loopSeq, ordinal);
-                const promptLogId = await this.#writePromptLog({
-                    workerId,
-                    loopId,
-                    turnId,
-                    sequence: nextActionIndex,
-                    target: injTarget,
-                    content: injectedRow.content,
-                });
-                onDispatch?.(promptLogId);
-                nextActionIndex++;
-            }
-        }
-        // The persistent search-index pass (_search-index.maintain) attaches
-        // every readable entry/log projection to complete graph/FTS/vector derivations.
-        // NOT an action: no log entry, no sequence slot,
-        // not dispatched. There is no materialized manifest entry — the catalog
-        // is served on demand by FIND: recursive when asked, shallow-mapped below.
-        // {§semantic-embed-dedup} — one pass-wide semantic plan binds every
-        // chunk counter to the derivation identity it produces.
-        // SPEC {§membership} D4/D5 — git-ls-files workspace membership, resolved at
-        // prompt-composition (EMI is eager + exhaustive — git is the only bound). When the
-        // workspace's project_root is a git working tree, tracked files are
-        // members without a client `add`; active members are materialized
-        // (disk → body channel) so they appear in the catalog. No-ops
-        // on headless / non-git workspaces. Runs BEFORE the derivation pump so
-        // this turn's packet reflects them.
-        // Workspace creation starts this eagerly. Joining here is the correctness
-        // boundary: the model never runs against partial graph/vector coverage.
-        await this.#queueWorkspaceWarm(systemCtx, false);
-        // The warm materialized membership before deriving. This second pass is the
-        // ordinary cheap change detector and captures any drift that landed meanwhile.
-        const fsDivergences = await GitMembership.indexGitMembership(systemCtx);
-        // {§packet-git-status} — one post-reconciliation snapshot supplies both
-        // the compact packet summary and each causal file event's exact XY state.
-        const gitStatus = await GitState.status(this.#db, workspaceId, this.#loopAborts.get(loopId)?.signal);
-        await this.#logFsFictions(workspaceId, fsDivergences, gitStatus);
-        // The refresh above may have changed bodies (including model/client edits
-        // since the startup warm). Re-derive to completion before packet/model
-        // construction. Membership is already current, so this pass does not
-        // consume the filesystem divergences a second time.
-        await this.#queueWorkspaceWarm(systemCtx, true, false);
-        // Turn-0 catalog preview (PLURNK_SERVICE_FILES_ITEMS, {§actor-boundary-catalog-preview}):
-        // FIND surveys foisted into the worker's first model turn so it opens with its catalog.
-        // Folder-capable surfaces reveal one level with `*`; each deeper directory is an
-        // actionable `dir/**` aggregate. The curated kernel docs remain recursive, so the
-        // opening packet demonstrates both navigation forms. Empty results are orientation.
-        if (seq === 1) {
-            // {§operator-config-workspace-files-items} — workspace filesItems replaces the env default.
-            const { filesItems: workspaceMI } = await WorkspaceSettings.read(this.#db, workspaceId);
-            const filesItems = workspaceMI !== null ? normalizeFilesItems(workspaceMI) : readFilesItems();
-            if (filesItems !== null && workerFirstLoop) { // {§actor-boundary-catalog-preview} — once per worker
-                // engine_scheme_catalog_summary is the workspace-bounded scheme source: ordered,
-                // one row per stored entry scheme. log:// is absent —
-                // it lives in log_entries, not the catalog (present-mode, the # Log section).
-                const catalogSchemes = await this.#db.engine_scheme_catalog_summary.all({ workspace_id: workspaceId });
-                // Entry-bearing plugin schemes foist alongside the four structural surveys below.
-                const foistSchemes = catalogSchemes
-                    .filter((catalog) => catalog.scheme !== "prompt" && catalog.scheme !== "worker")
-                    .map(({ scheme, shallow_items }) => ({ scheme, shallow_items }));
-                // Commons + project files always foist. An empty result establishes that the
-                // surface exists and currently contains nothing.
-                foistSchemes.push({
-                    scheme: "worker",
-                    shallow_items: catalogSchemes.find((c) => c.scheme === "worker")?.shallow_items ?? 0,
-                });
-                if (!foistSchemes.some((c) => c.scheme === "file"))
-                    foistSchemes.push({ scheme: "file", shallow_items: 0 }); // Empty project surface still receives its orienting FIND.
-                for (const { scheme, shallow_items: shallowItems } of foistSchemes) {
-                    const isFile = scheme === "file";
-                    const pattern = this.#schemes.manifestFor(scheme)?.folderScopes === true ? "*" : "**";
-                    // Only the file map takes PLURNK_SERVICE_FILES_ITEMS as an explicit first-N
-                    // cap. Every other ordinary survey uses FIND's markerless first page.
-                    const cap = isFile && filesItems > 0 && shallowItems > 0 ? Math.min(filesItems, shallowItems) : null;
-                    const catalogMarker = cap === null ? null : { marks: [1, cap] };
-                    // The file survey foists as the BARE relative glob — the path shape plurnk.md
-                    // teaches (`*`, `src/**`, `**/notes.md`; bare = project-relative) — so the turn-0
-                    // exemplar and the log rows the model reads never train a leading-slash or
-                    // file:/// habit the rest of the teaching contradicts.
-                    const catalogFind = {
-                        op: "FIND", suffix: "", signal: null,
-                        target: isFile ? { kind: "local", raw: pattern } : {
-                            kind: "url",
-                            raw: `${scheme}:///${pattern}`,
-                            scheme,
-                            username: null, password: null, hostname: null, port: null,
-                            pathname: `/${pattern}`,
-                            query: null, fragment: null,
-                        },
-                        body: null,
-                        lineMarker: catalogMarker,
-                        position: UNKNOWN_POSITION,
-                    };
-                    await this.dispatch({
-                        statement: catalogFind, workspaceId, workerId, loopId, turnId,
-                        sequence: nextActionIndex, origin: "plurnk", onDispatch,
-                    });
-                    nextActionIndex++;
-                    // {§model-entry} — the same FIND, rendered back to DSL for the turn-0 echo
-                    // (the model's own survey, mirrored OPEN). An explicit file cap rides as
-                    // `<1,N>`; ordinary surveys teach the safe markerless default by example.
-                    const target = isFile ? pattern : `${scheme}:///${pattern}`;
-                    turnZeroMoves.push(`<<FIND(${target})${cap === null ? "" : `<1,${cap}>`}::FIND`);
-                }
-                // The kernel's self-documenting surface — FIND(worker://plurnk/docs/**), uncapped,
-                // always ({§schemes-directory}, published under {§entry-owner}).
-                await Owner.kernelId(this.#db, workspaceId); // the row exists even before docs materialize — the empty survey is orienting, never 404
-                const kernelDocsFind = {
-                    op: "FIND", suffix: "", signal: null,
-                    target: { kind: "url", raw: "worker://plurnk/docs/**", scheme: "worker", username: null, password: null, hostname: "plurnk", port: null, pathname: "/docs/**", query: null, fragment: null },
-                    body: null, lineMarker: { marks: [1, -1] }, position: UNKNOWN_POSITION,
-                };
-                await this.dispatch({ statement: kernelDocsFind, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
-                nextActionIndex++;
-                turnZeroMoves.push("<<FIND(worker://plurnk/docs/**)<1,-1>::FIND");
-                // {§worker-scheme} — the building worker's own scratch gets the same markerless
-                // one-level survey in its perspective alone. It always executes: an empty private
-                // space is useful orientation, not grounds to hide the surface.
