@possumtech/rummy 2.2.1 → 2.3.1

package/src/plugins/error/error.js

@@ -1,5 +1,5 @@
 import { SOFT_FAILURE_OUTCOMES } from "../../agent/errors.js";
-import { SUMMARY_MAX_CHARS } from "../helpers.js";
+import { projectEmission, summarizeEmission } from "../helpers.js";
 
 const MAX_STRIKES = Number(process.env.RUMMY_MAX_STRIKES);
 const MIN_CYCLES = Number(process.env.RUMMY_MIN_CYCLES);
@@ -40,19 +40,14 @@ export default class ErrorPlugin {
 	constructor(core) {
 		this.#core = core;
 		core.registerScheme({ category: "logging" });
-		core.on("visible", (entry) => `# error\n${entry.body}`);
-		core.on("summarized", (entry) => entry.body.slice(0, SUMMARY_MAX_CHARS));
+		core.on("visible", (entry) => projectEmission(entry.body));
+		core.on("summarized", (entry) => summarizeEmission(entry.body));
 
 		core.hooks.error.log.on(this.#onErrorLog.bind(this));
 		core.hooks.loop.started.on(this.#onLoopStarted.bind(this));
 		core.hooks.loop.completed.on(this.#onLoopCompleted.bind(this));
 		core.hooks.turn.started.on(this.#onTurnStarted.bind(this));
 
-		// Subscribe to the turn.verdict filter chain. Multi-plugin
-		// surface — strike streak, cycle detection, stagnation
-		// pressure all flow through here. Future voters (e.g. budget
-		// overflow termination, runaway-on-context-grow) participate
-		// via the same chain.
 		core.filter("turn.verdict", this.#verdict.bind(this));
 	}
 
@@ -85,15 +80,8 @@ export default class ErrorPlugin {
 	}) {
 		const statusValue = status ?? 400;
 		const path = await store.logPath(runId, turn, "error", message);
-		// Soft errors record but don't strike: the issue was already
-		// recovered (e.g. parser auto-corrected a closing-tag mismatch)
-		// and the entry exists only so the model can see what happened.
-		// state="resolved" keeps recordedFailed clean; skipping
-		// turnErrors++ keeps the strike machinery from firing. Per SPEC
-		// #entries, outcome is reserved for state ∈ {failed, cancelled}
-		// — soft entries land with outcome=null. Status carrier for
-		// rendering is attributes.status, consulted before outcome by
-		// log.js's renderLogTag.
+		// Soft errors record without striking — recovered issues the model
+		// should see but not be punished for. SPEC #entries.
 		await store.set({
 			runId,
 			turn,
@@ -113,31 +101,19 @@ export default class ErrorPlugin {
 		_currentVerdict,
 		{ store, runId, loopId, recorded, summaryText, turn: _turn },
 	) {
-		// _currentVerdict is the upstream filter's result. Today this is
-		// the only voter so it's always { continue: true }. When other
-		// plugins join the chain, they can short-circuit by setting
-		// continue=false; this implementation could honor that via an
-		// early return. Left noop for now to preserve current semantics.
 		const state = this.#loopState.get(loopId);
 
 		let cycleReason = null;
-		// Empty turns share a blank fingerprint; intentional.
 		const fp = recorded.map(fingerprint).toSorted().join("|");
 		state.history.push(fp);
 		const cycle = detectCycle(state.history);
 		if (cycle.detected) {
 			cycleReason = "Loop detected";
-			// Silent strike: increment turn-errors without a model-facing entry.
 			state.turnErrors++;
 		}
 
