chore(release): auto-bump version to 0.353.0 — earned by # (minor: converged release (push-to-master bump))

Promotion record: (unknown)

README.md

@@ -1,9 +1,9 @@
 # Rune
 
-**Current release: v0.351.0**
+**Current release: v0.353.0**
 
 <!-- highlights:start -->
-## Highlights — from the latest release (v0.351.0)
+## Highlights — from the latest release (v0.353.0)
 
 - Plain-English jargon dictionary covers the v0.329 vocabulary, plus catch-all sentence simplification pass.
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rune"
-version = "0.351.0"
+version = "0.353.0"
 description = "Rune — a stateful coding assistant with persistent memory, orchestration, and TUI"
 requires-python = ">=3.10"
 

research/witness-run/witness-2026-10-24.json

@@ -0,0 +1,240 @@
+{
+ "method": "sys.setprofile witness over full import graph + serving-chain boot probe; RUNE_HOME isolated",
+ "numbers": {
+  "total_py_modules": 296,
+  "go_facade_served_live": 11,
+  "rust_kernel_wired_live": 79,
+  "live_pure_python_total": 204,
+  "  of which tooling/test-pattern": 117,
+  "  of which load-bearing candidates": 87,
+  "dead_never_executed": 1
+ },
+ "boot_chain_executed": [
+  "__init__",
+  "attention_capsule",
+  "behaviour_ledger",
+  "capability_broker",
+  "context_broker",
+  "effect_mediation",
+  "local_tool_runtime",
+  "memory_env",
+  "microkernel",
+  "mode_gate",
+  "model_routing",
+  "paths",
+  "tool_executor",
+  "tool_protocol",
+  "warm_router"
+ ],
+ "live_pure_core": [
+  "abstraction",
+  "adaptive_router",
+  "alpha",
+  "audit_ledger",
+  "auto_context",
+  "build_attestation",
+  "build_mode",
+  "builder_bridge",
+  "chat_bubble",
+  "construction_admission",
+  "construction_authority",
+  "construction_interface",
+  "context_broker",
+  "core_server",
+  "cron_engine",
+  "drift-ledger",
+  "drift_compression",
+  "effect_mediation",
+  "elastic_cognition",
+  "event_bus",
+  "event_envelope",
+  "event_wait",
+  "factory_protocol",
+  "failure_auto_filer",
+  "failure_recovery",
+  "ffi_query_memory_smoke",
+  "graph_projection",
+  "growth_delta",
+  "hook_engine",
+  "identity_anchors",
+  "impact_preview",
+  "inference_paths",
+  "live_proof",
+  "local_tool_runtime",
+  "memory_consolidation",
+  "memory_continuity",
+  "memory_env",
+  "memory_store",
+  "message_queue",
+  "message_widgets",
+  "mode_gate",
+  "model_connect",
+  "model_profiles",
+  "model_registry",
+  "night_mode",
+  "owner_envelope",
+  "parallel_processor",
+  "paths",
+  "persona_definition",
+  "persona_gate",
+  "pins",
+  "programme_gates",
+  "provider_budget",
+  "provider_context",
+  "provider_registry",
+  "recall_router",
+  "release_notes",
+  "route_risk_flags",
+  "rune_graphic",
+  "rune_operator",
+  "rune_spinner",
+  "rune_tui",
+  "runtime_attestation",
+  "safety_override",
+  "secret_store",
+  "self_change_qualification",
+  "self_transform_pipeline",
+  "skills_engine",
+  "sleep_time",
+  "stage_guards",
+  "standardized_providers",
+  "structural_migration",
+  "task_persist",
+  "tier_manager",
+  "tiered_executor",
+  "tool_executor",
+  "tool_protocol",
+  "tui_backlog",
+  "tui_transport",
+  "tui_validator",
+  "voice_injector",
+  "voicebox",
+  "wait_guard",
+  "wait_guard_corpus",
+  "warm_neuron_store",
+  "warm_router",
+  "work_manager"
+ ],
+ "live_pure_tooling": [
+  "ac_loader",
+  "al_loader",
+  "bb_loader",
+  "bh_loader",
+  "bl_loader",
+  "broker_loader",
+  "builder_bridge_cli",
+  "ca_loader",
+  "canary_audit_ledger",
+  "canary_cognitive_strata",
+  "canary_context_broker",
+  "canary_conversation_state",
+  "canary_full_system",
+  "canary_gitea_automation",
+  "canary_gitea_delegation",
+  "canary_gitea_pipeline",
+  "canary_memory_synthesis",
+  "canary_native",
+  "canary_orchestration_foundation",
+  "canary_p0_04",
+  "canary_p0_05",
+  "canary_p0_07",
+  "canary_p1_01",
+  "canary_p1_02",
+  "canary_p1_03",
+  "canary_p1_06",
+  "canary_p1_07",
+  "canary_query_memory",
+  "canary_resource_authority",
+  "canary_rune_entry",
+  "canary_rune_serve",
+  "canary_schema_migration",
+  "canary_spine_meta",
+  "canary_surface_parity",
+  "canary_tui_drift",
+  "canary_tui_transport",
+  "canary_unbounded",
+  "cb_loader",
+  "cc_loader",
+  "ccmd_loader",
+  "cd_loader",
+  "cdec_loader",
+  "cf_loader",
+  "ci_loader",
+  "cl_loader",
+  "cm_loader",
+  "construction_authority_cli",
+  "contracts_loader",
+  "cp_loader",
+  "cpb_loader",
+  "cpool_loader",
+  "cproj_loader",
+  "cps_loader",
+  "cs_loader",
+  "ct_loader",
+  "dc_loader",
+  "dcore_loader",
+  "dl_loader",
+  "do_loader",
+  "dr_loader",
+  "dt_loader",
+  "ec_loader",
+  "ee_loader",
+  "et_loader",
+  "evidence_probe",
+  "gm_loader",
+  "gp2_loader",
+  "gp_loader",
+  "gr_loader",
+  "ic_loader",
+  "ip_loader",
+  "it_loader",
+  "itr_loader",
+  "lc_loader",
+  "le_loader",
+  "me_loader",
+  "mems_loader",
+  "mg_loader",
+  "mr_loader",
+  "ms_loader",
+  "mse_loader",
+  "mt_loader",
+  "mu_loader",
+  "ol_loader",
+  "ou_loader",
+  "pa_loader",
+  "pc_loader",
+  "pr_loader",
+  "progressive_escalation_loader",
+  "ps_loader",
+  "ra_loader",
+  "rb_loader",
+  "rp_loader",
+  "ru_loader",
+  "sc_loader",
+  "sck_loader",
+  "sg_loader",
+  "sh_loader",
+  "si_loader",
+  "sk_loader",
+  "sl_loader",
+  "sm_loader",
+  "smm_loader",
+  "smod_loader",
+  "sp_loader",
+  "sr_loader",
+  "ss_loader",
+  "stm_loader",
+  "ta_loader",
+  "tc_loader",
+  "tg_loader",
+  "tl_loader",
+  "tm_loader",
+  "to_loader",
+  "vh_loader",
+  "vs_loader",
+  "wr_loader"
+ ],
+ "dead": [
+  "__main__"
+ ]
+}

scripts/admit_wave_d56_governor.py

@@ -0,0 +1,142 @@
+"""Admission dispatch for wave D56 (Gitea #2580 + #2581 — the
+provider-aware dispatch governor + the info-bar tok/s readout).
+
+classify + activate + admit (the headless scaffolding entry law): the
+D56 wave builds on the existing rune project, user-dispatch approved
+(D56 directive 2026-10-24; owner doctrine: cloud-first routing, no
+consent gates on cloud, routing scope = factory lane assignment).
+"""
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
+
+from rune import construction_activation as cact  # noqa: E402
+from rune import construction_admission as cadm  # noqa: E402
+from rune import construction_mode as cmode  # noqa: E402
+from rune import scaffold as sc  # noqa: E402
+
+ROOT = os.path.join(os.path.dirname(__file__), "..")
+
+OBJECTIVE = (
+    "land the D56 wave (Gitea #2580 + #2581, owner doctrine rulings "
+    "2026-10-24: CLOUD-FIRST routing — cloud lanes fill FIRST, local "
+    "absorbs only overflow; NO CONSENT on cloud models — configured "
+    "provider = spend freely, zero prompts; routing scope = factory "
+    "lane assignment, interactive chat routing stays the owner's): "
+    "(1) TELEMETRY — sample live tok/s per provider from production "
+    "data (the engine's real turn accounting; output-token counts "
+    "from the provider wires where published, honest token-estimate "
+    "fallback otherwise); rolling per-provider samples persisted via "
+    "the hot-state pattern (~/.rune/hot/provider_throughput.json, "
+    "atomic temp+rename); (2) SATURATION MODEL — a small rolling "
+    "(provider, lanes) EMA curve learned ONLY from samples, no "
+    "synthetic benchmarks; the lane cap is where the marginal tok/s "
+    "gain clears the floor (RUNE_GOVERNOR_CAP_FLOOR, default 5); "
+    "(3) CONNECTION-HEALTH — the governor polls the registry's "
+    "enabled providers live (reachable, authenticated, tok/s, error "
+    "rate, 429 throttle windows) and routes only to providers "
+    "actually alive; (4) LANE POOLS + CLOUD-FIRST — per-provider lane "
+    "pools, cloud pools fill first, least-loaded within a tier, "
+    "throttled providers refused (a 429 ceiling is worse than not "
+    "spawning); (5) CLASSIFIER INTEGRATION — dispatch-classifier "
+    "gains the governor's cap: PARALLEL verdicts become "
+    "throughput-aware ('PARALLEL (N lanes free at current tok/s)'), "
+    "the thin pipe says so, no false fan-out; registry/lock "
+    "semantics unchanged; (6) INFO BAR READOUT — tok/s after the "
+    "context readout ('context 4.2k/32k (13%) · 38 tok/s') fed from "
+    "/v1/status's new governor section through both bridge seams; "
+    "the sub-agents section shows the governor's state row (lanes in "
+    "use, measured tok/s, cap, '—' honest gap); (7) HONESTY — a thin "
+    "pipe is stated, never dressed up"
+)
+AFFECTED = [
+    "src/go/rune-core/",
+    "src/go/dispatch-classifier/",
+    "tui/cmd/rune-tui/",
+    "tui/lanes/",
+    "tui/bridge/",
+    "tui/runtime/lib/",
+    "scripts/admit_wave_d56_governor.py",
+]
+
+
+def main() -> int:
+    store = os.path.join(ROOT, "store", "scaffold")
+    scaffold = sc.Scaffold(store, "rune")
+
+    md = cmode.classify_mode(
+        OBJECTIVE,
+        target_project="rune",
+        project_exists=True,
+        affected_surface=AFFECTED,
+    )
+    print("classified mode:", md.mode)
+
+    need = {
+        "need_id": "need-wave-d56-governor",
+        "objective": OBJECTIVE,
+        "origin": "worker",
+        "project": "rune",
+        "task_ref": "wave-d56-governor",
+        "affected_surface": AFFECTED,
+        "evidence_refs": [
+            "src/go/rune-core/internal/runecore/governor.go",
+            "src/go/rune-core/internal/runecore/governor_test.go",
+            "src/go/rune-core/internal/runecore/server.go",
+            "src/go/rune-core/internal/runecore/engine.go",
+            "src/go/dispatch-classifier/capacity.go",
+            "src/go/dispatch-classifier/capacity_test.go",
+            "tui/cmd/rune-tui/main.go",
+            "tui/cmd/rune-tui/d56_governor_test.go",
+            "tui/bridge/d56_governor_test.go",
+            "tui/runtime/lib/lib.go",
+        ],
+    }
+    act = cact.activate(md, need=need, scaffold=scaffold,
+                        builder="wave-d56-governor")
+    print("activated:", act.get("activated"), act.get("mode"))
+
+    env = cadm.admit(
+        act,
+        objective=OBJECTIVE,
+        builder="wave-d56-governor",
+        affected_surface=AFFECTED,
+        evidence_refs=need["evidence_refs"],
+        origin="worker",
+        task_ref="wave-d56-governor",
+        expected_new_entities=[
+            "the D56 wave report (reports/)",
+            "the governor hot-state shape "
+            "(~/.rune/hot/provider_throughput.json)",
+            "the red-first governor/capacity/readout tests",
+        ],
+        expected_runtime_effects=[
+            "the governor samples live tok/s per provider from real "
+            "turns and persists the rolling model to the hot state, "
+            "routes cloud-first through healthy providers only "
+            "(429-throttled refused), the dispatch classifier's "
+            "PARALLEL verdicts carry the measured lane capacity with "
+            "the thin pipe stated honestly, and the info bar shows "
+            "the measured tok/s after the context readout with the "
+            "sub-agents section showing the governor's state",
+        ],
+        verification_obligations=[
+            "go test -race -short green on rune-core, "
+            "dispatch-classifier and tui (hermetic PTY/HTTP tests)",
+            "vet/gofmt clean on touched modules",
+            "readout proof: the info-bar test asserts 'context ... "
+            "(13%) · 38 tok/s' byte-shape against a fake serve",
+        ],
+        approval_ref="user:D56 directive 2026-10-24 (Gitea #2580 + #2581)",
+        contract_id="ADMIT-wave-d56-governor",
+        project_store=store,
+        project_id="rune",
+    )
+    print(json.dumps(env, indent=2, default=str)[:2400])
+    return 0 if env.get("success") else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/go/cache/eval.go