-                const ownFind = {
-                    op: "FIND", suffix: "", signal: null,
-                    target: { kind: "url", raw: "worker://~/*", scheme: "worker", username: null, password: null, hostname: "~", port: null, pathname: "/*", query: null, fragment: null },
-                    body: null, lineMarker: null, position: UNKNOWN_POSITION,
-                };
-                await this.dispatch({ statement: ownFind, workspaceId, workerId, loopId, turnId, sequence: nextActionIndex, origin: "plurnk", onDispatch });
-                nextActionIndex++;
-                turnZeroMoves.push("<<FIND(worker://~/*)::FIND"); // {§model-entry} — the own-space survey, into the turn-0 echo
-            }
-            // {§model-entry} — mirror the model's turn-0 OPEN at sequence 1: PLAN → the FINDs actually
-            // foisted above (real, their results already in the log) → SEND[102]. Dynamic — it reflects
-            // the true survey, never a frozen print — and OPEN: the worked example the model orients on,
-            // so the grammar can stay thin. Subsequent turns mirror the model's real output, folded.
-            if (workerFirstLoop) {
-                const emission = ["<<PLAN:Survey context, then address the prompt.:PLAN", ...turnZeroMoves, "<<SEND[102]:Next, address the prompt using the survey.:SEND"].join("\n");
-                await this.#dispatcher.writeModelEntry({ verbatim: emission, workerId, loopId, turnId, sequence: 1, folded: false, origin: "plurnk" });
-            }
-        }
-        // {§methods-loop-run-open-paths}: selected workspace paths belong to
-        // the prompt frame. Publish the frame, then dispatch ordinary core READs
-        // in that same turn; missing/non-member paths retain their normal 4xx.
-        for (const raw of turnOpenPaths) {
-            const pathname = raw.startsWith("/") ? raw : `/${raw}`;
-            const fileRead = {
-                op: "READ", suffix: "", signal: null, lineMarker: null,
-                target: {
-                    kind: "url", raw: `file://${pathname}`, scheme: "file",
-                    username: null, password: null, hostname: null, port: null,
-                    pathname, query: null, fragment: null,
-                },
-                body: null, position: UNKNOWN_POSITION,
-            };
-            await this.dispatch({
-                statement: fileRead, workspaceId, workerId, loopId, turnId,
-                sequence: nextActionIndex, origin: "plurnk", onDispatch,
-            });
-            nextActionIndex++;
-        }
-        // {§env-delta-log-pull} — materialize ambient observations before packet
-        // composition and reserve their action indices. {§exec-stream} owns the
-        // distinct byte-cursor path for this worker's streams.
-        // {§exec-poll} — EXEC `<0>` is turn-scoped: reap the worker's open turn-scoped streams (necessarily
-        // from a prior turn — this runs before the turn's own spawns) so a `<0>` never survives into
-        // the subsequent turn. The terminal output then surfaces born-OPEN via the stream-delta path.
-        await this.#reapTurnScopedStreams(workerId);
-        nextActionIndex += await this.#materializeEnvironmentDeltas({ workspaceId, workerId, loopId, turnId, fromSequence: nextActionIndex });
-        nextActionIndex += await this.#materializeStreamDeltas({ workerId, loopId, turnId, fromSequence: nextActionIndex });
-        // The post-reconciliation Git snapshot above is threaded into the packet
-        // and every budget rebuild; overflow never shells again.
-        // Notices are non-terminal observations, never operation-failure truth.
-        // Drain once and thread the same set through every grinder rebuild.
-        const notices = this.#notices.drain(loopId)
-            .filter((event) => event.level !== "info");
-        // Build the model request packet ({§packet-stored-shape}). The log build
-        // queries log_entries scoped to the worker — the prompt entry just
-        // written (if turn 1) is part of that query result.
-        let requestPacket = await this.#packets.buildRequestPacket({
-            initialMessages: messages, requirements, workspaceId, workerId, loopId,
-            currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
-        });
-        // SPEC {§grinder} — budget grinder, pre-LLM: reclaim window on actual overflow.
-        const enforced = await this.#packets.enforceBudget({
-            packet: requestPacket, provider, workerId, loopId, turnId,
-            // The overflow error row is minted at the turn's running sequence (nextActionIndex), pre-generate;
-            // runTurn advances the counter past it below so the post-generate dispatch rows never collide.
-            mintSequence: nextActionIndex,
-            // Rebuilds re-derive durable errors and retain the one drained notice
-            // set; neither path can duplicate or swallow a product failure.
-            rebuild: () => this.#packets.buildRequestPacket({
-                initialMessages: messages, requirements, workspaceId, workerId, loopId,
-                currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
-            }),
-        });
-        if (enforced.recorded)
-            nextActionIndex += 1; // a fold-to-fit Problem consumed the reserved sequence
-        requestPacket = enforced.packet;
-        if (!enforced.fit) {
-            // {§grinder-hard-413-recovery}/{§grinder-hard-413-abort} — admit
-            // one physically sendable informed recovery turn; a physical
-            // overflow or consecutive policy overflow terminates immediately.
-            let physicalAdmission = await this.#packets.physicalAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
-            let recoveryAdmitted = false;
-            if (physicalAdmission.admitted && !this.#hardOverflowRecovery.has(loopId)) {
-                const ceiling = this.#packets.ceilingFor(provider);
-                if (ceiling === null) {
-                    throw new Error("an unbounded prompt budget cannot enter budget recovery");
-                }
-                await this.#problems.record({
-                    workerId,
-                    loopId,
-                    turnId,
-                    sequence: nextActionIndex++,
-                    origin: "model",
-                    source: "engine",
-                    result: BudgetOverflow.result(requestPacket.tokens, ceiling, true),
-                });
-                // Rebuild so the recovery-steer row just minted renders in THIS packet's log +
-                // errors sections (the same re-derive contract the soft grind uses).
-                requestPacket = await this.#packets.buildRequestPacket({
-                    initialMessages: messages, requirements, workspaceId, workerId, loopId,
-                    currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
-                });
-                physicalAdmission = await this.#packets.physicalAdmission(requestPacket, provider, this.#loopAborts.get(loopId)?.signal);
-                if (physicalAdmission.admitted) {
-                    this.#hardOverflowRecovery.add(loopId);
-                    recoveryAdmitted = true;
-                }
-            }
-            if (!recoveryAdmitted) {
-                // Hard 413: physically unsendable, or still over after the informed recovery turn.
-                const ceiling = this.#packets.ceilingFor(provider);
-                if (ceiling === null) {
-                    throw new Error("an unbounded prompt budget cannot hard-stop");
-                }
-                if (!enforced.recorded || !physicalAdmission.admitted) {
-                    await this.#problems.record({
-                        workerId,
-                        loopId,
-                        turnId,
-                        sequence: nextActionIndex++,
-                        origin: "plurnk",
-                        source: "engine",
-                        result: BudgetOverflow.result(requestPacket.tokens, ceiling, false, physicalAdmission.admitted
-                            ? undefined
-                            : {
-                                reason: physicalAdmission.reason,
-                                detail: physicalAdmission.detail,
-                                capacity: physicalAdmission.capacity,
-                                tokens: physicalAdmission.measurement?.tokens,
-                                tokenKind: physicalAdmission.measurement?.kind,
-                                tokenSource: physicalAdmission.measurement?.source,
-                            }),
-                    });
-                    requestPacket = await this.#packets.buildRequestPacket({
-                        initialMessages: messages, requirements, workspaceId, workerId, loopId,
-                        currentTurnSeq: seq, provider, gitStatus, notices, transientOpenLogEntryId,
-                    });
-                }
-                // Skip the LLM, close the turn, and let runLoop abandon.