-		// Some failure outcomes are findings the model should adapt to,
-		// not contract violations. `not_found` (model tried to act on an
-		// entry that doesn't exist) and `conflict` (SEARCH text didn't
-		// match current body) are recoverable: the model reads the new
-		// state and tries again. Striking on these punishes legitimate
-		// state-discovery and accumulates 499s on otherwise productive
-		// runs. Hard outcomes (validation, permission, exit:N) still strike.
+		// Soft outcomes (not_found, conflict) are state-discovery findings
+		// the model adapts to; only hard failures count toward the strike.
 		let recordedFailed = false;
 		for (const e of recorded) {
 			const current = await store.getState(runId, e.path);
@@ -161,7 +137,7 @@ export default class ErrorPlugin {
 		if (struck) {
 			state.streak++;
 			if (state.streak >= MAX_STRIKES) {
-				// Abandoning-strike turn: same-turn terminal update wins over 499.
+				// Same-turn terminal update wins over 499.
 				if (summaryText) {
 					state.streak = 0;
 					const updateEntry = recorded?.findLast?.(
@@ -178,11 +154,6 @@ export default class ErrorPlugin {
 						`Abandoned after ${state.streak} consecutive strikes.`,
 				};
 			}
-			// No reason on continue: the model sees the actual failure
-			// entries directly in <log> next turn. Hardcoding "Missing
-			// update" mislabels strikes that fire on validation /
-			// permission / dispatch failures or cycles, when the update
-			// itself was emitted correctly.
 			return { continue: true };
 		}
 

package/src/plugins/get/get.js

@@ -1,5 +1,10 @@
 import Entries from "../../agent/Entries.js";
-import { storePatternResult } from "../helpers.js";
+import { countTokens } from "../../agent/tokens.js";
+import {
+	projectEmission,
+	storePatternResult,
+	summarizeEmission,
+} from "../helpers.js";
 import docs from "./getDoc.js";
 
 export default class Get {
@@ -19,11 +24,8 @@ export default class Get {
 
 	async handler(entry, rummy) {
 		const { entries: store, sequence: turn, runId, loopId } = rummy;
-		// Search-by-tags: same `tags` attribute that <set> writes onto
-		// entries. Same name on both ends — no in/out semantic split.
 		const tagsAttr = entry.attributes.tags;
-		// Tags-only get defaults path to "**" so the model can recall by
-		// folksonomic tags without remembering exact paths.
+		// Tags-only get defaults path to "**" for tag-only recall.
 		const target = entry.attributes.path || (tagsAttr ? "**" : null);
 		if (!target) {
 			await store.set({
@@ -74,7 +76,6 @@ export default class Get {
 			});
 		}
 
-		// Manifest: list matches + full-body token costs; no promotion.
 		if (manifest) {
 			await storePatternResult(
 				store,
@@ -89,27 +90,36 @@ export default class Get {
 			return;
 		}
 
-		// Partial read: line slice in the log entry; no promotion.
-		// Per getDoc: "line/limit works on any scheme — files, sh
-		// stdout, knowns, urls." Multi-match (glob, tags, or body
-		// filter narrowing) emits one slice section per match —
-		// model can scope further with body filter or tighter path.
+		// Partial read: slice into attrs.slice, no promotion. Multi-match
+		// emits one section per match.
 		if (line !== null || limit !== null) {
 			if (matches.length === 0) {
 				await store.set({
 					runId,
 					turn,
 					path: entry.resultPath,
-					body: `${target} not found`,
+					body: "",
 					state: "resolved",
+					outcome: "not_found",
 					loopId,
-					attributes: { path: target },
+					attributes: {
+						path: target,
+						line,
+						limit,
+						error: `${target} not found`,
+					},
 				});
 				return;
 			}
 			const sections = matches.map((match) => sliceSection(match, line, limit));
-			const body = sections.map((s) => s.text).join("\n\n");
-			const attributes = { path: target };
+			const sliceBody = sections.map((s) => s.text).join("\n\n");
+			const attributes = {
+				path: target,
+				line,
+				limit,
+				beforeActionTokens: 0,
+				afterActionTokens: countTokens(sliceBody),
+			};
 			if (sections.length === 1) {
 				const only = sections[0];
 				attributes.lineStart = only.startLine;
@@ -122,7 +132,7 @@ export default class Get {
 				runId,
 				turn,
 				path: entry.resultPath,
-				body,
+				body: sliceBody,
 				state: "resolved",
 				loopId,
 				attributes,
@@ -170,31 +180,39 @@ export default class Get {
 				runId,
 				turn,
 				path: entry.resultPath,
-				body: `${target} not found`,
+				body: "",
 				state: "resolved",
+				outcome: "not_found",
 				loopId,
-				attributes: { path: target },
+				attributes: { path: target, error: `${target} not found` },
 			});
 		} else {
-			// Log line in <log> proves the promotion happened so the model doesn't re-fetch.
+			const promotedTokens = matches.reduce(
+				(n, m) => n + countTokens(m.body),
+				0,
+			);
 			await store.set({
 				runId,
 				turn,
 				path: entry.resultPath,
-				body: `${target} promoted`,
+				body: "",
 				state: "resolved",
 				loopId,
-				attributes: { path: target },
+				attributes: {
+					path: target,
+					beforeActionTokens: 0,
+					afterActionTokens: promotedTokens,
+				},
 			});
 		}
 	}
 