@@ -0,0 +1,155 @@
+// Eval — the live ops surface for the Python delegation facade
+// (src/rune/cache.py). `cache eval <ops.json>` reads a JSON array of op
+// dicts and emits one result per op. Each op carries memory_dir (the
+// cache.db parent — the oracle's memory_env.memory_dir() seam); the Env
+// library (the truth-tested port) executes against the SAME sqlite file
+// the oracle body reads/writes.
+//
+// Ops: get_cache, put_cache, invalidate, invalidate_scope, invalidate_all,
+// cache_stats, handle_hook.
+//
+// Fail-loud: unknown op or engine error aborts non-zero; the Python
+// oracle stays behind RUNE_CACHE_ENGINE=python.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+)
+
+// plainJSON converts OrderedMaps/slices to plain JSON-shaped data.
+func plainJSON(v any) any {
+	switch t := v.(type) {
+	case *OrderedMap:
+		out := map[string]any{}
+		for _, k := range t.Keys {
+			out[k] = plainJSON(t.Vals[k])
+		}
+		return out
+	case []any:
+		out := make([]any, 0, len(t))
+		for _, e := range t {
+			out = append(out, plainJSON(e))
+		}
+		return out
+	case []string:
+		out := make([]any, 0, len(t))
+		for _, e := range t {
+			out = append(out, e)
+		}
+		return out
+	default:
+		return v
+	}
+}
+
+func cacheEvalOps(ops []map[string]any) ([]any, string) {
+	out := make([]any, 0, len(ops))
+	for i, op := range ops {
+		name, _ := op["op"].(string)
+		res, emsg := cacheEvalOp(name, op)
+		if emsg != "" {
+			return nil, fmt.Sprintf("op %d (%s): %s", i, name, emsg)
+		}
+		out = append(out, res)
+	}
+	return out, ""
+}
+
+func cacheEvalOp(name string, op map[string]any) (any, string) {
+	dir, _ := op["memory_dir"].(string)
+	if dir == "" {
+		dir = memoryDirFromEnv()
+	}
+	e := NewEnv(dir)
+	switch name {
+	case "get_cache":
+		key, _ := op["key"].(string)
+		if key == "" {
+			return nil, "get_cache: missing key"
+		}
+		res := e.getCache(key)
+		if hit, _ := res.Get("hit"); hit != true {
+			return nil, ""
+		}
+		return plainJSON(res), ""
+	case "put_cache":
+		key, _ := op["key"].(string)
+		value, _ := op["value"].(string)
+		if key == "" {
+			return nil, "put_cache: missing key"
+		}
+		scope, _ := op["scope"].(string)
+		if scope == "" {
+			scope = "general"
+		}
+		sourceHash, _ := op["source_hash"].(string)
+		var compressed *string
+		if c, ok := op["compressed"].(string); ok && c != "" {
+			compressed = &c
+		}
+		return plainJSON(e.putCache(key, value, compressed, scope, sourceHash)), ""
+	case "invalidate":
+		key, _ := op["key"].(string)
+		reason, _ := op["reason"].(string)
+		return plainJSON(e.invalidate(key, reason)), ""
+	case "invalidate_scope":
+		scope, _ := op["scope"].(string)
+		reason, _ := op["reason"].(string)
+		return plainJSON(e.invalidateScope(scope, reason)), ""
+	case "invalidate_all":
+		reason, _ := op["reason"].(string)
+		return plainJSON(e.invalidateAll(reason)), ""
+	case "cache_stats":
+		return plainJSON(e.cacheStats()), ""
+	case "handle_hook":
+		event, _ := op["event"].(string)
+		data := OrderedMapFromMap(map[string]any{})
+		if d, ok := op["data"].(map[string]any); ok {
+			data = OrderedMapFromMap(d)
+		}
+		return plainJSON(e.handleHook(event, data)), ""
+	default:
+		return nil, fmt.Sprintf("unknown op %q", name)
+	}
+}
+
+// runEvalMain — the eval entry, called from main(). Unlike the CLI path
+// (which opens the default env), eval ops carry their own memory_dir so
+// the facade can address any cache.db.
+func runEvalMain(args []string) int {
+	var raw []byte
+	var err error
+	if len(args) > 0 && args[0] != "-" {
+		raw, err = os.ReadFile(args[0])
+	} else {
+		raw, err = io.ReadAll(os.Stdin)
+	}
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "cache eval: %v\n", err)
+		return 2
+	}
+	var ops []map[string]any
+	if jerr := json.Unmarshal(raw, &ops); jerr != nil {
+		fmt.Fprintf(os.Stderr, "cache eval: parse ops: %v\n", jerr)
+		return 2
+	}
+	results, emsg := cacheEvalOps(ops)
+	if emsg != "" {
+		fmt.Fprintf(os.Stderr, "cache eval: %s\n", emsg)
+		return 1
+	}
+	enc, _ := json.Marshal(results)
+	fmt.Println(string(enc))
+	return 0
+}
+
+func OrderedMapFromMap(m map[string]any) *OrderedMap {
+	om := NewOrderedMap()
+	for k, v := range m {
+		om.Set(k, v)
+	}
+	return om
+}

src/go/cache/main.go

@@ -265,6 +265,9 @@ var Plugin = NewOrderedMap(
 )
 
 func main() {
+	if len(os.Args) >= 2 && os.Args[1] == "eval" {
+		os.Exit(runEvalMain(os.Args[2:]))
+	}
 	e := NewEnv(memoryDirFromEnv())
 	defer e.flushStats() // the oracle's atexit.register(flush_stats)
 

src/go/dispatch-classifier/capacity.go

@@ -0,0 +1,119 @@
+package main
+
+// capacity.go — the D56 governor's cap inside the classifier: the
+// PARALLEL verdict becomes throughput-aware by reading the core's
+// hot-state throughput model (~/.rune/hot/
+// provider_throughput.json — the same file the rune-core governor
+// persists). Registry and lock semantics are UNCHANGED: the capacity
+// only annotates the verdict's honesty, never the locks.
+
+import (
+	"encoding/json"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+)
+
+// Capacity is the governor's live snapshot, classifier-shaped.
+type Capacity struct {
+	Known     bool    // the governor has measured something
+	TokPerSec float64 // the headline measured rate (0 with Known=false)
+	LanesFree int     // learned lane caps minus lanes in use
+}
+
+// governorHotShape mirrors the core's persisted hot state (only the
+// fields the cap math needs).
+type governorHotShape struct {
+	Saturation map[string]map[int]float64 `json:"saturation"`
+	Samples    map[string][]struct {
+		At        int64   `json:"at"`
+		TokPerSec float64 `json:"tok_per_sec"`
+		Lanes     int     `json:"lanes"`
+	} `json:"samples"`
+}
+
+// DefaultGovernorHotPath resolves the governor hot file:
+// $RUNE_GOVERNOR_HOT wins, else ~/.rune/hot/provider_throughput.json.
+func DefaultGovernorHotPath() string {
+	if p := os.Getenv("RUNE_GOVERNOR_HOT"); p != "" {
+		return p
+	}
+	home := "~"
+	if u, err := user.Current(); err == nil {
+		home = u.HomeDir
+	}
+	return filepath.Join(home, ".rune", "hot", "provider_throughput.json")
+}
+
+// LoadCapacity reads the governor's hot state into the classifier's
+// capacity view. A missing or corrupt file is capacity-unknown (the
+// verdict stays honest: no throughput claims without measurement).
+// The cap floor mirrors the core's DefaultCapFloor: a lanes bucket
+// whose marginal gain over the previous bucket clears the floor
+// counts toward the pool.
+func LoadCapacity(path string) Capacity {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return Capacity{}
+	}
+	var st governorHotShape
+	if json.Unmarshal(data, &st) != nil {
+		return Capacity{}
+	}
+	cap := Capacity{Known: len(st.Saturation) > 0 || len(st.Samples) > 0}
+	if !cap.Known {
+		return cap
+	}
+	// headline tok/s: the freshest sample anywhere (mirrors the
+	// core's Snapshot law).
+	var freshest int64
+	for _, ss := range st.Samples {
+		for _, s := range ss {
+			if s.At >= freshest {
+				freshest, cap.TokPerSec = s.At, s.TokPerSec
+			}
+		}
+	}
+	const floor = 5.0
+	for _, buckets := range st.Saturation {
+		lanes := make([]int, 0, len(buckets))
+		for l := range buckets {
+			lanes = append(lanes, l)
+		}
+		for i := 0; i < len(lanes); i++ {
+			for j := i + 1; j < len(lanes); j++ {
+				if lanes[j] < lanes[i] {
+					lanes[i], lanes[j] = lanes[j], lanes[i]
+				}
+			}
+		}
+		providerCap := 1
+		prev := buckets[lanes[0]]
+		for _, l := range lanes[1:] {
+			gain := buckets[l] - prev
+			if gain < floor {
+				break
+			}
+			providerCap = l
+			prev = buckets[l]
+		}
+		cap.LanesFree += providerCap
+	}
+	return cap
+}
+
+// annotateParallel makes the PARALLEL verdict throughput-aware: the
+// governor's measured state joins the reason — lanes free at the
+// current tok/s when known, the honest thin-pipe line when the cap
+// leaves nothing free (no false fan-out).
+func annotateParallel(reason string, c Capacity) string {
+	if !c.Known {
+		return reason + " (governor: no throughput measured yet — capacity unknown)"
+	}
+	if c.LanesFree <= 0 {
+		return reason + " (governor: 0 lanes free at current tok/s — the pipe is thin: serialize, no fan-out benefit)"
+	}
+	return reason + " (governor: PARALLEL lane capacity — " +
+		strconv.Itoa(c.LanesFree) + " lanes free at current tok/s)"
+}