-                await this.#db.engine_close_turn.run({
-                    id: turnId, status: 413, packet: StoredPacket.stringify(requestPacket),
-                    // The attempted turn retains its effective allowance even
-                    // when no provider exchange completed. {§tokenomics-client-gauge}
-                    usage_prompt_budget: this.#packets.promptBudgetFor(provider),
-                    finish_reason: "budget_hard_stop", model: provider.model, meta: "{}",
-                });
-                return {
-                    turnId,
-                    status: 413,
-                    outcomes: [],
-                    fingerprint: "",
-                    budgetStruck: enforced.struck,
-                    budgetHardStop: true,
-                    steerStruck: false,
-                    emissionAttempts: 0,
-                    emissionExhausted: false,
-                    budget: BudgetOverflow.measure(requestPacket.tokens, ceiling),
-                };
-            }
-        }
-        else {
-            // A fitting turn clears the recovery grant; a later independent overflow can earn
-            // a fresh recovery turn (chronic overflow still strikes out via the rail).
-            this.#hardOverflowRecovery.delete(loopId);
-        }
-        const modelMessages = PacketWire.packetToWireMessages(requestPacket);
-        // Packet pressure and provider generation are independent. The grinder governs
-        // only the request packet; maxTokens comes only from the provider envelope and
-        // never shrinks as the virtual prompt budget fills.
-        let response;
-        let splitResponse;
-        let railGrammar;
-        let railEvidence;
-        let emissionAttempts = 0;
-        let providerCallInFlight = false;
-        let providerAttemptSequence = 0;
-        let providerAttemptId = null;
-        let providerAttemptAttributions = [];
-        const providerSignal = this.#loopAborts.get(loopId)?.signal ?? signal;
-        // {§client-metadata}
-        const { client } = await WorkspaceSettings.read(this.#db, workspaceId);
-        const observeProviderAttempt = async (id, attemptResponse) => {
-            const attemptUsage = attemptResponse.assistant.usage;
-            await this.#db.engine_observe_turn_attempt_response.run({
-                id,
-                response: JSON.stringify(attemptResponse),
-                usage_prompt: attemptUsage.prompt,
-                usage_completion: attemptUsage.completion,
-                usage_reasoning: attemptUsage.reasoning,
-                usage_cached: attemptUsage.cached,
-                usage_cost: JSON.stringify({
-                    kind: "unknown",
-                    reason: "provider response retained before monetary classification",
-                }),
-                finish_reason: attemptResponse.assistant.finishReason,
-                model: attemptResponse.assistant.model,
-            });
-        };
-        const classifyProviderAttempt = async (id, attemptResponse, attemptSplit, sequence, accepted, failure = null) => {
-            const attemptUsage = attemptSplit.callMetadata.usage;
-            const attemptCost = providerCostFor(provider, attemptUsage, attemptResponse.charge);
-            const attemptCostUsd = providerCostUsd(attemptCost);
-            await this.#db.engine_classify_turn_attempt_response.run({
-                id,
-                accepted: accepted ? 1 : 0,
-                parse_errors: JSON.stringify(attemptSplit.parseErrors),
-                failure: failure === null ? null : JSON.stringify(failure),
-                usage_cost: JSON.stringify(attemptCost),
-                usage_cost_usd: attemptCostUsd,
-            });
-            emissionAttempts = sequence;
-        };
-        try {
-            // {§turn-lifecycle}: bracket the complete provider-attempt window with liveness notices.
-            if (!signal?.aborted)
-                this.#notices.push(workspaceId, loopId, { source: "engine:turn", kind: "turn_awaiting_model", level: "info", message: "awaiting model response" });
-            const loopSeq = (await this.#db.engine_loop_sequence.get({ loop_id: loopId }))?.sequence ?? loopId;
-            railGrammar = await this.#grammarConstraint(provider);
-            const primaryWorkerId = String(await this.resolveWorkerPrimary(workerId));
-            const attemptLimit = readEmissionAttempts();
-            const maxTokens = this.#packets.maxTokensFor(provider) ?? undefined;
-            const strikeStreak = this.#strikes.streak(loopId);
-            for (let attempt = 1; attempt <= attemptLimit; attempt++) {
-                // Every attempt carries the exact same model packet, coordinates,
-                // limits, and engine-strike state. Plugin-authored tags are pulled
-                // for the attempt and do not alter the model messages. No failed
-                // emission is appended and no new engine turn opens between calls.
-                providerAttemptSequence = attempt;
-                const attributionContext = Object.freeze({
-                    workspaceId: String(workspaceId),
-                    workerId: String(workerId),
-                    primaryWorkerId,
-                    loop: loopSeq,
-                    turn: seq,
-                    attempt,
-                });
-                providerAttemptAttributions = await this.#attemptAttributions(provider, attributionContext);
-                requestPacket = { ...requestPacket, attributions: providerAttemptAttributions };
-                const attemptRow = await this.#db.engine_open_turn_attempt.get({
-                    turn_id: turnId,
-                    sequence: attempt,
-                    attributions: JSON.stringify(providerAttemptAttributions),
-                    model: provider.model,
-                });
-                if (attemptRow === undefined) {
-                    throw new Error(`Engine.runTurn: provider attempt ${attempt} did not open`);
-                }
-                providerAttemptId = attemptRow.id;
-                providerCallInFlight = true;
-                const completedResponse = await observed(// {§observability-boundary}
-                "provider.generate", { model: provider.model, attempt }, async (span) => {
-                    const generated = await provider.generate({
-                        messages: modelMessages,
-                        workerId: String(workerId),
-                        primaryWorkerId,
-                        signal: providerSignal,
-                        grammar: railGrammar,
-                        maxTokens,
-                        strikes: strikeStreak,
-                        attributions: providerAttemptAttributions.length > 0
-                            ? providerAttemptAttributions
-                            : undefined,
-                        client: client ?? undefined,
-                        workspaceId: String(workspaceId),
-                        loop: loopSeq,
-                        turn: seq,
-                    }); // {§provider-surface-generate} {§provider-guarantees-signal-wired} {§provider-guarantees-serial-attempts} {§attribution} {§client-metadata}
-                    providerCallInFlight = false;
-                    recordCounter(PROVIDER_CALLS, {
-                        model: provider.model,
-                        attempt,
-                        status: "resolved",
-                    });
-                    span.setAttribute("status", "resolved");
-                    return generated;
-                });
-                response = completedResponse;
-                await observeProviderAttempt(attemptRow.id, completedResponse);
-                railEvidence = railGrammar === undefined
-                    ? undefined
-                    : Engine.#requireGrammarEvidence(completedResponse);
-                splitResponse = this.#splitResponse(completedResponse);
-                await classifyProviderAttempt(attemptRow.id, completedResponse, splitResponse, attempt, splitResponse.emissionValid);
-                if (splitResponse.emissionValid)
-                    break;
-            }
-            if (!signal?.aborted)
-                this.#notices.push(workspaceId, loopId, { source: "engine:turn", kind: "turn_generated", level: "info", message: "parsing model response" });
-        }
-        catch (err) {
-            // This handler owns only provider-call failures. Parser, cost, SQL,
-            // and engine-contract failures retain their original source.
-            if (!providerCallInFlight)
-                throw err;
-            providerCallInFlight = false;
-            if (providerAttemptId === null) {
-                throw new Error("provider call failed without a durable attempt identity", { cause: err });
-            }
-            const failure = err instanceof ProviderError
-                ? { status: err.problem.status, problem: err.problem }
-                : providerSignal?.aborted === true
-                    ? Results.failure("engine:provider", providerSignal.reason === LOOP_TIMEOUT_REASON ? "provider-call-timeout" : "provider-call-cancelled", providerSignal.reason === LOOP_TIMEOUT_REASON ? 504 : 499, providerSignal.reason === LOOP_TIMEOUT_REASON
-                        ? "The provider call was interrupted by the loop deadline."