 	full(entry) {
-		return `# get ${entry.attributes.path || entry.path}\n${entry.body}`;
+		return projectEmission(entry.body);
 	}
 
-	summary() {
-		return "";
+	summary(entry) {
+		return summarizeEmission(entry.body);
 	}
 }
 

package/src/plugins/google/google.js

@@ -10,6 +10,21 @@ const PROVIDER = "google";
 const BASE_URL = "https://generativelanguage.googleapis.com/v1beta";
 const COMPAT_URL = `${BASE_URL}/openai`;
 
+// Documented input-token limits, prefix-matched. The native introspection
+// endpoint (/v1beta/models/{model}) requires a key permission separate from
+// generateContent — keys provisioned for chat-only return 403 here, crashing
+// any run that depends on the lookup. Trust the docs first; hit the API only
+// for unknown models.
+const KNOWN_CONTEXT = [
+	["gemini-3.1-flash-lite", 1_048_576],
+	["gemini-3.1-flash", 1_048_576],
+	["gemini-3.1-pro", 1_048_576],
+	["gemini-3.0", 1_048_576],
+	["gemini-2.5", 1_048_576],
+	["gemini-2.0", 1_048_576],
+	["gemini-1.5", 1_048_576],
+];
+
 // Repo-root-relative key file. Resolved relative to this source file so
 // CWD changes during runs (programbench/tbench cd into workspaces) don't
 // break the lookup. Plugin is inert if the file is missing. Tests may
@@ -94,9 +109,14 @@ export default class Google {
 	async #getContextSize(model) {
 		if (this.#contextCache.has(model)) return this.#contextCache.get(model);
 
-		// Native /v1beta/models/{model} requires API key as `?key=` query
-		// parameter — Bearer auth (which works on the OpenAI-compat layer)
-		// returns 401 here. Different auth surface, same key.
+		const known = KNOWN_CONTEXT.find(([prefix]) => model.startsWith(prefix));
+		if (known) {
+			this.#contextCache.set(model, known[1]);
+			return known[1];
+		}
+
+		// /v1beta/models/{model} requires `?key=` (Bearer 401s here) AND a
+		// key scope that includes models.get — chat-only keys return 403.
 		const url = `${BASE_URL}/models/${model}?key=${encodeURIComponent(this.#apiKey)}`;
 		const res = await fetch(url, {
 			signal: AbortSignal.timeout(FETCH_TIMEOUT),

package/src/plugins/helpers.js

@@ -2,30 +2,32 @@ import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// Hard system ceiling on the size of any summarized projection. Single
-// source of truth — every plugin's `summarized` view must produce output
-// ≤ this many characters; materializeContext's defensive cap fires when
-// a plugin breaks the contract. Change this number, everything downstream
-// stays consistent (no "450 here, 480 there, 500 over yonder" drift).
+// Hard ceiling on summarized projections. materializeContext enforces.
 export const SUMMARY_MAX_CHARS = 500;
 