src/go/dispatch-classifier/capacity_test.go

@@ -0,0 +1,73 @@
+package main
+
+// capacity_test.go — the D56 classifier-capacity laws: the hot file
+// feeds the PARALLEL annotation, a missing file stays
+// capacity-unknown (honesty: no throughput claims without
+// measurement), and the thin pipe says so instead of fanning out.
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestLoadCapacityMissingFileUnknown(t *testing.T) {
+	c := LoadCapacity(filepath.Join(t.TempDir(), "absent.json"))
+	if c.Known {
+		t.Fatal("capacity invented from a missing file — never guess a rate")
+	}
+}
+
+func TestLoadCapacityReadsHotState(t *testing.T) {
+	dir := t.TempDir()
+	p := filepath.Join(dir, "provider_throughput.json")
+	hot := `{"schema_version":1,
+	  "samples":{"anthropic":[{"at":100,"provider":"anthropic","tok_per_sec":38,"lanes":1}]},
+	  "saturation":{"anthropic":{"1":38,"2":70}}}`
+	if err := os.WriteFile(p, []byte(hot), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	c := LoadCapacity(p)
+	if !c.Known || c.TokPerSec != 38 {
+		t.Fatalf("capacity = %+v, want known with 38 tok/s", c)
+	}
+	if c.LanesFree != 2 {
+		t.Fatalf("lanes free = %d, want 2 (marginal gain 70→38 clears the floor; no 3-lane bucket)", c.LanesFree)
+	}
+}
+
+func TestClassifyCapacityAnnotatesParallel(t *testing.T) {
+	reg := &Registry{Version: 1}
+	now := time.Now().UTC()
+	v := ClassifyCapacity([]string{"src/a/x.go", "src/b/y.go"}, reg, false, now,
+		Capacity{Known: true, TokPerSec: 38, LanesFree: 4})
+	if v.Decision != "PARALLEL" {
+		t.Fatalf("decision = %s, want PARALLEL", v.Decision)
+	}
+	if !strings.Contains(v.Reason, "4 lanes free at current tok/s") {
+		t.Fatalf("verdict not throughput-aware: %s", v.Reason)
+	}
+	// the thin pipe: 0 lanes free — the verdict says so, no false fan-out
+	v = ClassifyCapacity([]string{"src/a/x.go", "src/b/y.go"}, reg, false, now,
+		Capacity{Known: true, TokPerSec: 38, LanesFree: 0})
+	if !strings.Contains(v.Reason, "0 lanes free") || !strings.Contains(v.Reason, "thin") {
+		t.Fatalf("thin pipe not surfaced: %s", v.Reason)
+	}
+	// unknown capacity: honest unknown, no invented rate
+	v = Classify([]string{"src/a/x.go", "src/b/y.go"}, reg, false, now)
+	if !strings.Contains(v.Reason, "no throughput measured yet") {
+		t.Fatalf("unknown capacity not honest: %s", v.Reason)
+	}
+}
+
+func TestClassifyCapacityLeavesLocksUntouched(t *testing.T) {
+	reg := &Registry{Version: 1}
+	now := time.Now().UTC()
+	v := ClassifyCapacity([]string{"src/a/x.go", "src/b/y.go"}, reg, false, now,
+		Capacity{Known: true, TokPerSec: 38, LanesFree: 4})
+	if len(v.Surfaces) != 2 || len(v.LocksToTake) != 2 {
+		t.Fatalf("lock semantics changed by capacity: %+v", v)
+	}
+}

src/go/dispatch-classifier/classify.go

@@ -27,6 +27,15 @@ type Verdict struct {
 //  3. multiple disjoint surfaces → PARALLEL with a suggested split;
 //  4. else SOLO.
 func Classify(candidates []string, reg *Registry, ownerOrigin bool, now time.Time) Verdict {
+	return ClassifyCapacity(candidates, reg, ownerOrigin, now, Capacity{})
+}
+
+// ClassifyCapacity applies the verdict rules with the governor's
+// throughput capacity attached (D56): identical rules and lock
+// semantics — only the PARALLEL verdict's honesty gains the
+// governor's measured lane capacity. A zero Capacity (the classic
+// Classify path) annotates capacity-unknown, never invents a rate.
+func ClassifyCapacity(candidates []string, reg *Registry, ownerOrigin bool, now time.Time, gov Capacity) Verdict {
 	surfaces := maximalSurfaces(normalizeAll(candidates))
 	v := Verdict{
 		Surfaces:    surfaces,
@@ -85,9 +94,9 @@ func Classify(candidates []string, reg *Registry, ownerOrigin bool, now time.Tim
 			lanes[i] = fmt.Sprintf("lane %d: %s", i+1, s)
 		}
 		v.Decision = "PARALLEL"
-		v.Reason = fmt.Sprintf(
+		v.Reason = annotateParallel(fmt.Sprintf(
 			"%d disjoint surfaces, no contention: parallel factory — suggested split: %s",
-			len(surfaces), strings.Join(lanes, "; "))
+			len(surfaces), strings.Join(lanes, "; ")), gov)
 		return v
 	}
 

src/go/dispatch-classifier/main.go

@@ -199,7 +199,8 @@ func cmdClassify() error {
 	if err != nil {
 		return err
 	}
-	v := Classify(brief2candidates(brief, explicit), reg, *ownerOrigin, time.Now().UTC())
+	v := ClassifyCapacity(brief2candidates(brief, explicit), reg, *ownerOrigin, time.Now().UTC(),
+		LoadCapacity(governorHotPath(fs)))
 	out, err := json.MarshalIndent(v, "", "  ")
 	if err != nil {
 		return err
@@ -263,3 +264,12 @@ func defaultAgent() string {
 	}
 	return fmt.Sprintf("%s:%d", host, os.Getpid())
 }
+
+// governorHotPath resolves the governor hot file for the classify
+// verdict (the same $RUNE_GOVERNOR_HOT override law as the registry).
+func governorHotPath(fs *flag.FlagSet) string {
+	if p := os.Getenv("RUNE_GOVERNOR_HOT"); p != "" {
+		return p
+	}
+	return DefaultGovernorHotPath()
+}

src/go/rune-core/internal/runecore/cloud_anthropic.go

@@ -100,7 +100,8 @@ type anthropicChatResponse struct {
 	Model   string                  `json:"model"`
 	Content []anthropicContentBlock `json:"content"`
 	Usage   struct {
-		InputTokens int `json:"input_tokens"`
+		InputTokens  int `json:"input_tokens"`
+		OutputTokens int `json:"output_tokens"`
 	} `json:"usage"`
 }
 
@@ -192,7 +193,7 @@ func (c *AnthropicClient) ChatWithTools(ctx context.Context, model string, msgs
 		return ChatReply{}, fmt.Errorf("%s /v1/messages decode: %w", c.provider, err)
 	}
 	reply := ChatReply{Model: out.Model, ContextLimit: contextLimitFor(c.ctxLimits, model),
-		ContextUsed: out.Usage.InputTokens}
+		ContextUsed: out.Usage.InputTokens, OutputTokens: out.Usage.OutputTokens}
 	var content strings.Builder
 	for _, blk := range out.Content {
 		switch blk.Type {

src/go/rune-core/internal/runecore/cloud_gemini.go

@@ -97,7 +97,8 @@ type geminiChatResponse struct {
 	} `json:"candidates"`
 	ModelVersion  string `json:"modelVersion"`
 	UsageMetadata struct {
-		PromptTokenCount int `json:"promptTokenCount"`
+		PromptTokenCount     int `json:"promptTokenCount"`
+		CandidatesTokenCount int `json:"candidatesTokenCount"`
 	} `json:"usageMetadata"`
 }
 