-                        : "The provider call was interrupted by loop cancellation.", {}, { stage: "provider-request", retryable: false })
-                    : (() => {
-                        console.error("Provider failed outside its Problem Details contract:", err);
-                        return Results.failure("engine:provider", "provider-contract-violation", 502, "The provider failed without returning its required Problem Details.", {}, {
-                            stage: "provider-request",
-                            retryable: false,
-                        });
-                    })();
-            // {§provider-interrupted-attempt} — a provider-declared interruption
-            // carries response evidence without becoming a completed exchange.
-            // Persist it as an unaccepted attempt before settling the failure.
-            if (err instanceof ProviderError && err.attempt !== undefined) {
-                response = err.attempt;
-                await observeProviderAttempt(providerAttemptId, response);
-                splitResponse = this.#splitResponse(response);
-                await classifyProviderAttempt(providerAttemptId, response, splitResponse, providerAttemptSequence, false, failure);
-            }
-            else {
-                const unknownCost = {
-                    kind: "unknown",
-                    reason: "provider call failed without response-bearing charge evidence",
-                };
-                await this.#db.engine_fail_turn_attempt.run({
-                    id: providerAttemptId,
-                    failure: JSON.stringify(failure),
-                    usage_cost: JSON.stringify(unknownCost),
-                });
-                emissionAttempts = providerAttemptSequence;
-            }
-            // {§turn-never-blank} — a ProviderError means no completed exchange exists.
-            // Persist its exact RFC 9457 result before propagating it. Grammar evidence
-            // and its engine-owned verdict exist only on completed responses
-            // ({§rail-truth-engine-verdict}). Cancellation is lifecycle truth, not a
-            // provider failure. Close the
-            // attempted turn without inventing an assistant response, then let
-            // runLoop/Daemon settle the exact 504/499 loop result.
-            if (providerSignal?.aborted) {
-                await this.#db.engine_close_turn.run({
-                    id: turnId,
-                    status: providerSignal.reason === LOOP_TIMEOUT_REASON ? 504 : 499,
-                    packet: StoredPacket.stringify(requestPacket),
-                    usage_prompt_budget: this.#packets.promptBudgetFor(provider),
-                    finish_reason: splitResponse?.callMetadata.finishReason ?? null,
-                    model: splitResponse?.callMetadata.model ?? provider.model,
-                    meta: JSON.stringify(response?.meta ?? {}),
-                });
-                throw err;
-            }
-            const recorded = await this.#problems.record({
-                workerId,
-                loopId,
-                turnId,
-                sequence: nextActionIndex,
-                origin: "plurnk",
-                source: "provider",
-                result: failure,
-            });
-            // The provider call was attempted, but no completed exchange exists.
-            // Persist the exact request half and failure status; omitting assistant
-            // is materially different from fabricating an empty model turn.
-            await this.#db.engine_close_turn.run({
-                id: turnId,
-                status: recorded.result.status,
-                packet: StoredPacket.stringify(requestPacket),
-                usage_prompt_budget: this.#packets.promptBudgetFor(provider),
-                finish_reason: splitResponse?.callMetadata.finishReason ?? null,
-                model: splitResponse?.callMetadata.model ?? provider.model,
-                meta: JSON.stringify(response?.meta ?? {}),
-            });
-            throw new OperationFailureError(recorded.result, { cause: err });
-        }
-        if (response === undefined || splitResponse === undefined) {
-            throw new Error("provider attempt loop completed without a response");
-        }
-        if (!splitResponse.emissionValid) {
-            // {§invalid-emission-attempts} The first consecutive exhaustion
-            // publishes only the raw final response and generic recovery fact.
-            let rejectedModelEntryId;
-            if (allowInvalidEmissionRecovery) {
-                rejectedModelEntryId = await this.#dispatcher.writeModelEntry({
-                    verbatim: splitResponse.packetAssistant.content,
-                    workerId,
-                    loopId,
-                    turnId,
-                    sequence: nextActionIndex,
-                    folded: true,
-                    admission: "rejected",
-                });
-                this.#notices.push(workspaceId, loopId, {
-                    source: "engine:grammar",
-                    kind: "invalid_emission",
-                    level: "error",
-                    message: INVALID_EMISSION_RECOVERY_MESSAGE,
-                });
-            }
-            await this.#db.engine_close_turn.run({
-                id: turnId,
-                status: allowInvalidEmissionRecovery ? TURN_STATUS_IMPLICIT_CONTINUE : 500,
-                packet: StoredPacket.stringify(requestPacket),
-                usage_prompt_budget: this.#packets.promptBudgetFor(provider),
-                finish_reason: splitResponse.callMetadata.finishReason,
-                model: splitResponse.callMetadata.model,
-                meta: JSON.stringify(response.meta ?? {}),
-            });
-            return {
-                turnId,
-                status: allowInvalidEmissionRecovery ? TURN_STATUS_IMPLICIT_CONTINUE : 500,
-                outcomes: [],
-                fingerprint: "",
-                budgetStruck: enforced.struck,
-                budgetHardStop: false,
-                steerStruck: false,
-                emissionAttempts,
-                emissionExhausted: true,
-                ...(rejectedModelEntryId === undefined ? {} : { rejectedModelEntryId }),
-            };
-        }
-        // {§packet-stored-shape} — admitted emission data extends the packet;
-        // provider-call metadata remains on the Turn row.
-        const { packetAssistant, callMetadata, parseNotices, recoverableParseErrors, } = splitResponse; // raw assistant content is opaque — split, never interpreted — {§provider-guarantees-assistantraw-opaque}
-        for (const notice of parseNotices) {
-            this.#notices.push(workspaceId, loopId, notice);
-        }
-        // Non-fatal provider transport notices on an accepted turn. Forward each
-        // Notice with a content-offset `line:col`;
-        // the model resolves it against its own emission — READ the folded model-emission row at the
-        // cited lines ({§model-entry}) — not an embedded snippet that would duplicate the emission.
-        for (const notice of response.notices ?? []) {
-            const located = typeof notice.position === "number"
-                ? this.#offsetToLineColumn(packetAssistant.content, notice.position)
-                : null;
-            this.#notices.push(workspaceId, loopId, {
-                source: notice.source,
-                kind: notice.kind,
-                message: notice.message ?? "",
-                level: notice.level,
-                ...(located !== null
-                    ? { position: { type: "content-offset", line: located.line, column: located.column } }
-                    : {}),
-            });
-        }
-        // Grade configured local evidence independently. Endpoint-owned
-        // constraints remain provider observations. {§rail-truth-engine-verdict}
-        let railKeys;
-        if (railGrammar !== undefined) {
-            if (railEvidence === undefined)
-                throw new Error("configured GBNF response has no final grammar evidence");
-            let verdict = null;
-            try {
-                verdict = validateGbnf(railGrammar, railEvidence.input);
-            }
-            catch (cause) {
-                Engine.#warnRailVerdictGapOnce(cause.message);
-            }
-            railKeys = {
-                railsAttached: railEvidence.transported ? "client" : "withheld",
-                railsVerdict: verdict?.status ?? "unverifiable",
-            };
-            if (verdict !== null && verdict.status !== "accept") {
-                const contentPosition = verdict.pos >= railEvidence.contentStart
-                    ? verdict.pos - railEvidence.contentStart
-                    : null;
-                const located = contentPosition === null
-                    ? null
-                    : this.#offsetToLineColumn(packetAssistant.content, contentPosition);
-                this.#notices.push(workspaceId, loopId, {
-                    source: "engine:rails",
-                    kind: "grammar_unenforced",
-                    message: verdict.status === "reject"
-                        ? `emission rejects the grammar at raw code point ${verdict.pos}`
-                        : `emission is an incomplete grammar sentence (ends at raw code point ${verdict.pos})`,
-                    level: "warn",
-                    ...(located === null
-                        ? {}
-                        : { position: { type: "content-offset", line: located.line, column: located.column } }),
-                });
-            }
-        }
-        const opsCount = packetAssistant.ops.length;
-        const finalOp = packetAssistant.ops.at(-1);
-        if (finalOp?.op !== "SEND") {
-            // Text emissions cannot reach this point without a disposition;
-            // this fail-hard guard also keeps Mock's trusted pre-parsed seam
-            // from creating runtime states that production admission forbids.