-// Render a single entry as a heredoc-fenced block. Replaces the prior
-// per-plugin XML tag rendering (`<known path="..." ...>body</known>`).
-//
-// Why heredoc, not XML: the model emits XML for actions (`<set>`,
-// `<get>`, `<sh>`). When entries were ALSO XML, the inner tag could
-// look indistinguishable from a tool call — a file containing a
-// `<set>` example, an env streamed-stdout containing tool-shaped text,
-// or the model's own `<known>` body containing accidental tag-shaped
-// content could leak into the model's emit pattern. Heredoc fences
-// have zero training prior in tool-emission position, so they're
-// structurally separate from the action grammar.
-//
-// Format: `{json-meta} <<:::{path}\n{body}\n:::{path}`. The path is the
-// terminator — collision requires the body to literally contain its own
-// URI on a line by itself, which is vanishingly rare without active
-// malice. JSON metadata is sorted-key stringified for prefix-cache
-// stability (different field order = different bytes = cache miss).
+// Tab-indent every line so a column-zero `:::path` in the body can't
+// prematurely close the outer heredoc envelope.
+export function projectEmission(source) {
+	if (!source) return "";
+	return source
+		.split("\n")
+		.map((line) => `\t${line}`)
+		.join("\n");
+}
+
+// Same tab-indent recap signal as `projectEmission`, capped at
+// SUMMARY_MAX_CHARS post-projection so tabs don't push past the contract.
+export function summarizeEmission(body) {
+	if (!body) return "";
+	const projected = projectEmission(body);
+	return projected.length > SUMMARY_MAX_CHARS
+		? projected.slice(0, SUMMARY_MAX_CHARS)
+		: projected;
+}
+
+// Heredoc fence (path is the terminator) — distinct from XML so model
+// emissions and entry projections can't collide. JSON meta sorted for
+// prefix-cache stability.
 export function renderEntry(path, metadata, body) {
 	const meta = canonicalJson(metadata);
 	if (!body) {
@@ -35,7 +37,6 @@ export function renderEntry(path, metadata, body) {
 	return `${meta} <<:::${path}\n${body}${trailingNewline}:::${path}`;
 }
 
-// JSON.stringify with sorted top-level keys for byte-stable output.
 function canonicalJson(obj) {
 	const keys = Object.keys(obj).sort();
 	const sorted = {};
@@ -43,39 +44,28 @@ function canonicalJson(obj) {
 	return JSON.stringify(sorted);
 }
 
-// Read sibling tooldoc .md; strips HTML comments (rationale stays out of the model packet).
+// Read sibling tooldoc .md, strip HTML comments (rationale stays out of
+// the model packet) and collapse blank-line runs.
 export function loadDoc(metaUrl, name) {
 	const dir = dirname(fileURLToPath(metaUrl));
 	return readFileSync(join(dir, name), "utf8")
+		.replace(/^[ \t]*<!--[\s\S]*?-->[ \t]*\n?/gm, "")
 		.replace(/<!--[\s\S]*?-->/g, "")
 		.replace(/\n{3,}/g, "\n\n")
 		.trim();
 }
 
-// log://turn_N/{action}/{rest} → {action}://turn_N/{rest}; null if not a log path.
 export function logPathToDataBase(logPath) {
 	const m = logPath?.match(/^log:\/\/turn_(\d+)\/([^/]+)\/(.+)$/);
 	if (!m) return null;
 	return `${m[2]}://turn_${m[1]}/${m[3]}`;
 }
 
-// env/sh stdout/stderr summary projection: line-tail with a final hard
-// truncation to SUMMARY_MAX_CHARS. The line cap is the natural unit
-// when the program emits text; the final size cap is the contract floor
-// (see materializeContext) and protects against few-newline output like
-// terminal-control programs (cmatrix, htop) emitting one giant ANSI line.
-//
-// Output stays as a flat string (not a renderEntry block) because the
-// caller (log.assembleLog) wraps each log entry in renderEntry with its
-// own metadata; this is the BODY of that block. Effectively double
-// fencing — `<<:::log://turn_3/sh/foo` outer, then this header inside —
-// but that's correct: the outer fence labels "this is sh activity at
-// turn 3", and the body inside is the slice of stdout the model sees.
-export function streamSummary(label, entry, MAX_LINES = 20) {
+// Tail-truncate stream output to last MAX_LINES, then chop to
+// SUMMARY_MAX_CHARS for one-line giants (ANSI/cmatrix shape).
+export function streamSummary(_label, entry, MAX_LINES = 20) {
 	if (!entry.body) return "";
-	const { body, attributes } = entry;
-	const command = attributes.command;
-	const channel = attributes.channel === 2 ? "stderr" : "stdout";
+	const { body } = entry;
 	const trailingNewline = body.endsWith("\n");
 	const lines = trailingNewline
 		? body.slice(0, -1).split("\n")
@@ -85,17 +75,11 @@ export function streamSummary(label, entry, MAX_LINES = 20) {
 		total <= MAX_LINES
 			? body
 			: lines.slice(-MAX_LINES).join("\n") + (trailingNewline ? "\n" : "");
-
-	const header =
-		total <= MAX_LINES
-			? `# ${label} ${command} (${channel}, ${total}L)`
-			: `# ${label} ${command} (${channel}, lines ${total - MAX_LINES + 1} through ${total} of ${total}; <get line="1" limit="N"/> for head)`;
-
-	const out = `${header}\n${lineTail}`;
-	return out.length > SUMMARY_MAX_CHARS ? out.slice(0, SUMMARY_MAX_CHARS) : out;
+	return lineTail.length > SUMMARY_MAX_CHARS
+		? lineTail.slice(0, SUMMARY_MAX_CHARS)
+		: lineTail;
 }
 