@@ -208,7 +209,7 @@ func (c *GeminiClient) ChatWithTools(ctx context.Context, model string, msgs []C
 		return ChatReply{}, fmt.Errorf("%s generateContent decode: %w", c.provider, err)
 	}
 	reply := ChatReply{Model: out.ModelVersion, ContextLimit: contextLimitFor(c.ctxLimits, model),
-		ContextUsed: out.UsageMetadata.PromptTokenCount}
+		ContextUsed: out.UsageMetadata.PromptTokenCount, OutputTokens: out.UsageMetadata.CandidatesTokenCount}
 	var content strings.Builder
 	if len(out.Candidates) > 0 {
 		for _, part := range out.Candidates[0].Content.Parts {

src/go/rune-core/internal/runecore/cloud_openai.go

@@ -89,7 +89,8 @@ type oiChatRequest struct {
 type oiChatResponse struct {
 	Model string `json:"model"`
 	Usage struct {
-		PromptTokens int `json:"prompt_tokens"`
+		PromptTokens     int `json:"prompt_tokens"`
+		CompletionTokens int `json:"completion_tokens"`
 	} `json:"usage"`
 	Choices []struct {
 		Message struct {
@@ -190,7 +191,7 @@ func (c *OpenAICompatClient) ChatWithTools(ctx context.Context, model string, ms
 		return ChatReply{}, fmt.Errorf("%s /chat/completions decode: %w", c.provider, err)
 	}
 	reply := ChatReply{Model: out.Model, ContextLimit: contextLimitFor(c.ctxLimits, model),
-		ContextUsed: out.Usage.PromptTokens}
+		ContextUsed: out.Usage.PromptTokens, OutputTokens: out.Usage.CompletionTokens}
 	if len(out.Choices) > 0 {
 		msg := out.Choices[0].Message
 		if msg.Content != nil {

src/go/rune-core/internal/runecore/cloud_stream.go

@@ -86,7 +86,8 @@ func oiDecodeReply(resp *http.Response, model, provider string, ctxLimit int) (C
 type oiStreamChunk struct {
 	Model string `json:"model"`
 	Usage struct {
-		PromptTokens int `json:"prompt_tokens"`
+		PromptTokens     int `json:"prompt_tokens"`
+		CompletionTokens int `json:"completion_tokens"`
 	} `json:"usage"`
 	Choices []struct {
 		Delta struct {
@@ -148,6 +149,9 @@ func (c *OpenAICompatClient) StreamChatWithTools(ctx context.Context, model stri
 		if chunk.Usage.PromptTokens > 0 {
 			reply.ContextUsed = chunk.Usage.PromptTokens
 		}
+		if chunk.Usage.CompletionTokens > 0 {
+			reply.OutputTokens = chunk.Usage.CompletionTokens
+		}
 		if len(chunk.Choices) == 0 {
 			return nil
 		}
@@ -269,6 +273,9 @@ func (c *AnthropicClient) StreamChatWithTools(ctx context.Context, model string,
 				PartialJSON string `json:"partial_json"`
 			} `json:"delta"`
 			Message *anthropicChatResponse `json:"message"`
+			Usage   *struct {
+				OutputTokens int `json:"output_tokens"`
+			} `json:"usage"`
 		}
 		if err := json.Unmarshal([]byte(data), &ev); err != nil {
 			return fmt.Errorf("%s stream decode: %w", c.provider, err)
@@ -279,6 +286,10 @@ func (c *AnthropicClient) StreamChatWithTools(ctx context.Context, model string,
 				reply.Model = ev.Message.Model
 				reply.ContextUsed = ev.Message.Usage.InputTokens
 			}
+		case "message_delta":
+			if ev.Usage != nil && ev.Usage.OutputTokens > 0 {
+				reply.OutputTokens = ev.Usage.OutputTokens
+			}
 		case "content_block_start":
 			if ev.Block != nil && ev.Block.Type == "tool_use" {
 				toolNames[ev.Index] = ev.Block.Name
@@ -348,7 +359,7 @@ func anthropicDecodeReply(resp *http.Response, ctxLimit int, provider string) (C
 	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
 		return ChatReply{}, fmt.Errorf("%s /v1/messages decode: %w", provider, err)
 	}
-	reply := ChatReply{Model: out.Model, ContextLimit: ctxLimit, ContextUsed: out.Usage.InputTokens}
+	reply := ChatReply{Model: out.Model, ContextLimit: ctxLimit, ContextUsed: out.Usage.InputTokens, OutputTokens: out.Usage.OutputTokens}
 	var content strings.Builder
 	for _, blk := range out.Content {
 		switch blk.Type {
@@ -373,7 +384,7 @@ func geminiDecodeReply(resp *http.Response, ctxLimit int, provider string) (Chat
 	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
 		return ChatReply{}, fmt.Errorf("%s generateContent decode: %w", provider, err)
 	}
-	reply := ChatReply{Model: out.ModelVersion, ContextLimit: ctxLimit, ContextUsed: out.UsageMetadata.PromptTokenCount}
+	reply := ChatReply{Model: out.ModelVersion, ContextLimit: ctxLimit, ContextUsed: out.UsageMetadata.PromptTokenCount, OutputTokens: out.UsageMetadata.CandidatesTokenCount}
 	var content strings.Builder
 	if len(out.Candidates) > 0 {
 		for _, part := range out.Candidates[0].Content.Parts {
@@ -455,6 +466,9 @@ func (c *GeminiClient) StreamChatWithTools(ctx context.Context, model string, ms
 		if chunk.UsageMetadata.PromptTokenCount > 0 {
 			reply.ContextUsed = chunk.UsageMetadata.PromptTokenCount
 		}
+		if chunk.UsageMetadata.CandidatesTokenCount > 0 {
+			reply.OutputTokens = chunk.UsageMetadata.CandidatesTokenCount
+		}
 		if len(chunk.Candidates) == 0 {
 			return nil
 		}

src/go/rune-core/internal/runecore/engine.go

@@ -18,6 +18,7 @@ import (
 	"fmt"
 	"strings"
 	"sync"
+	"time"
 )
 
 // ErrChannelBusy refuses a second in-flight turn on one channel — the
@@ -79,6 +80,12 @@ type ChatReply struct {
 	// guesses.
 	ContextUsed  int
 	ContextLimit int
+	// OutputTokens (D56 throughput telemetry): the tokens the provider
+	// says it GENERATED this call (the ollama eval_count, the cloud
+	// usage.completion_tokens family). Zero when the wire carries none
+	// — the governor falls back to the assistant text's token estimate,
+	// never to a guess presented as a measurement.
+	OutputTokens int
 	// ToolCalls (D45 toolset gap): the model's requested tool calls on
 	// THIS response — empty on a final answer. Only ChatWithTools
 	// returns these.
@@ -152,6 +159,11 @@ type Engine struct {
 
 	flightsMu sync.Mutex
 	inFlight  map[string]bool // channel -> a turn is running
+
+	// governor (D56): the provider-aware dispatch governor — learns
+	// tok/s from THIS engine's real turns (hot-state persisted), owns
+	// lane pools and cloud-first routing. Never nil.
+	governor *Governor
 }
 
 // NewEngine builds the engine without a router: the local binding
@@ -159,9 +171,13 @@ type Engine struct {
 // ErrProviderUnrouted. home is the rune home directory holding
 // provider_selection.json (the TUI's first-run law record).
 func NewEngine(store Store, client ModelClient, home string) *Engine {
-	return &Engine{store: store, client: client, home: home, inFlight: map[string]bool{}}
+	return &Engine{store: store, client: client, home: home, inFlight: map[string]bool{}, governor: NewGovernor(home)}
 }
 
+// Governor exposes the engine's governor (the server surface reads it
+// for /v1/status; tests seed it directly).
+func (e *Engine) Governor() *Governor { return e.governor }
+
 // NewRoutedEngine builds the engine with the cloud router attached:
 // the record's Provider field selects the client (the local spellings
 // keep the engine's own client; everything else resolves through the
@@ -325,12 +341,30 @@ func (e *Engine) TurnStream(ctx context.Context, req TurnRequest, sink StreamSin
 		payload = append(payload, cm)
 	}
 
+	provider := "local"
+	if recErr == nil {
+		provider = rec.Provider
+	}
+	if servedByLocalBinding(provider) {
+		provider = "local"
+	}
+	start := time.Now()
 	reply, err := e.runTurn(ctx, client, model, req.Channel, payload, sink)
 	if err != nil {
 		// the user message stays persisted: the user DID send it (the
 		// Python oracle's behavior); the failure is honest, not silent
+		e.governor.RecordError(provider, err)
 		return TurnResult{UserMsgID: userMsg.MsgID, Model: model}, err
 	}
+	// D56 throughput telemetry: the governor learns from the real
+	// turn — the provider's own generated-token accounting when the
+	// wire carries it, the assistant text's token estimate otherwise
+	// (an honest estimate, never presented as a wire measurement).
+	outTokens := reply.OutputTokens
+	if outTokens <= 0 {
+		outTokens = tokenEstimate(reply.Content)
+	}
+	e.governor.RecordTurn(provider, model, outTokens, time.Since(start), 1)
 