-            throw new Error("an admitted emission must end in a disposition SEND");
-        }
-        const dispositionSignal = finalOp.signal;
-        if (typeof dispositionSignal !== "number" || !TERMINAL_SEND_SIGNALS.has(dispositionSignal)) {
-            throw new Error("an admitted emission must end in a disposition SEND");
-        }
-        const sendOp = finalOp;
-        // {§send} the terminal contract — engine error states verify a terminal claim against loop
-        // state, never trusting the model's code. They strike via turn.steerStruck
-        // ({§engine-rails}): the loop continues, the model sees the steering hint not the strike
-        // count, and a non-resolver spins out to the engine's 500.
-        let steerStruck = false;
-        // Engine errors raised this turn, minted as op='error' log rows after dispatch (they share the
-        // post-dispatch sequence counter). {§operation-result-uniform-error-channel}
-        const pendingEngineErrors = [];
-        // Terminal adjudication moved to the DISPATCHER ({§send-premature-terminate}, the unified
-        // pending set): the terminal SEND is judged AT ITS OWN DISPATCH — after the emission's
-        // earlier ops executed — so a same-turn KILL+[200] repairs in one turn and a same-turn
-        // WORK+[200] is caught. A refused final disposition (409) strikes via
-        // the dispatch-loop check below.
-        let turnStatus = dispositionSignal;
-        // Idle turn: an implicit-continue (102) that did no WORK — its ops are only PLAN/SEND, no mid op.
-        // The model continued with nothing to do.
-        const midOpsCount = packetAssistant.ops.filter((op) => op.op !== "PLAN" && op.op !== "SEND").length
-            + recoverableParseErrors.length;
-        if (!steerStruck && turnStatus === TURN_STATUS_IMPLICIT_CONTINUE && midOpsCount === 0) {
-            steerStruck = true;
-            pendingEngineErrors.push("idle_turn");
-        }
-        // Close the turn with the final packet, status, and usage stats.
-        const packet = StoredPacket.admit(requestPacket, packetAssistant, response.assistantRaw);
-        await this.#db.engine_close_turn.run({
-            id: turnId,
-            status: turnStatus,
-            packet: StoredPacket.stringify(packet),
-            usage_prompt_budget: this.#packets.promptBudgetFor(provider), // {§tokenomics-client-gauge}
-            finish_reason: callMetadata.finishReason,
-            model: callMetadata.model,
-            // Opaque provider metadata plus engine-authored rail keys.
-            // {§meta-passthrough}, {§rail-truth-engine-verdict}
-            meta: JSON.stringify({ ...(response.meta ?? {}), ...(railKeys ?? {}) }),
-        });
-        // Dispatch model ops starting at nextActionIndex (continues the
-        // turn's running counter after any pre-model writes).
-        //
-        // Max-commands ceiling: OFF by default (unlimited) — every generated op dispatches.
-        // A degenerate op-loop is a sampler failure guarded at generation, not by dropping
-        // already-generated work post-hoc. The ceiling is an OPT-IN operator/client bound:
-        // when set, overflow ops drop without per-op log entries (no forensics flood) and the
-        // model gets one notices signal next packet.
-        // {§operator-config-workspace-max-commands} — workspace maxCommands min()s the env ceiling.
-        const maxCommands = Math.min(readMaxCommands(), (await WorkspaceSettings.read(this.#db, workspaceId)).maxCommands ?? Number.POSITIVE_INFINITY);
-        // PLAN (intended goals) and the final disposition SEND are not actions —
-        // they always dispatch and never count against the cap. maxCommands
-        // bounds real actions only; maxCommands:0 still admits a plan and a disposition
-        // (the PLAN/SEND ops, zero actions), which is its only coherent meaning.
-        let realCommands = 0;
-        const admittedOps = packetAssistant.ops.filter((op) => {
-            return op.op === "PLAN"
-                || op === sendOp
-                || realCommands++ < maxCommands;
-        });
-        const opsToDispatch = scheduleTurnOps(admittedOps);
-        await this.#dispatcher.prepareEditBatches(opsToDispatch.filter((statement) => statement.op === "EDIT"), {
-            workspaceId, workerId, loopId, turnId,
-            origin, onDispatch,
-        });
-        const droppedCount = opsCount - opsToDispatch.length;
-        const outcomes = [];
-        // Running counter — a multi-file READ writes N rows from one statement (rowsWritten),
-        // so the next op's sequence picks up after them. Collapses to nextActionIndex+i when
-        // every op writes one row (the common case).
-        let rowSeq = nextActionIndex;
-        let parseErrorsRecorded = false;
-        const recordRecoverableParseErrors = async () => {
-            if (parseErrorsRecorded)
-                return;
-            parseErrorsRecorded = true;
-            for (const error of recoverableParseErrors) {
-                const recorded = await this.#problems.record({
-                    workerId,
-                    loopId,
-                    turnId,
-                    sequence: rowSeq++,
-                    origin: "model",
-                    source: "grammar",
-                    result: Results.failure("grammar:parser", "invalid-operation-syntax", 400, error.message, {}, {
-                        line: error.line,
-                        column: error.column,
-                        source: error.source,
-                        stage: "parse",
-                        recovery: "Correct only the failed operation; sibling operations were retained.",
-                        retryable: false,
-                    }),
-                });
-                outcomes.push({ op: null, status: recorded.result.status });
-                onDispatch?.(recorded.id);
-            }
-        };
-        for (const statement of opsToDispatch) {
-            if (statement.op === "SEND"
-                && typeof statement.signal === "number"
-                && TERMINAL_SEND_SIGNALS.has(statement.signal)) {
-                await recordRecoverableParseErrors();
-                // {§worker-optimistic-settlement} — SEND judges the refreshed
-                // lifecycle after this turn's own fast streams receive one
-                // bounded opportunity to conclude. This is not a sleep and
-                // does not delay a later turn for older monitored streams.
-                const execHandler = this.#schemes.get("exec");
-                await execHandler?.settleTurnSpawns?.(workerId, turnId, readOptimisticSettlementMs(), providerSignal);
-            }
-            const result = await observed(// {§observability-boundary}
-            "op.dispatch", { op: statement.op }, async (span) => {
-                const dispatchResult = await this.#dispatcher.dispatch({
-                    statement, workspaceId, workerId, loopId, turnId,
-                    sequence: rowSeq,
-                    origin, onDispatch,
-                });
-                span.setAttribute("status", dispatchResult.status);
-                recordCounter(OPS_DISPATCHED, { op: statement.op, status: dispatchResult.status });
-                return dispatchResult;
-            });
-            outcomes.push({ op: statement.op, status: result.status });
-            for (const normalization of result.scopeNormalizations ?? []) {
-                this.#notices.push(workspaceId, loopId, {
-                    source: "engine:slicer",
-                    kind: "scope_normalized",
-                    level: "warn",
-                    message: `Scope <${normalization.requested.join(",")}> was normalized to <${normalization.canonical.join(",")}>.`,
-                });
-            }
-            // {§engine-rails} — a refused final disposition leaves both loop
-            // and turn continuing, and its 409 steering ruling strikes once.