-// Pattern-result log entry shared by get/set/store/rm.
 export async function storePatternResult(
 	store,
 	runId,

package/src/plugins/instructions/README.md

@@ -17,7 +17,7 @@ run.
   participants mutate a docsMap keyed by tool name). Render order
   follows tool-registration order.
 - **Filter**: `assembly.user` (priority 165) — renders
-  `instructions-user.md` as `<instructions>` late in the user
+  `instructions-user.md` as `<system_requirements>` late in the user
   message, between `<unknowns>` (150) and `<budget>` (175). The
   user message is a sandwich: `<prompt>` (30) leads for cache
   stability, dynamic state fills the middle, then rules and
@@ -39,7 +39,7 @@ The persona block is rendered by the persona plugin's own
   Static within a run; only `[%TOOLS%]` substitutes at render. No
   per-turn content here, ever.
 - `instructions-user.md` — the per-turn imperative reminder
-  rendered as `<instructions>` in the user message. Same bytes
+  rendered as `<system_requirements>` in the user message. Same bytes
   every turn.
 - `protocol.js` / `protocol.test.js` — pass-through stub on
   `entry.recording` (priority 1) reserved for future

package/src/plugins/instructions/instructions-user.md

@@ -50,4 +50,4 @@ Example:
 	<update status="200">Paris</update>
 
 YOU MUST NOT allow the `"tokens":N` sum of source entries, prompts, or log events to exceed `tokensFree="N"` budget.
-YOU MUST terminate your turn with <update status="{102|200}">{ direct answer or one-line summary }</update> (<= 80 chars)
+YOU MUST terminate every turn with <update status="{102|200}">{ direct one-line answer or one-line summary }</update> (<= 80 chars)

package/src/plugins/instructions/instructions.js

@@ -28,13 +28,26 @@ export default class Instructions {
 		this.#core = core;
 		core.hooks.instructions.findLatestSummary =
 			this.findLatestSummary.bind(this);
-		// System message: priority chain. Base header + grammar at 50,
-		// joined per-tool docs at 100, persona at 150 (in persona.js).
+		// System message: <system_commands> wraps the grammar + per-tool
+		// docs as a single semantic unit. Wrapper filters at 49 / 101
+		// sandwich the two content filters at 50 / 100. Other system
+		// participants (state blocks at 200/250/300/350) render after.
+		core.filter(
+			"assembly.system",
+			(content) => `${content}<system_commands>\n`,
+			49,
+		);
 		core.filter("assembly.system", this.assembleSystemBase.bind(this), 50);
 		core.filter("assembly.system", this.assembleSystemToolDocs.bind(this), 100);
-		// User message: per-turn reminder block at the front of the user
-		// packet — sets discipline before the prompt.
-		core.filter("assembly.user", this.assembleInstructions.bind(this), 30);
+		core.filter(
+			"assembly.system",
+			(content) => `${content}\n</system_commands>\n`,
+			101,
+		);
+		// User message: <system_requirements> at the action site —
+		// recency keeps protocol discipline (XML tag wrapping, terminal
+		// `<update>`) warm right before generation.
+		core.filter("assembly.user", this.assembleInstructions.bind(this), 165);
 		new Protocol(core);
 	}
 