 	assistant := Message{
 		MsgID:         newMsgID(),

src/go/rune-core/internal/runecore/governor.go

@@ -0,0 +1,481 @@
+package runecore
+
+// governor.go — the provider-aware dispatch governor (Gitea #2580 +
+// #2581, owner doctrine 2026-10-24: CLOUD-FIRST routing — cloud lanes
+// fill FIRST, speed is the priority; local absorbs only overflow; a
+// configured provider is spend-freely authorized, no consent gates).
+//
+// Everything here is learned from PRODUCTION samples (the engine's
+// real turn accounting): no synthetic benchmarks, no guessed curves.
+// Per-provider rolling samples persist under the hot-state pattern
+// (~/.rune/hot/provider_throughput.json) so the model survives
+// restarts.
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+// HotThroughputFile is the hot-state path, relative to the rune home:
+// per-provider rolling throughput samples + the learned saturation
+// curve (the same survives-restart pattern as task_state.json).
+const HotThroughputFile = "hot/provider_throughput.json"
+
+// sampleWindow is the rolling sample cap per provider (the model is
+// small and local: recent behavior only).
+const sampleWindow = 256
+
+// DefaultCapFloor is the default marginal tok/s gain below which
+// another lane is judged useless (configurable: RUNE_GOVERNOR_CAP_FLOOR).
+const DefaultCapFloor = 5.0
+
+// ThroughputSample is one production measurement: tokens the provider
+// actually generated in the wall time it took, at the lane count the
+// provider was serving.
+type ThroughputSample struct {
+	At        int64   `json:"at"` // unix seconds
+	Provider  string  `json:"provider"`
+	Model     string  `json:"model,omitempty"`
+	TokPerSec float64 `json:"tok_per_sec"`
+	Lanes     int     `json:"lanes"`
+}
+
+// ProviderHealth is the connection-health row (#2581): what the
+// governor actually knows about one provider's liveness.
+type ProviderHealth struct {
+	Reachable      bool    `json:"reachable"`
+	Authenticated  bool    `json:"authenticated"`
+	ErrorRate      float64 `json:"error_rate"` // recent errors / attempts
+	TokPerSec      float64 `json:"tok_per_sec"`
+	LanesActive    int     `json:"lanes_active"`
+	LanesCap       int     `json:"lanes_cap"`
+	ThrottledUntil int64   `json:"throttled_until,omitempty"` // unix secs; a 429 ceiling
+	LastSeen       int64   `json:"last_seen,omitempty"`
+	LastError      string  `json:"last_error,omitempty"`
+}
+
+// GovernorSnapshot is the honest external face: /v1/status's governor
+// section and the TUI's readout all render THIS — never more than the
+// governor measured.
+type GovernorSnapshot struct {
+	TokensPerSec float64                   `json:"tokens_per_sec"` // 0 = nothing measured yet
+	LanesActive  int                       `json:"lanes_active"`
+	LanesCap     int                       `json:"lanes_cap"`
+	Providers    map[string]ProviderHealth `json:"providers"`
+}
+
+// governorState is the persisted hot-state shape.
+type governorState struct {
+	SchemaVersion int                           `json:"schema_version"`
+	Samples       map[string][]ThroughputSample `json:"samples"`
+	// saturation is the learned curve: (provider, lanes) → EMA tok/s.
+	Saturation map[string]map[int]float64 `json:"saturation"`
+}
+
+// Governor is the dispatch governor. Zero-value is usable but inert;
+// NewGovernor loads the persisted hot state.
+type Governor struct {
+	mu        sync.Mutex
+	home      string
+	state     governorState
+	health    map[string]*ProviderHealth
+	attempts  map[string]int
+	errors    map[string]int
+	lanes     map[string]int // provider -> active lanes
+	lastOrder []string       // most-recently-used providers (the snapshot's headline tok/s)
+	probed    bool           // at least one health probe ran in this process
+	floor     float64
+}
+
+// GovernorCapFloorEnv resizes the marginal-gain floor (tok/s).
+const GovernorCapFloorEnv = "RUNE_GOVERNOR_CAP_FLOOR"
+
+// NewGovernor builds a governor rooted at home (the rune home dir),
+// loading any persisted hot state. A missing or corrupt file is an
+// empty model, never an error (the hot-state freshness law).
+func NewGovernor(home string) *Governor {
+	g := &Governor{
+		home: home,
+		state: governorState{
+			SchemaVersion: 1,
+			Samples:       map[string][]ThroughputSample{},
+			Saturation:    map[string]map[int]float64{},
+		},
+		health:   map[string]*ProviderHealth{},
+		attempts: map[string]int{},
+		errors:   map[string]int{},
+		lanes:    map[string]int{},
+		floor:    DefaultCapFloor,
+	}
+	if v := strings.TrimSpace(os.Getenv(GovernorCapFloorEnv)); v != "" {
+		if f, err := parsePositiveFloat(v); err == nil && f > 0 {
+			g.floor = f
+		}
+	}
+	g.load()
+	return g
+}
+
+func parsePositiveFloat(s string) (float64, error) {
+	var f float64
+	_, err := fmt.Sscanf(s, "%g", &f)
+	return f, err
+}
+
+func (g *Governor) hotPath() string {
+	return filepath.Join(g.home, HotThroughputFile)
+}
+
+func (g *Governor) load() {
+	data, err := os.ReadFile(g.hotPath())
+	if err != nil {
+		return
+	}
+	var st governorState
+	if json.Unmarshal(data, &st) != nil || st.Samples == nil {
+		return
+	}
+	if st.Saturation == nil {
+		st.Saturation = map[string]map[int]float64{}
+	}
+	g.state = st
+}
+
+// persist writes the hot state atomically (temp + rename — a reader
+// never sees a torn file). Best-effort: telemetry must never break a
+// turn.
+func (g *Governor) persist() {
+	data, err := json.Marshal(g.state)
+	if err != nil {
+		return
+	}
+	path := g.hotPath()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return
+	}
+	tmp := path + ".tmp"
+	if err := os.WriteFile(tmp, data, 0o600); err != nil {
+		return
+	}
+	_ = os.Rename(tmp, path)
+}
+
+// RecordTurn samples one completed turn: the provider that served it,
+// the tokens it generated (the client's own accounting; the engine's
+// honest token-estimate fallback when the wire carries none), the wall
+// duration, and the lane count it served at. This is the ONLY way the
+// model learns — production samples, never benchmarks.
+func (g *Governor) RecordTurn(provider, model string, outputTokens int, dur time.Duration, lanes int) {
+	if provider == "" {
+		provider = "local"
+	}
+	if lanes < 1 {
+		lanes = 1
+	}
+	if outputTokens <= 0 || dur <= 0 {
+		return // nothing measurable — the model never invents a rate
+	}
+	tps := float64(outputTokens) / dur.Seconds()
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	now := time.Now().Unix()
+	s := ThroughputSample{At: now, Provider: provider, Model: model, TokPerSec: tps, Lanes: lanes}
+	samples := append(g.state.Samples[provider], s)
+	if len(samples) > sampleWindow {
+		samples = samples[len(samples)-sampleWindow:]
+	}
+	g.state.Samples[provider] = samples
+	// the saturation point: EMA over the lanes bucket (smooth, small)
+	b := g.state.Saturation[provider]
+	if b == nil {
+		b = map[int]float64{}
+	}
+	b[lanes] = ema(b[lanes], tps)
+	g.state.Saturation[provider] = b
+	h := g.health[provider]
+	if h == nil {
+		h = &ProviderHealth{}
+		g.health[provider] = h
+	}
+	h.Reachable, h.Authenticated = true, true
+	h.TokPerSec = b[lanes]
+	h.LastSeen = now
+	h.LastError = ""
+	g.touchOrder(provider)
+	g.persist()
+}
+
+// RecordError marks a failed attempt against a provider (the health
+// row's error rate).
+func (g *Governor) RecordError(provider string, err error) {
+	if provider == "" {
+		provider = "local"
+	}
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.attempts[provider]++
+	g.errors[provider]++
+	h := g.health[provider]
+	if h == nil {
+		h = &ProviderHealth{}
+		g.health[provider] = h
+	}
+	h.Reachable = false
+	h.LastError = fmt.Sprint(err)
+	if g.attempts[provider] > 0 {
+		h.ErrorRate = float64(g.errors[provider]) / float64(g.attempts[provider])
+	}
+}
+
+// MarkThrottled records a 429: the published TPM/RPM ceiling just bit.
+// A throttled provider is WORSE than not spawning — routes refuse it
+// until the window lapses.
+func (g *Governor) MarkThrottled(provider string, until time.Time) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	h := g.health[provider]
+	if h == nil {
+		h = &ProviderHealth{}
+		g.health[provider] = h
+	}
+	h.ThrottledUntil = until.Unix()
+}
+
+// AcquireLane takes one lane on a provider (the pool's in-use count).
+func (g *Governor) AcquireLane(provider string) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.lanes[provider]++
+}
+
+// ReleaseLane returns one lane.
+func (g *Governor) ReleaseLane(provider string) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.lanes[provider] > 0 {
+		g.lanes[provider]--
+	}
+}
+
+// SaturationCap answers the lane cap for a provider: the highest lane
+// count whose MARGINAL tok/s gain still clears the floor. With no
+// curve learned, the honest cap is 1 (never invent headroom).
+func (g *Governor) SaturationCap(provider string) int {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.saturationCapLocked(provider)
+}
+
+func (g *Governor) saturationCapLocked(provider string) int {
+	b := g.state.Saturation[provider]
+	if len(b) == 0 {
+		return 1
+	}
+	lanes := sortedLanes(b)
+	cap := 1
+	prev := b[lanes[0]]
+	for _, l := range lanes[1:] {
+		gain := b[l] - prev
+		if gain < g.floor {
+			break
+		}
+		cap = l
+		prev = b[l]
+	}
+	return cap
+}
+
+func sortedLanes(b map[int]float64) []int {
+	out := make([]int, 0, len(b))
+	for l := range b {
+		out = append(out, l)
+	}
+	sort.Ints(out)
+	return out
+}
+
+// Route applies the owner doctrine: CLOUD-FIRST — among healthy
+// candidates, every cloud provider (a non-local binding; configured
+// providers are spend-authorized, no consent gates) fills its lane
+// pool BEFORE any local provider absorbs overflow. Within a tier the
+// least-loaded provider wins (lanes/cap ratio). Unhealthy or
+// throttled providers are refused outright (route only to providers
+// actually alive). The second return is false when NO candidate is
+// healthy — the thin-pipe honesty case.
+func (g *Governor) Route(candidates []string) (ordered []string, healthy bool) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	var cloud, local []string
+	now := time.Now().Unix()
+	key := func(p string) float64 {
+		h := g.health[p]
+		c := 1
+		if h != nil && h.LanesCap > 0 {
+			c = h.LanesCap
+		}
+		return float64(g.lanes[p]) / float64(c)
+	}
+	less := func(a, b string) bool { return key(a) < key(b) }
+	for _, p := range candidates {
+		h := g.health[p]
+		if h != nil {
+			if !h.Reachable || (h.ThrottledUntil > 0 && h.ThrottledUntil > now) {
+				continue // not alive / 429'd — worse than not spawning
+			}
+		} else if g.probed {
+			// Health telemetry is live and this provider never came
+			// back alive: refuse it (#2581 — route only to providers
+			// actually alive). Before any probe ran, day-one routing
+			// passes candidates through (never refuse what we never
+			// asked).
+			continue
+		}
+		if servedByLocalBinding(p) {
+			local = append(local, p)
+		} else {
+			cloud = append(cloud, p)
+		}
+	}
+	sort.Slice(cloud, func(i, j int) bool { return less(cloud[i], cloud[j]) })
+	sort.Slice(local, func(i, j int) bool { return less(local[i], local[j]) })
+	ordered = append(cloud, local...)
+	return ordered, len(ordered) > 0
+}
+
+// MarkReachable records a health probe outcome (#2581): reachable is
+// the probe's liveness verdict, authenticated whether the wire
+// accepted the key.
+func (g *Governor) MarkReachable(provider string, reachable, authenticated bool) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	h := g.health[provider]
+	if h == nil {
+		h = &ProviderHealth{}
+		g.health[provider] = h
+	}
+	h.Reachable = reachable
+	h.Authenticated = authenticated
+	if reachable {
+		h.LastSeen = time.Now().Unix()
+		h.LastError = ""
+	}
+	g.probed = true
+}
+
+func (g *Governor) touchOrder(p string) {
+	for i, q := range g.lastOrder {
+		if q == p {
+			g.lastOrder = append(g.lastOrder[:i], g.lastOrder[i+1:]...)
+			break
+		}
+	}
+	g.lastOrder = append(g.lastOrder, p)
+}
+
+// Snapshot renders the honest state: the headline tok/s is the most
+// recently sampled provider's current rate (0 when nothing was ever
+// measured — the bar shows '—', never a guess); lanes are the global
+// active count against the sum of the pools' caps.
+func (g *Governor) Snapshot() GovernorSnapshot {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	snap := GovernorSnapshot{Providers: map[string]ProviderHealth{}}
+	for p, h := range g.health {
+		row := *h
+		row.LanesCap = g.saturationCapLocked(p)
+		row.LanesActive = g.lanes[p]
+		snap.Providers[p] = row
+	}
+	// headline tok/s: the freshest sample's provider, at the lane
+	// count we actually run there — persisted state survives restarts
+	// (lastOrder doesn't), so the read comes from the samples.
+	var freshestP string
+	var freshestAt int64
+	for p, ss := range g.state.Samples {
+		if len(ss) == 0 {
+			continue
+		}
+		if last := ss[len(ss)-1]; last.At >= freshestAt {
+			freshestAt, freshestP = last.At, p
+		}
+	}
+	if freshestP != "" {
+		lanes := g.lanes[freshestP]
+		if lanes < 1 {
+			lanes = 1
+		}
+		b := g.state.Saturation[freshestP]
+		if v, ok := b[lanes]; ok {
+			snap.TokensPerSec = v
+		} else if len(b) > 0 {
+			for _, l := range sortedLanes(b) {
+				snap.TokensPerSec = b[l] // fall back to the freshest learned bucket
+			}
+		}
+	}
+	for p := range g.state.Saturation {
+		if _, ok := snap.Providers[p]; !ok {
+			cap := g.saturationCapLocked(p)
+			snap.Providers[p] = ProviderHealth{Reachable: true, Authenticated: true, LanesCap: cap, LanesActive: g.lanes[p]}
+		}
+		snap.LanesActive += g.lanes[p]
+		snap.LanesCap += g.saturationCapLocked(p)
+	}
+	return snap
+}
+
+// ema is the one-pole smooth: alpha small enough to ignore a single
+// outlier, big enough to track a real shift within a few turns.
+func ema(prev, next float64) float64 {
+	if prev == 0 {
+		return next
+	}
+	const alpha = 0.3
+	return prev + alpha*(next-prev)
+}
+
+// PollRegistryHealth probes every enabled, URL-bearing provider in
+// the landed registry (#2581): a cheap GET against the provider's
+// wire base with a short timeout. The verdict lands through
+// MarkReachable — reachable = the probe answered, authenticated = a
+// key ref is wired (the probe proves the WIRE, the ref proves the
+// credential is configured; a real 401 surfaces as an error sample).
+// Returns the number of providers probed.
+func (g *Governor) PollRegistryHealth(path string, timeout time.Duration) int {
+	rows, err := LoadProviderRegistry(path)
+	if err != nil {
+		return 0
+	}
+	probed := 0
+	for _, e := range rows {
+		if !e.Enabled || strings.TrimSpace(e.BaseURL()) == "" {
+			continue
+		}
+		client := &http.Client{Timeout: timeout}
+		resp, perr := client.Get(strings.TrimRight(e.BaseURL(), "/") + "/models")
+		if perr != nil {
+			g.RecordError(e.Name, perr)
+			g.MarkReachable(e.Name, false, e.APIKeyRef != "")
+			probed++
+			continue
+		}
+		resp.Body.Close()
+		g.MarkReachable(e.Name, true, e.APIKeyRef != "")
+		probed++
+	}
+	return probed
+}
+
+// HealthPollInterval is the live-state cadence.
+const HealthPollInterval = 60 * time.Second
+
+// isCloudProvider answers the doctrine's tier split: anything NOT a
+// local binding is cloud (the same law the engine's router uses).
+func isCloudProvider(p string) bool { return !servedByLocalBinding(p) }