-            if (statement === sendOp && result.status === 409) {
-                steerStruck = true;
-                turnStatus = TURN_STATUS_IMPLICIT_CONTINUE;
-                await this.#db.engine_reconcile_turn_status.run({ id: turnId, status: turnStatus });
-            }
-            // {§send-300-choices}: a question resolves through the proposal system; whatever the
-            // resolution (answer/reject/timeout), the LOOP continues to the turn where the model
-            // reads it; the turn record is a continue, never a 300 terminal.
-            if (statement === sendOp && sendOp.signal === 300 && result.status !== 409) {
-                turnStatus = TURN_STATUS_IMPLICIT_CONTINUE;
-                await this.#db.engine_reconcile_turn_status.run({ id: turnId, status: turnStatus });
-            }
-            // A broadcast [202] is a conditional wait, not an unconditional turn status:
-            // live work parks at 202; completed-but-unobserved work continues at 102; an
-            // empty join completes at 200. Persist and return the dispatcher's actual ruling.
-            if (statement === sendOp
-                && result.status !== 409
-                && sendOp.target === null
-                && sendOp.signal === 202
-                && result.status !== 202) {
-                turnStatus = result.status;
-                await this.#db.engine_reconcile_turn_status.run({ id: turnId, status: turnStatus });
-            }
-            rowSeq += result.rowsWritten ?? 1;
-        }
-        await recordRecoverableParseErrors();
-        // Engine rail failures mint as op='error' log rows at the turn's next
-        // free sequence. Bounded syntax failures were recorded in their
-        // authored turn before its terminal disposition.
-        let errSeq = rowSeq;
-        // max_commands_exceeded IS model-facing: dropped ops the model emitted that didn't run.
-        if (droppedCount > 0)
-            pendingEngineErrors.push("max_commands_exceeded");
-        for (const kind of pendingEngineErrors) {
-            const problem = ENGINE_PROBLEMS[kind];
-            const extensions = kind === "max_commands_exceeded"
-                ? {
-                    operationLimit: maxCommands,
-                    omittedOperations: droppedCount,
-                    stage: "dispatch-admission",
-                    recovery: "Continue with no more than the configured operation limit.",
-                    retryable: false,
-                }
-                : {
-                    stage: "turn",
-                    recovery: "Perform an operation before continuing with SEND[102].",
-                    retryable: false,
-                };
-            await this.#problems.record({
-                workerId,
-                loopId,
-                turnId,
-                sequence: errSeq++,
-                origin: "plurnk",
-                source: "rail",
-                result: Results.failure("engine:rail", problem.code, problem.status, problem.detail, {}, extensions),
-            });
-        }
-        // {§log-row-self-explains} — model-operation failures remain on their
-        // own rows; genuine engine faults fail hard and mint no substitute row.
-        // {§model-entry} — mirror this turn's verbatim emission back as a `model` row, so the NEXT
-        // packet shows the model exactly what it last produced. ALWAYS born FOLDED — the old
-        // born-OPEN-on-error auto-trigger was conditional helpfulness that bred its own hazards
-        // (a 24k-char ramble mirrored open re-injects itself into the next packet: cost,
-        // contamination, pressure feedback).
-        // {§encrypted-reasoning-carrier} — core relays every provider-normalized
-        // item unchanged.
-        const reasoningItems = response.assistant.reasoningEncrypted?.length
-            ? response.assistant.reasoningEncrypted
-            : undefined;
-        if (packetAssistant.content.trim().length > 0 || reasoningItems !== undefined) {
-            await this.#dispatcher.writeModelEntry({ verbatim: packetAssistant.content, workerId, loopId, turnId, sequence: errSeq++, folded: true, ...(reasoningItems !== undefined ? { reasoningItems } : {}) });
-        }
-        return {
-            turnId,
-            status: turnStatus,
-            outcomes,
-            fingerprint: StrikeRail.fingerprintTurn(packetAssistant.ops),
-            budgetStruck: enforced.struck,
-            budgetHardStop: false,
-            steerStruck,
-            emissionAttempts,
-            emissionExhausted: false,
-        };
-    }
-    // Split the wire-level ProviderResponse into the two destinations:
-    // packet.assistant gets the model's emission (content, ops, reasoning);
-    // Turn columns get the call-metadata (usage, finishReason, model).
-    // {§provider-surface} Text-fragment scraping policy lives
-    // here — engine owns the parse and the scraping rule, providers stay
-    // grammar-unaware.
-    //
-    // Test-fixture escape hatch: the Mock provider may pre-supply `ops` on
-    // its assistant payload to skip the parse roundtrip. The wire Provider
-    // contract has no `ops` field; only Mock exposes one. Real providers
-    // always take the parse path because their `assistant.ops` is undefined.
-    #splitResponse(response) {
-        const { assistant } = response;
-        const preParsedOps = assistant.ops;
-        const ops = [];
-        // PLAN is an ordinary op — emitted by the model, dispatched, and passed to the
-        // client as a log entry. No special hoisting into the reasoning field. Only
-        // structured operations are executable; interstitial text is not an operation.
-        // Full PlurnkParseError context is preserved on rejected attempt evidence;
-        // warnings remain admissible Notices. {§parse-diagnostics}
-        const parseErrors = [];
-        let hasUnparsedTail = false;
-        const parseNotices = [];
-        if (preParsedOps !== undefined) {
-            ops.push(...preParsedOps);
-        }
-        else {
-            // {§observability-boundary} — the parse is observed without its input;
-            // only the resulting statement count is attributable.
-            const parsed = observedSync("contracts.parse", {}, (span) => {
-                const result = PlurnkParser.parse(assistant.content);
-                span.setAttribute("statements", result.items.filter((item) => item.kind === "statement").length);
-                return result;
-            });
-            for (const item of parsed.items) {
-                if (item.kind === "statement") {
-                    ops.push(item.statement);
-                }
-                else if (item.kind === "error") {
-                    const err = item.error;
-                    if (err instanceof PlurnkParseError) {
-                        if (err.severity === "warning") {
-                            parseNotices.push({
-                                source: "grammar",
-                                kind: "parse_advisory",
-                                level: "warn",
-                                message: err.message,
-                                position: {
-                                    type: "content-offset",
-                                    line: err.line,
-                                    column: err.column,
-                                },
-                                parserSource: err.source,
-                            });
-                        }
-                        else {
-                            parseErrors.push({ message: err.message, line: err.line, column: err.column, source: err.source });
-                        }
-                    }
-                    else {
-                        const msg = err?.message ?? "parse error";
-                        parseErrors.push({ message: msg, line: 0, column: 0, source: "parser" });
-                    }
-                }
-            }
-            // Boundary loss is the parser's one public fact from `unparsedTail.from` onward;
-            // preserve it with the rejected forensic attempt. {§unparsed-tail-boundary}
-            const tail = parsed.unparsedTail;
-            if (tail !== undefined) {
-                hasUnparsedTail = true;
-                parseErrors.push({ message: tail.reason, line: tail.from.line, column: tail.from.column, source: "grammar" });
-            }
-        }
-        const plan = ops[0]?.op === "PLAN" ? ops[0] : undefined;
-        const finalOp = ops.at(-1);
-        const terminalSend = finalOp?.op === "SEND"
-            && typeof finalOp.signal === "number"
-            && TERMINAL_SEND_SIGNALS.has(finalOp.signal)
-            ? finalOp
-            : undefined;
-        const recoverableParseErrors = plan !== undefined && terminalSend !== undefined && !hasUnparsedTail
-            ? parseErrors.filter((error) => comparePosition(error, plan.position) > 0
-                && comparePosition(error, terminalSend.position) < 0).toSorted(comparePosition)
-            : [];
-        const emissionValid = preParsedOps !== undefined
-            || (plan !== undefined
-                && terminalSend !== undefined
-                && !hasUnparsedTail
-                && recoverableParseErrors.length === parseErrors.length);
-        const reasoning = assistant.reasoning ?? null;
-        return {
-            packetAssistant: { content: assistant.content, ops, reasoning },
-            callMetadata: { usage: assistant.usage, finishReason: assistant.finishReason, model: assistant.model },
-            parseErrors,
-            recoverableParseErrors: emissionValid ? recoverableParseErrors : [],
-            parseNotices,
-            // The ANTLR model-turn parser is authoritative. A trustworthy
-            // PLAN...SEND frame admits bounded interior statement failures so
-            // they become durable operation results. Missing boundaries,
-            // errors outside the frame, and an unparsed tail reject wholesale.