@@ -76,7 +89,7 @@ export default class Instructions {
 
 	// assembly.user @ 165 — per-turn reminder, same body every turn.
 	assembleInstructions(content, _ctx) {
-		return `${content}<instructions>\n${userInstructions}\n</instructions>\n`;
+		return `${content}<system_requirements>\n${userInstructions}\n</system_requirements>\n`;
 	}
 
 	// Latest terminal update (status=200) — used by cli.js to print the

package/src/plugins/known/known.js

@@ -16,8 +16,7 @@ export default class Known {
 		core.on("summarized", this.summary.bind(this));
 		core.filter("assembly.system", this.assembleSummarized.bind(this), 200);
 		core.filter("assembly.system", this.assembleVisible.bind(this), 250);
-		// Hidden from the advertised tool list — written via <set path="known://...">.
-		// The known:// scheme lifecycle is taught in instructions-user.md.
+		// Written via <set path="known://...">; lifecycle in instructions-user.md.
 		core.markHidden();
 	}
 
@@ -83,17 +82,11 @@ export default class Known {
 		return entry.body;
 	}
 
-	// Summarized: first SUMMARY_MAX_CHARS of the body. The model already
-	// knows summarized data is approximate (taught in instructions), so
-	// we don't owe it a "[truncated]" marker that would push the body
-	// past the contract floor.
 	summary(entry) {
 		if (!entry.body) return "";
 		return entry.body.slice(0, SUMMARY_MAX_CHARS);
 	}
 
-	// Identity-keyed summary lines: every data entry the run is tracking
-	// at visibility=visible or visibility=summarized.
 	async assembleSummarized(content, ctx) {
 		const entries = ctx.rows.filter(
 			(r) =>

package/src/plugins/log/log.js

@@ -94,11 +94,19 @@ function renderLogTag(entry, rowsByPath) {
 
 	const meta = { action };
 	if (attrs?.path) meta.target = attrs.path;
-	// Suppress status on prompts; uniform 200 carries no signal.
 	if (statusValue != null && action !== "prompt") meta.status = statusValue;
 	if (entry.outcome) meta.outcome = entry.outcome;
 	if (typeof attrs?.query === "string") meta.query = attrs.query;
 	if (typeof attrs?.command === "string") meta.command = attrs.command;
+	if (typeof attrs?.from === "string") meta.from = attrs.from;
+	if (typeof attrs?.to === "string") meta.to = attrs.to;
+	if (typeof attrs?.question === "string") meta.question = attrs.question;
+	if (typeof attrs?.answer === "string") meta.answer = attrs.answer;
+	if (attrs?.line != null) meta.line = attrs.line;
+	if (attrs?.limit != null) meta.limit = attrs.limit;
+	if (attrs?.manifest !== undefined) meta.manifest = true;
+	if (attrs?.channel === 1) meta.channel = "stdout";
+	else if (attrs?.channel === 2) meta.channel = "stderr";
 	if (typeof attrs?.tags === "string") meta.tags = attrs.tags.slice(0, 80);
 	if (isSlice) {
 		meta.lines = `${attrs.lineStart}-${attrs.lineEnd}/${attrs.totalLines}`;
@@ -106,6 +114,12 @@ function renderLogTag(entry, rowsByPath) {
 		meta.lines = lineSource;
 	}
 	if (tokenSource != null) meta.tokens = tokenSource;
+	if (attrs?.beforeActionTokens != null) {
+		meta.beforeActionTokens = attrs.beforeActionTokens;
+	}
+	if (attrs?.afterActionTokens != null) {
+		meta.afterActionTokens = attrs.afterActionTokens;
+	}
 
 	return renderEntry(entry.path, meta, projectedBody(entry));
 }

package/src/plugins/mv/mv.js

@@ -1,5 +1,10 @@
 import Entries from "../../agent/Entries.js";
-import { storePatternResult } from "../helpers.js";
+import { countTokens } from "../../agent/tokens.js";
+import {
+	projectEmission,
+	storePatternResult,
+	summarizeEmission,
+} from "../helpers.js";
 import docs from "./mvDoc.js";
 
 const LOG_ACTION_RE = /^log:\/\/turn_\d+\/(\w+)\//;
@@ -35,7 +40,6 @@ export default class Mv {
 			? entry.attributes.visibility
 			: undefined;
 