src/go/rune-core/internal/runecore/governor_test.go

@@ -0,0 +1,137 @@
+package runecore
+
+// governor_test.go — the D56 governor's frozen laws: production-only
+// samples (a turn with no tokens is never a sample), the honest cap
+// (no curve = 1 lane, never invented headroom), cloud-first ordering
+// with health-gating and 429 refusal, and hot-state persistence.
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestGovernorRecordTurnSamplesAndPersists(t *testing.T) {
+	home := t.TempDir()
+	g := NewGovernor(home)
+	g.RecordTurn("anthropic", "claude-x", 300, 10*time.Second, 1)
+	snap := g.Snapshot()
+	if snap.TokensPerSec != 30 {
+		t.Fatalf("tok/s = %v, want 30", snap.TokensPerSec)
+	}
+	// hot state: a fresh governor over the same home sees the curve
+	if _, err := os.Stat(filepath.Join(home, HotThroughputFile)); err != nil {
+		t.Fatalf("hot state not persisted: %v", err)
+	}
+	g2 := NewGovernor(home)
+	if got := g2.SaturationCap("anthropic"); got < 1 {
+		t.Fatalf("cap after one sample = %d, want >=1", got)
+	}
+	if g2.Snapshot().TokensPerSec == 0 {
+		t.Fatal("reloaded governor lost the measured tok/s")
+	}
+}
+
+func TestGovernorNoTokensNoSample(t *testing.T) {
+	home := t.TempDir()
+	g := NewGovernor(home)
+	g.RecordTurn("anthropic", "m", 0, time.Second, 1)
+	if snap := g.Snapshot(); snap.TokensPerSec != 0 || len(snap.Providers) != 0 {
+		t.Fatalf("zero-token turn invented a sample: %+v", snap)
+	}
+}
+
+func TestGovernorCapHonestWithoutCurve(t *testing.T) {
+	home := t.TempDir()
+	g := NewGovernor(home)
+	if got := g.SaturationCap("never-measured"); got != 1 {
+		t.Fatalf("cap with no curve = %d, want 1 (never invent headroom)", got)
+	}
+}
+
+func TestGovernorCapFromMarginalGain(t *testing.T) {
+	home := t.TempDir()
+	g := NewGovernor(home)
+	// 1 lane: 40 tok/s; 2 lanes: 70 (gain 30 >= floor); 3 lanes: 72
+	// (gain 2 < floor) — the cap is 2 lanes.
+	g.RecordTurn("p", "m", 400, 10*time.Second, 1)
+	g.RecordTurn("p", "m", 700, 10*time.Second, 2)
+	g.RecordTurn("p", "m", 720, 10*time.Second, 3)
+	if got := g.SaturationCap("p"); got != 2 {
+		t.Fatalf("cap = %d, want 2 (marginal gain at 3 lanes below the floor)", got)
+	}
+}
+
+func TestGovernorRouteCloudFirstAndHealthGated(t *testing.T) {
+	home := t.TempDir()
+	g := NewGovernor(home)
+	g.MarkReachable("ollama", true, true)
+	g.MarkReachable("anthropic", true, true)
+	g.MarkReachable("openai", true, true)
+	g.MarkReachable("deadcloud", false, false)
+	ordered, healthy := g.Route([]string{"ollama", "anthropic", "openai", "deadcloud"})
+	if !healthy {
+		t.Fatal("healthy candidates exist; Route lied about the thin pipe")
+	}
+	// cloud-first: both cloud rows precede local; deadcloud refused.
+	foundCloud, foundLocal, sawDead := 0, 0, false
+	for i, p := range ordered {
+		switch p {
+		case "anthropic", "openai":
+			foundCloud++
+			if foundLocal > 0 {
+				t.Fatalf("cloud row %s routed after local — doctrine broken (order %v)", p, ordered)
+			}
+		case "ollama":
+			foundLocal++
+		case "deadcloud":
+			sawDead = true
+		}
+		_ = i
+	}
+	if foundCloud != 2 || foundLocal != 1 || sawDead {
+		t.Fatalf("route order wrong: %v", ordered)
+	}
+	// 429 throttle = worse than not spawning
+	g.MarkThrottled("openai", time.Now().Add(time.Hour))
+	ordered, _ = g.Route([]string{"openai"})
+	if len(ordered) != 0 {
+		t.Fatalf("throttled provider routed: %v", ordered)
+	}
+}
+
+func TestGovernorThinPipeHonesty(t *testing.T) {
+	home := t.TempDir()
+	g := NewGovernor(home)
+	// health telemetry live: the probe ran, the provider never came
+	// back alive — the route must refuse and report the thin pipe.
+	g.MarkReachable("ollama", false, false)
+	_, healthy := g.Route([]string{"ollama"})
+	if healthy {
+		t.Fatal("dead provider routed: Route must report the thin pipe")
+	}
+	// day-one honesty in the other direction: before ANY probe ran,
+	// routing passes through (never refuse what we never asked).
+	fresh := NewGovernor(t.TempDir())
+	_, healthy = fresh.Route([]string{"ollama"})
+	if !healthy {
+		t.Fatal("pre-probe routing must pass through, not refuse")
+	}
+}
+
+func TestGovernorLanesCount(t *testing.T) {
+	home := t.TempDir()
+	g := NewGovernor(home)
+	g.RecordTurn("anthropic", "m", 100, time.Second, 1)
+	g.AcquireLane("anthropic")
+	g.AcquireLane("anthropic")
+	snap := g.Snapshot()
+	if snap.Providers["anthropic"].LanesActive != 2 || snap.LanesActive != 2 {
+		t.Fatalf("lanes = %+v, want 2", snap)
+	}
+	g.ReleaseLane("anthropic")
+	if snap := g.Snapshot(); snap.Providers["anthropic"].LanesActive != 1 {
+		t.Fatalf("lanes after release = %d, want 1", snap.Providers["anthropic"].LanesActive)
+	}
+}

src/go/rune-core/internal/runecore/ollama.go

@@ -133,7 +133,7 @@ func (c *OllamaClient) ChatWithTools(ctx context.Context, model string, msgs []C
 	// server-side for qwen3-family even without think:true).
 	visible, inline := splitInlineThinking(out.Message.Content)
 	reply := ChatReply{Content: visible, Model: out.Model,
-		ContextUsed: out.PromptEvalCount}
+		ContextUsed: out.PromptEvalCount, OutputTokens: out.EvalCount}
 	for _, tc := range out.Message.ToolCalls {
 		call := ToolCall{Name: tc.Function.Name}
 		if len(tc.Function.Arguments) > 0 {
@@ -323,7 +323,7 @@ func (c *OllamaClient) StreamChatWithTools(ctx context.Context, model string, ms
 		return ChatReply{}, w.err(fmt.Errorf("ollama stream read: %w", err), idle)
 	}
 	visible, inline := splitInlineThinking(content.String())
-	reply := ChatReply{Content: visible, Model: last.Model, ContextUsed: last.PromptEvalCount}
+	reply := ChatReply{Content: visible, Model: last.Model, ContextUsed: last.PromptEvalCount, OutputTokens: last.EvalCount}
 	reply.ToolCalls = toolCalls
 	reply.ContextLimit = c.contextLimit(ctx, model)
 	if thinking.Len() > 0 {

src/go/rune-core/internal/runecore/registry.go

@@ -38,6 +38,16 @@ type RegistryModel struct {
 	ContextLimit int // the row's limit.context; 0 = the row records none
 }
 
+// BaseURL is the provider's wire base: the migrated /v1-bearing
+// SourceBaseURL when present, the raw URL otherwise ("" when the row
+// carries none).
+func (e ProviderRegistryEntry) BaseURL() string {
+	if e.SourceBaseURL != "" {
+		return e.SourceBaseURL
+	}
+	return e.URL
+}
+
 // DefaultProviderRegistryPath resolves the registry file by the
 // migration's own law (the TUI's registry.go mirror): RUNE_REGISTRY_
 // CONFIG overrides, the user config dir's rune/providers.json is the

src/go/rune-core/internal/runecore/server.go

@@ -120,9 +120,18 @@ func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
 		// (used = tokens sent, limit = the model's budget). Absent
 		// until the first turn — the bar never guesses.
 		"context": map[string]int{"used": ctxUsed, "limit": ctxLimit},
+		// D56 dispatch governor: the honest live state — measured tok/s
+		// (0 = nothing measured yet; the bar renders '—', never a
+		// guess), lanes in use against the learned cap, and the
+		// per-provider health rows (#2581).
+		"governor": s.engine.Governor().Snapshot(),
 	})
 }
 