-            // Pre-parsed ops are Mock's trusted test seam.
-            emissionValid,
-        };
+    runTurn(args) {
+        return this.#turnRunner.runTurn(args);
     }
-    // #note12 — the plugin-provided reference docs (schemes' + execs' `documentation`),
-    // materialized at worker://plurnk/docs/<name>.md by LoopDocs (like operator docs).
     docEntries(workspaceId) {
         return this.#packets.docEntries(workspaceId);
     }
     // {§env-delta-log-pull} — materialize one closed interval of the ambient
     // occurrence journal into this worker's self-contained log. #67 owns only
     // the remaining model-facing actor-name projection.
-    async #materializeEnvironmentDeltas(args) {
-        const { workspaceId, workerId, loopId, turnId, fromSequence } = args;
-        const rows = await this.#db.engine_pull_ambient_events.all({ workspace_id: workspaceId, worker_id: workerId });
-        const window = rows[0];
-        if (window === undefined)
-            throw new Error(`ambient pull: worker ${workerId} has no observation window`);
-        let written = 0;
-        for (const r of rows) {
-            if (r.event_id === null || r.producer_worker_id === null || r.producer_worker_name === null || r.kind === null
-                || r.op === null || r.status_rx === null)
-                continue;
-            const termination = r.kind === "loop_termination";
-            if (r.rx === null)
-                throw new Error(`ambient event ${r.event_id} has no materializable result`);
-            const terminal = termination
-                ? TerminalResult.parse(r.rx, `ambient loop-termination event ${r.event_id}`)
-                : null;
-            if (terminal !== null && terminal.status !== r.status_rx) {
-                throw new Error(`ambient loop-termination event ${r.event_id} status ${r.status_rx} does not match its terminal result status ${terminal.status}`);
-            }
-            let attrs = r.attrs ?? "{}";
-            if (terminal !== null) {
-                const inherited = JSON.parse(attrs);
-                if (inherited === null || typeof inherited !== "object" || Array.isArray(inherited)) {
-                    throw new TypeError(`ambient loop-termination event ${r.event_id} attrs must be an object`);
-                }
-                const receipt = await BranchReceipt.render(this.#db, r.producer_worker_id);
-                attrs = JSON.stringify({
-                    ...inherited,
-                    kind: "loop_termination",
-                    ...(r.terminated_by === null ? {} : { terminatedBy: r.terminated_by }),
-                    ...(receipt === null ? {} : { receipt }),
-                });
-            }
-            const inserted = await this.#db.engine_insert_ambient_delta.get({
-                worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence: fromSequence + written,
-                event_id: r.event_id,
-                source: r.source ?? WorkerControlAddress.render(r.producer_worker_name),
-                op: r.op,
-                scheme: r.scheme,
-                hostname: r.hostname,
-                pathname: r.pathname,
-                rx: r.rx,
-                mimetype_rx: "application/json",
-                status: r.status_rx,
-                expanded: terminal !== null && terminal.status >= 200 && terminal.status < 300 ? 1 : 0,
-                attrs,
-            });
-            if (inserted !== undefined)
-                written++;
-        }
-        await this.#db.engine_advance_ambient_cursor.get({
-            workspace_id: workspaceId,
-            worker_id: workerId,
-            cursor: window.cursor,
-            boundary: window.boundary,
-        });
-        return written;
-    }
-    // {§exec-poll} — EXEC `<0>` is turn-scoped: abort the worker's open turn-scoped streams via their
-    // owning scheme (the same registry-routed abort the total reap uses). Called at each pre-turn
-    // before the turn's own spawns, so every open turn-scoped sub here is from a prior turn — it
-    // never survives into the subsequent turn. Fire-and-forget: the spawn finalizes async and its
-    // terminal output surfaces born-OPEN through the stream-delta path ({§exec-stream}).
-    async #reapTurnScopedStreams(workerId) {
-        const open = await this.#db.find_open_turn_scoped_subscriptions_for_worker.all({ worker_id: workerId });
-        await Promise.all(open.map(({ id }) => this.#liveSubscriptions.cancel(id)));
-    }
     cancelSubscription(subscriptionId) {
         return this.#liveSubscriptions.cancel(subscriptionId);
     }
@@ -1889,141 +598,6 @@ export default class Engine {
     // 200 while the channel streams and preserves the exact terminal result when closed. Ongoing
     // observations fold; the terminal observation auto-OPENs. The cursor is the streamEnd recorded
     // on the channel's prior observation. {§exec-stream}
-    async #materializeStreamDeltas(args) {
-        const { workerId, loopId, turnId, fromSequence } = args;
-        const channels = await this.#db.engine_worker_stream_channels.all({ worker_id: workerId });
-        let written = 0;
-        for (const ch of channels) {
-            // Default channels are an implementation detail. Preserve the
-            // channel internally on the entry/subscription, but present the
-            // ordinary address to the model; only an explicitly non-default
-            // channel earns a fragment in the log.
-            const visibleFragment = ch.published_channel !== null
-                && ch.channel === this.#schemes.defaultChannelFor(ch.runtime)
-                ? null
-                : ch.channel;
-            const prior = await this.#db.engine_stream_cursor.get({
-                worker_id: workerId, scheme: ch.runtime, pathname: ch.coord, fragment: visibleFragment,
-            });
-            const priorAttrs = prior !== undefined ? JSON.parse(prior.attrs) : {};
-            const cursor = priorAttrs.streamEnd ?? 0;
-            const closed = ch.state === "closed" || ch.state === "errored";
-            const terminal = closed
-                ? Results.assert(JSON.parse(ch.close_result ?? "null"))
-                : null;
-            const terminalResult = async (fields, sequence) => {
-                if (terminal === null)
-                    throw new Error(`closed subscription ${ch.subscription_id} has no terminal result`);
-                const result = Results.assert({
-                    ...terminal,
-                    ...(terminal.problem === undefined ? {} : { problem: { ...terminal.problem } }),
-                    ...fields,
-                });
-                if (result.problem !== undefined) {
-                    const seqs = await this.#db.engine_loop_turn_seqs.get({
-                        loop_id: loopId,
-                        turn_id: turnId,
-                    });
-                    if (seqs === undefined)
-                        throw new Error(`stream delta has no log coordinate for loop=${loopId} turn=${turnId}`);
-                    Results.attachInstance(result, `log:///${seqs.loop_seq}/${seqs.turn_seq}/${sequence}/READ`);
-                }
-                return result;
-            };
-            const publishEnd = streamPublicationEnd(ch.content, ch.mimetype, cursor, closed);
-            if (publishEnd <= cursor) {
-                // The cursor-terminal race: a channel written in one final
-                // burst gets fully shown FOLDED while still active; the close then has zero new
-                // content and the auto-OPEN terminal observation never fired — the model was never shown
-                // the conclusion of a stream whose result it already holds folded. The same
-                // observation is required when the channel produced no publishable content:
-                // completion is information independently of payload. Text streams retain their
-                // terse marker; structured channels emit a bodyless typed conclusion.