-		// Manifest: list what would be affected without performing the mv.
 		if (entry.attributes.manifest !== undefined) {
 			const matches = await store.getEntriesByPattern(runId, path);
 			await storePatternResult(store, runId, turn, "mv", path, null, matches, {
@@ -46,7 +50,7 @@ export default class Mv {
 			return;
 		}
 
-		// Visibility-in-place: no destination, change visibility of matched entries
+		// Visibility-in-place: no destination, change visibility of matches.
 		if (visibility && !to) {
 			const matches = await store.getEntriesByPattern(runId, path);
 			for (const match of matches)
@@ -70,9 +74,7 @@ export default class Mv {
 
 		const source = await store.getBody(runId, path);
 		if (source === null) return;
-		// Tags propagate: explicit `tags=` on the mv wins; otherwise the
-		// destination inherits the source entry's tags. Same shape as
-		// visibility — explicit attr overrides, default inherits.
+		// Tags: explicit attr wins; otherwise destination inherits source's.
 		let destTags = null;
 		if (typeof entry.attributes.tags === "string") {
 			destTags = entry.attributes.tags;
@@ -90,19 +92,18 @@ export default class Mv {
 				? `Overwrote existing entry at ${to}`
 				: null;
 
-		const body = `${path} ${to}`;
+		const sourceTokens = countTokens(source);
+		const destOldTokens = existing !== null ? countTokens(existing) : 0;
+		const beforeTokens = sourceTokens + destOldTokens;
+		const afterTokens = sourceTokens;
+
 		if (destScheme === null) {
-			// Bare-file destination: hand the shared materializer (set.js
-			// #materializeFile, gated on attrs.path + attrs.patched) the
-			// authoritative new body so it writes the source content to
-			// disk on accept. Without this the source rm fired but the
-			// destination was never created. Same shape as cp's bare-file
-			// branch.
+			// Bare-file: hand the shared set.js materializer attrs.patched.
 			await store.set({
 				runId,
 				turn,
 				path: entry.resultPath,
-				body,
+				body: "",
 				state: "proposed",
 				attributes: {
 					from: path,
@@ -112,6 +113,8 @@ export default class Mv {
 					path: to,
 					patched: source,
 					visibility,
+					beforeActionTokens: beforeTokens,
+					afterActionTokens: afterTokens,
 				},
 				loopId,
 			});
@@ -131,19 +134,26 @@ export default class Mv {
 				runId,
 				turn,
 				path: entry.resultPath,
-				body,
+				body: "",
 				state: "resolved",
-				attributes: { from: path, to, isMove: true, warning },
+				attributes: {
+					from: path,
+					to,
+					isMove: true,
+					warning,
+					beforeActionTokens: beforeTokens,
+					afterActionTokens: afterTokens,
+				},
 				loopId,
 			});
 		}
 	}
 
 	full(entry) {
-		return `# mv ${entry.attributes.from} ${entry.attributes.to}`;
+		return projectEmission(entry.body);
 	}
 
-	summary() {
-		return "";
+	summary(entry) {
+		return summarizeEmission(entry.body);
 	}
 }

package/src/plugins/persona/persona.js

@@ -3,13 +3,13 @@ export default class Persona {
 		core.registerScheme({ name: "persona", category: "data" });
 		core.hooks.tools.onView("persona", (entry) => entry.body, "visible");
 		core.hooks.tools.onView("persona", () => "", "summarized");
-		// assembly.system @ 150 — last system-prompt section. Body comes
-		// from runs.persona, plumbed in via ctx.persona by TurnExecutor.
-		core.filter("assembly.system", this.assembleSystemPersona.bind(this), 150);
+		// assembly.user @ 10 — top of the user message. Sets voice/role
+		// freshly per turn, ahead of the prompt. Body from ctx.persona.
+		core.filter("assembly.user", this.assembleSystemPersona.bind(this), 10);
 	}
 
 	assembleSystemPersona(content, ctx) {
 		if (!ctx.persona) return content;
-		return `${content}\n\n## Operational Persona\n\n${ctx.persona}`;
+		return `${content}<system_instructions>\n${ctx.persona}\n</system_instructions>\n`;
 	}
 }