+// Engine exposes the served engine (main.go wires the governor's
+// health poll through it).
+func (s *Server) Engine() *Engine { return s.engine }
+
 // handleHealth: the core's own liveness + identity.
 func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 	var model string

src/go/rune-core/main.go

@@ -115,6 +115,18 @@ func main() {
 	router := runecore.NewProviderRouter(runecore.SecretToolReader())
 	srv := runecore.NewServer(runecore.NewRoutedEngine(st, client, home, router), client, home)
 
+	// D56 connection health (#2581): poll the registry's providers'
+	// live state so the governor routes only to providers actually
+	// alive — once at boot, then on the health cadence.
+	gov := srv.Engine().Governor()
+	go func() {
+		registry := runecore.DefaultProviderRegistryPath()
+		for {
+			gov.PollRegistryHealth(registry, 5*time.Second)
+			time.Sleep(runecore.HealthPollInterval)
+		}
+	}()
+
 	addr := fmt.Sprintf("%s:%d", host, port)
 	httpSrv := &http.Server{Addr: addr, Handler: srv.Handler()}
 

src/rune/__init__.py

@@ -6,7 +6,7 @@ This is the main entry point for the Rune program.
 import json
 from pathlib import Path
 
-__version__ = "0.351.0"
+__version__ = "0.353.0"
 
 # One build identity (handoff 2026-09-10 §4): the semantic version above is
 # the repo-level truth (auto-bumped at merge); the DEPLOYED revision (exact

src/rune/cache.py

@@ -26,6 +26,66 @@ import sqlite3
 import sys
 import threading
 import time
+
+import subprocess
+import tempfile
+
+# ---------------------------------------------------------------------------
+# Fail-loud Go delegation (REBASE-COMPLETION, #2587 wave): the cache seam
+# operations resolve through the Go engine (src/go/cache, `eval
+# <ops.json>` surface) against the SAME cache.db the oracle body
+# reads/writes. Python bodies kept as oracle/escape hatch
+# (RUNE_CACHE_ENGINE=python); RUNE_CACHE_BIN overrides the binary.
+# Missing binary or engine error raises RuntimeError — no silent
+# fallback (house shape: model_routing.reconcile_tools_support).
+# ---------------------------------------------------------------------------
+
+
+def _go_engine_enabled() -> bool:
+    return os.environ.get("RUNE_CACHE_ENGINE", "go") != "python"
+
+
+def _go_engine_bin() -> str:
+    override = os.environ.get("RUNE_CACHE_BIN")
+    if override:
+        return override
+    root = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    return os.path.join(root, "src", "go", "cache", "cache-bin")
+
+
+def _go_eval(ops: list) -> list:
+    bin_path = _go_engine_bin()
+    if not os.path.exists(bin_path):
+        raise RuntimeError(
+            f"cache go engine binary missing: {bin_path} (set RUNE_CACHE_ENGINE=python for the legacy path)"
+        )
+    fd, ops_path = tempfile.mkstemp(suffix=".json", prefix="cache-ops-")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            json.dump(ops, fh)
+        try:
+            proc = subprocess.run(
+                [bin_path, "eval", ops_path],
+                capture_output=True,
+                text=True,
+                timeout=60,
+            )
+        except (OSError, subprocess.TimeoutExpired) as exc:
+            raise RuntimeError(f"cache go engine failed: {exc}") from exc
+        if proc.returncode != 0:
+            raise RuntimeError(f"cache go engine exit {proc.returncode}: {proc.stderr.strip()}")
+        return json.loads(proc.stdout)
+    finally:
+        try:
+            os.unlink(ops_path)
+        except OSError:
+            pass
+
+
+def _memory_dir() -> str:
+    return memory_env.memory_dir()
+
+
 from datetime import datetime, timezone
 
 _SD = os.path.dirname(os.path.abspath(__file__))
@@ -183,6 +243,16 @@ def get_cache(key):
     Hit/miss statistics are accumulated in memory and flushed to SQLite
     periodically (every 50 events or 30 seconds) to avoid write-on-read.
     """
+    if _go_engine_enabled():
+        row = _go_eval([{"op": "get_cache", "memory_dir": _memory_dir(), "key": key}])[0]
+        if row is None:
+            return {"hit": False, "key": key}
+        return row
+    return _get_cache_python(key)
+
+
+def _get_cache_python(key):
+    """Oracle body (kept as escape/oracle; see module header)."""
     db = connect()
     try:
         row = db.execute("SELECT * FROM cache WHERE key=? AND invalidated_at IS NULL", (key,)).fetchone()
@@ -225,6 +295,26 @@ def put_cache(key, value, compressed=None, scope="general", source_hash=""):
 
     Uses INSERT … ON CONFLICT to update content without resetting hit/miss stats.
     """
+    if _go_engine_enabled():
+        flush_stats()
+        return _go_eval(
+            [
+                {
+                    "op": "put_cache",
+                    "memory_dir": _memory_dir(),
+                    "key": key,
+                    "value": value,
+                    "compressed": compressed or "",
+                    "scope": scope,
+                    "source_hash": source_hash,
+                }
+            ]
+        )[0]
+    return _put_cache_python(key, value, compressed=compressed, scope=scope, source_hash=source_hash)
+
+
+def _put_cache_python(key, value, compressed=None, scope="general", source_hash=""):
+    """Oracle body (kept as escape/oracle; see module header)."""
     # Flush any pending stats before writing so we don't lose counts
     flush_stats()
 
@@ -259,6 +349,13 @@ def put_cache(key, value, compressed=None, scope="general", source_hash=""):
 
 def invalidate(key, reason=""):
     """Invalidate a specific cache entry."""
+    if _go_engine_enabled():
+        return _go_eval([{"op": "invalidate", "memory_dir": _memory_dir(), "key": key, "reason": reason}])[0]
+    return _invalidate_python({"op": "invalidate", "memory_dir": _memory_dir(), "key": key, "reason": reason})
+
+
+def _invalidate_python(key, reason=""):
+    """Oracle body (kept as escape/oracle; see module header)."""
     db = connect()
     db.execute("UPDATE cache SET invalidated_at=? WHERE key=? AND invalidated_at IS NULL", (_now(), key))
     db.commit()
@@ -268,6 +365,15 @@ def invalidate(key, reason=""):
 
 def invalidate_scope(scope, reason=""):
     """Invalidate all entries in a scope."""
+    if _go_engine_enabled():
+        return _go_eval([{"op": "invalidate_scope", "memory_dir": _memory_dir(), "scope": scope, "reason": reason}])[0]
+    return _invalidate_scope_python(
+        {"op": "invalidate_scope", "memory_dir": _memory_dir(), "scope": scope, "reason": reason}
+    )
+
+
+def _invalidate_scope_python(scope, reason=""):
+    """Oracle body (kept as escape/oracle; see module header)."""
     db = connect()
     count = db.execute(
         "UPDATE cache SET invalidated_at=? WHERE scope=? AND invalidated_at IS NULL", (_now(), scope)
@@ -279,6 +385,13 @@ def invalidate_scope(scope, reason=""):
 
 def invalidate_all(reason=""):
     """Invalidate everything. Nuclear option."""
+    if _go_engine_enabled():
+        return _go_eval([{"op": "invalidate_all", "memory_dir": _memory_dir(), "reason": reason}])[0]
+    return _invalidate_all_python({"op": "invalidate_all", "memory_dir": _memory_dir(), "reason": reason})
+
+
+def _invalidate_all_python(reason=""):
+    """Oracle body (kept as escape/oracle; see module header)."""
     db = connect()
     count = db.execute("UPDATE cache SET invalidated_at=? WHERE invalidated_at IS NULL", (_now(),)).rowcount
     db.commit()
@@ -350,6 +463,14 @@ def _parse_ts(ts_str):
 
 def cache_stats():
     """Return cache statistics (includes in-memory pending counts)."""
+    if _go_engine_enabled():
+        flush_stats()
+        return _go_eval([{"op": "cache_stats", "memory_dir": _memory_dir()}])[0]
+    return _cache_stats_python()
+
+
+def _cache_stats_python():
+    """Oracle body (kept as escape/oracle; see module header)."""
     # Flush pending counts first so stats are fully accurate
     flush_stats()
 
@@ -380,6 +501,22 @@ def cache_stats():
 
 def handle_hook(event, data=None):
     """Event-driven invalidation. Subscribe to event bus events."""
+    if _go_engine_enabled():
+        return _go_eval(
+            [
+                {
+                    "op": "handle_hook",
+                    "memory_dir": _memory_dir(),
+                    "event": event,
+                    "data": data or {},
+                }
+            ]
+        )[0]
+    return _handle_hook_python(event, data)
+
+
+def _handle_hook_python(event, data=None):
+    """Oracle body (kept as escape/oracle; see module header)."""
     if event in INVALIDATION_MAP:
         scopes = INVALIDATION_MAP[event]
         invalidated = 0

src/rune/canary_gitea_automation.py

@@ -233,7 +233,7 @@ def main() -> int:
     )
     check(
         "Rune minor version advertises provisioning and restore verification",
-        '__version__ = "0.351.0"' in rune_version,
+        '__version__ = "0.353.0"' in rune_version,
         failures,
     )
     # #169 policy update: auto-bump on merge is sanctioned (Nick directive:

src/rune/rune_tui.py

@@ -8,7 +8,7 @@ mode system, subject header, shared memory and identity.
 
 This is not an interface. This is how I see, speak, and interact with the world.
 