-                if (closed && priorAttrs.terminal !== true) {
-                    const streamTarget = renderTarget({
-                        scheme: ch.runtime,
-                        pathname: ch.coord,
-                        fragment: visibleFragment,
-                    });
-                    if (streamTarget === null)
-                        throw new Error(`stream ${ch.subscription_id} has no renderable address`);
-                    const pointer = cursor > 0
-                        ? `full output already delivered above; READ ${streamTarget} to revisit`
-                        : "stream produced no output";
-                    const sequence = fromSequence + written;
-                    const content = baseMimetype(ch.mimetype).startsWith("text/")
-                        ? `[ stream closed (${ch.close_status ?? 200}) - ${pointer} ]`
-                        : "";
-                    await this.#db.engine_insert_stream_delta.run({
-                        worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence,
-                        scheme: ch.runtime, pathname: ch.coord, fragment: visibleFragment,
-                        rx: JSON.stringify(await terminalResult({
-                            content,
-                            mimetype: ch.mimetype,
-                        }, sequence)),
-                        status: terminal?.status ?? 200,
-                        attrs: JSON.stringify({ streamEnd: ch.content.length, terminal: true }),
-                        expanded: 1,
-                    });
-                    written++;
-                }
-                continue;
-            }
-            // startLine continues the line count across turns: a multi-turn stream's deltas number
-            // into one sequence (lines N..M, then M+1..), not N independent "1:" restarts. {§exec-stream}
-            const startLine = (ch.content.slice(0, cursor).match(/\n/g)?.length ?? 0) + 1;
-            const sequence = fromSequence + written;
-            const content = ch.content.slice(cursor, publishEnd);
-            const terminalDelivery = closed && publishEnd === ch.content.length;
-            const fields = { content, mimetype: ch.mimetype, startLine };
-            const result = terminalDelivery
-                ? await terminalResult(fields, sequence)
-                : { status: 200, ...fields };
-            await this.#db.engine_insert_stream_delta.run({
-                worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence,
-                scheme: ch.runtime, pathname: ch.coord, fragment: visibleFragment,
-                rx: JSON.stringify(result),
-                status: result.status,
-                attrs: JSON.stringify({ streamEnd: publishEnd, terminal: terminalDelivery }),
-                expanded: terminalDelivery ? 1 : 0, // {§exec-stream} — terminal observation auto-OPENs; ongoing folds
-            });
-            written++;
-        }
-        return written;
-    }
-    // {§env-delta-filesystem-narration} {§membership-emi-divergence-signal}
-    // — journal project-file divergence once through the reserved actor.
-    async #logFsFictions(workspaceId, divergences, gitStatus) {
-        if (divergences.length === 0)
-            return;
-        const gitByPath = new Map(gitStatus?.files.map(({ path, status }) => [path, status]) ?? []);
-        const worker = await this.#db.envelope_get_worker_by_name.get({ workspace_id: workspaceId, name: "plurnk" })
-            ?? await this.#db.envelope_insert_worker.get({ workspace_id: workspaceId, name: "plurnk", origin: "plurnk" });
-        if (worker === undefined)
-            throw new Error("logFsFictions: plurnk worker resolution returned no row");
-        const loop = await this.#db.envelope_insert_client_loop.get({ worker_id: worker.id });
-        if (loop === undefined)
-            throw new Error("logFsFictions: loop insert returned no row");
-        const turn = await JournalTurn.insert(this.#db, loop.id);
-        let sequence = 1;
-        for (const d of divergences) {
-            const span = editedSpan(d.before, d.after);
-            await this.#db.engine_insert_log_entry.get({
-                worker_id: worker.id, loop_id: loop.id, turn_id: turn.id, sequence: sequence++,
-                origin: "plurnk", source: "file", op: "EDIT", suffix: "", signal: null,
-                // Match Dispatcher.#extractTarget: a bare file address has NULL scheme
-                // only in log target metadata; its entry identity remains `file`.
-                scheme: null, username: null, password: null, hostname: null, port: null,
-                pathname: d.pathname, query: null, fragment: null, lineMarker: null,
-                tx: "", mimetype_tx: "text/plain",
-                rx: JSON.stringify({ status: 200, entryId: d.entryId, channel: d.channel, span }), mimetype_rx: "application/json",
-                status_rx: 200, tokens: 0, state: "resolved", outcome: null,
-                attrs: gitByPath.has(d.pathname)
-                    ? JSON.stringify({ git: gitByPath.get(d.pathname) })
-                    : "{}",
-            });
-        }
-    }
     async dispatch(context) {
         return observed(// {§observability-boundary}
         "op.dispatch", { op: context.statement.op }, async (span) => {
@@ -2043,43 +617,6 @@ export default class Engine {
     async resolveEntryAddress(context) {
         return this.#dispatcher.resolveEntryAddress(context);
     }
-    async #writePromptLog({ workerId, loopId, turnId, sequence, target, content, }) {
-        const row = await this.#db.engine_insert_log_entry.get({
-            worker_id: workerId,
-            loop_id: loopId,
-            turn_id: turnId,
-            sequence,
-            origin: "plurnk",
-            source: null,
-            op: "prompt",
-            suffix: "",
-            signal: null,
-            scheme: target.scheme,
-            username: target.username,
-            password: target.password,
-            hostname: target.hostname,
-            port: target.port,
-            pathname: target.pathname,
-            query: target.query,
-            fragment: target.fragment,
-            lineMarker: null,
-            tx: "",
-            mimetype_tx: "text/plain",
-            rx: JSON.stringify({ content, mimetype: "text/markdown" }),
-            mimetype_rx: "application/json",
-            status_rx: 200,
-            tokens: this.#tokenize(content),
-            state: "resolved",
-            outcome: null,
-            attrs: "{}",
-        });
-        if (row === undefined)
-            throw new Error("Engine.#writePromptLog: INSERT ... RETURNING produced no row");
-        return row.id;
-    }
-    // External API to feed a resolution into a pending proposal — the client-interface
-    // seam, core-owned disposition, or the timeout watcher.
-    // {§worker-lifecycle-total-reap}: release every stopped-world waiter before joining drains.
     cancelAllProposals(outcome) {
         this.#proposals.cancelAll(outcome);
     }
@@ -2117,7 +654,7 @@ export default class Engine {
             signal: undefined,
             streamEventNotify: this.#streamEventNotify,
             wakeWorkerNotify: this.#wakeWorkerNotify,
-            tokenize: this.#tokenize,
+            weigh: this.#weighContent,
             mimetypes: this.#mimetypes,
             defaultChannelFor: (s) => this.#schemes.defaultChannelFor(s),
             pushNotice: (notice) => this.#notices.notify(workspaceId, 0, notice),
@@ -2172,12 +709,11 @@ export default class Engine {
             signal: this.#loopAborts.get(loopId)?.signal,
             streamEventNotify: this.#streamEventNotify,
             wakeWorkerNotify: this.#wakeWorkerNotify,
-            tokenize: this.#tokenize,
+            weigh: this.#weighContent,
             pushNotice: (notice) => this.#notices.push(workspaceRow.workspace_id, loopId, notice),
         };
         const entry = {
             channels: { body: { content: prompt, mimetype: "text/markdown" } },
-            tags: [],
             attributes: { openPaths },
         };
         await EntryCrud.writeEntry(pathname, entry, ctx, "prompt", workerId);