-Version: v0.351.0
+Version: v0.353.0
 Features: 41 (24 original + 17 new native commands)
 
 Usage:
@@ -2047,7 +2047,7 @@ class RuneApp(App):
         # Show version info
         self.chat_channel.add_message(
             "system",
-            f"[dim]Rune v0.351.0 | Textual TUI | {len(loaded)} native modules[/dim]",
+            f"[dim]Rune v0.353.0 | Textual TUI | {len(loaded)} native modules[/dim]",
         )
 
         # Auto-show night mode suggestion if evening/night hours

store/scaffold/segments/entities/contract__ADMIT-wave-d56-governor.json

@@ -0,0 +1,173 @@
+{
+ "checkpoints": [
+  {
+   "at": "2026-10-25T00:44:54Z",
+   "evidence": "predicted-frontier",
+   "note": "{\"level0_direct\": [], \"level1_obligations\": [], \"contracts\": [], \"level2_verification\": []}",
+   "phase": "draft"
+  },
+  {
+   "at": "2026-10-25T00:45:17Z",
+   "evidence": "user:D56 directive 2026-10-24 (Gitea #2580 + #2581)",
+   "note": "",
+   "phase": "approved"
+  },
+  {
+   "at": "2026-10-25T00:45:39Z",
+   "evidence": "builder:wave-d56-governor",
+   "note": "",
+   "phase": "building"
+  }
+ ],
+ "evidence_refs": [
+  "contract-created:ADMIT-wave-d56-governor"
+ ],
+ "ext": {
+  "activation": {
+   "activated": true,
+   "builder": "wave-d56-governor",
+   "evidence": [
+    "affected surface known: ['src/go/rune-core/', 'src/go/dispatch-classifier/']",
+    "file mention binds scoped target",
+    "scoping words bind to known target: ['current']",
+    "smallness markers: ['patch']"
+   ],
+   "lifecycle": "bounded",
+   "mode": "LOCAL_CHANGE",
+   "note": "bounded governance via existing authority \u2014 no Project Scaffold bootstrap",
+   "project_authority": "rune_internal",
+   "target_project": "rune"
+  },
+  "affected_paths": [
+   "scripts/admit_wave_d56_governor.py",
+   "src/go/dispatch-classifier/",
+   "src/go/rune-core/",
+   "tui/bridge/",
+   "tui/cmd/rune-tui/",
+   "tui/lanes/",
+   "tui/runtime/lib/"
+  ],
+  "affected_regions": [],
+  "affected_ui_surfaces": [],
+  "expected_runtime_effects": [
+   "the governor samples live tok/s per provider from real turns and persists the rolling model to the hot state, routes cloud-first through healthy providers only (429-throttled refused), the dispatch classifier's PARALLEL verdicts carry the measured lane capacity with the thin pipe stated honestly, and the info bar shows the measured tok/s after the context readout with the sub-agents section showing the governor's state"
+  ],
+  "predicted_frontier": {
+   "change_kind": "implementation_change",
+   "contextual_not_obligations": [],
+   "contracts": [],
+   "level0_direct": [],
+   "level1_obligations": [],
+   "level2_verification": [],
+   "max_level": 2,
+   "traversal_scope": "spine-structural-only"
+  },
+  "scope_provenance": {
+   "caller_added": [],
+   "generated_from_affected_surface": [
+    "scripts/admit_wave_d56_governor.py",
+    "src/go/dispatch-classifier/",
+    "src/go/rune-core/",
+    "tui/bridge/",
+    "tui/cmd/rune-tui/",
+    "tui/lanes/",
+    "tui/runtime/lib/"
+   ]
+  },
+  "task_ref": "wave-d56-governor",
+  "unresolved_surfaces": [
+   {
+    "kind": "source_path",
+    "reason": "no authority records this path as an entity (path remains file-scope only)",
+    "surface": "scripts/admit_wave_d56_governor.py"
+   },
+   {
+    "kind": "source_path",
+    "reason": "no authority records this path as an entity (path remains file-scope only)",
+    "surface": "src/go/dispatch-classifier/"
+   },
+   {
+    "kind": "source_path",
+    "reason": "no authority records this path as an entity (path remains file-scope only)",
+    "surface": "src/go/rune-core/"
+   },
+   {
+    "kind": "source_path",
+    "reason": "no authority records this path as an entity (path remains file-scope only)",
+    "surface": "tui/bridge/"
+   },
+   {
+    "kind": "source_path",
+    "reason": "no authority records this path as an entity (path remains file-scope only)",
+    "surface": "tui/cmd/rune-tui/"
+   },
+   {
+    "kind": "source_path",
+    "reason": "no authority records this path as an entity (path remains file-scope only)",
+    "surface": "tui/lanes/"
+   },
+   {
+    "kind": "source_path",
+    "reason": "no authority records this path as an entity (path remains file-scope only)",
+    "surface": "tui/runtime/lib/"
+   }
+  ],
+  "workflow_config_surfaces": []
+ },
+ "id": "contract:ADMIT-wave-d56-governor",
+ "identities": {
+  "acceptance": [
+   "bounded repair verified: land the D56 wave (Gitea #2580 + #2581, owner doctrine rulings 2026-10-24: CLOUD-FIRST routing \u2014 cloud lanes fill FIRST,"
+  ],
+  "affected_entities": [],
+  "expected_consumers": [],
+  "expected_new_entities": [
+   "the D56 wave report (reports/)",
+   "the governor hot-state shape (~/.rune/hot/provider_throughput.json)",
+   "the red-first governor/capacity/readout tests"
+  ],
+  "gap_evidence": "smallness markers: ['patch']; scoping words bind to known target: ['current']; file mention binds scoped target; affected surface known: ['src/go/rune-core/', 'src/go/dispatch-classifier/']",
+  "migration_obligations": [],
+  "need": "land the D56 wave (Gitea #2580 + #2581, owner doctrine rulings 2026-10-24: CLOUD-FIRST routing \u2014 cloud lanes fill FIRST, local absorbs only overflow; NO CONSENT on cloud models \u2014 configured provider = spend freely, zero prompts; routing scope = factory lane assignment, interactive chat routing stays the owner's): (1) TELEMETRY \u2014 sample live tok/s per provider from production data (the engine's real turn accounting; output-token counts from the provider wires where published, honest token-estimate fallback otherwise); rolling per-provider samples persisted via the hot-state pattern (~/.rune/hot/provider_throughput.json, atomic temp+rename); (2) SATURATION MODEL \u2014 a small rolling (provider, lanes) EMA curve learned ONLY from samples, no synthetic benchmarks; the lane cap is where the marginal tok/s gain clears the floor (RUNE_GOVERNOR_CAP_FLOOR, default 5); (3) CONNECTION-HEALTH \u2014 the governor polls the registry's enabled providers live (reachable, authenticated, tok/s, error rate, 429 throttle windows) and routes only to providers actually alive; (4) LANE POOLS + CLOUD-FIRST \u2014 per-provider lane pools, cloud pools fill first, least-loaded within a tier, throttled providers refused (a 429 ceiling is worse than not spawning); (5) CLASSIFIER INTEGRATION \u2014 dispatch-classifier gains the governor's cap: PARALLEL verdicts become throughput-aware ('PARALLEL (N lanes free at current tok/s)'), the thin pipe says so, no false fan-out; registry/lock semantics unchanged; (6) INFO BAR READOUT \u2014 tok/s after the context readout ('context 4.2k/32k (13%) \u00b7 38 tok/s') fed from /v1/status's new governor section through both bridge seams; the sub-agents section shows the governor's state row (lanes in use, measured tok/s, cap, '\u2014' honest gap); (7) HONESTY \u2014 a thin pipe is stated, never dressed up",
+  "next_action": "complete implementation, then verify",
+  "non_goals": [],
+  "origin": "worker",
+  "regression_obligations": [],
+  "requirement": "headless admission (classified: LOCAL_CHANGE)",
+  "research_refs": [
+   "src/go/dispatch-classifier/capacity.go",
+   "src/go/dispatch-classifier/capacity_test.go",
+   "src/go/rune-core/internal/runecore/engine.go",
+   "src/go/rune-core/internal/runecore/governor.go",
+   "src/go/rune-core/internal/runecore/governor_test.go",
+   "src/go/rune-core/internal/runecore/server.go",
+   "tui/bridge/d56_governor_test.go",
+   "tui/cmd/rune-tui/d56_governor_test.go",
+   "tui/cmd/rune-tui/main.go",
+   "tui/runtime/lib/lib.go"
+  ],
+  "resolution": "",
+  "rollback_ref": "git revert",
+  "scope": [
+   "scripts/admit_wave_d56_governor.py",
+   "src/go/dispatch-classifier/",
+   "src/go/rune-core/",
+   "tui/bridge/",
+   "tui/cmd/rune-tui/",
+   "tui/lanes/",
+   "tui/runtime/lib/"
+  ],
+  "toolchain": {},
+  "verification_obligations": [
+   "go test -race -short green on rune-core, dispatch-classifier and tui (hermetic PTY/HTTP tests)",
+   "readout proof: the info-bar test asserts 'context ... (13%) \u00b7 38 tok/s' byte-shape against a fake serve",
+   "vet/gofmt clean on touched modules"
+  ]
+ },
+ "kind": "construction_contract",
+ "maturity": "DECLARED",
+ "observed_at": "2026-10-25T00:45:39Z",
+ "phase": "building",
+ "status": "open",
+ "tags": []
+}

tests/test_cache_go_parity.py

@@ -0,0 +1,151 @@
+"""REBASE-COMPLETION (#2587) parity battery — cache.
+
+Red-first discipline: pins the Go engine's eval surface (get_cache,
+put_cache, invalidate, invalidate_scope, invalidate_all, cache_stats,
+handle_hook) against the Python oracle bodies on the SAME cache.db. A
+mutation of an oracle body must flip the battery. Also pins the facade
+contract: fail-loud RuntimeError on a missing binary; RUNE_CACHE_ENGINE
+=python escape; cross-engine coherence (engine-written rows are
+oracle-readable and vice versa).
+"""
+
+import os
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
+
+from rune import cache as cache_mod  # noqa: E402
+
+
+@pytest.fixture()
+def mem_dir(tmp_path, monkeypatch):
+    monkeypatch.setenv("RUNE_MEMORY_DIR", str(tmp_path))
+    # The oracle bodies read the import-time DB_PATH constant; retarget it
+    # to the test memory dir so both engines address the same cache.db.
+    monkeypatch.setattr(cache_mod, "DB_PATH", str(tmp_path / "cache.db"))
+    return str(tmp_path)
+
+
+def _oracle(mem_dir, monkeypatch):
+    monkeypatch.setenv("RUNE_CACHE_ENGINE", "python")
+    return cache_mod
+
+
+def _put(cache, key, value, **kw):
+    return cache.put_cache(key, value, **kw)
+
+
+# -- put / get roundtrip -----------------------------------------------------
+
+
+def test_put_get_roundtrip_go_vs_oracle(mem_dir, monkeypatch):
+    got = _put(cache_mod, "k1", "value one")
+    monkeypatch.setenv("RUNE_CACHE_ENGINE", "python")
+    oracle_put = cache_mod._put_cache_python("k1", "value one")
+    oracle_get = cache_mod._get_cache_python("k1")
+    monkeypatch.delenv("RUNE_CACHE_ENGINE")
+    engine_get = cache_mod.get_cache("k1")
+    assert got == oracle_put == {"stored": "k1", "content_hash": got["content_hash"], "scope": "general"}
+    assert engine_get["hit"] is True and oracle_get["hit"] is True
+    assert engine_get["full"] == oracle_get["full"] == "value one"
+    assert engine_get["content_hash"] == oracle_get["content_hash"]
+
+
+def test_miss_shape_go_vs_oracle(mem_dir):
+    assert cache_mod.get_cache("absent-key") == {"hit": False, "key": "absent-key"}
+    assert cache_mod._get_cache_python("absent-key") == {"hit": False, "key": "absent-key"}
+
+
+def test_put_scope_and_source_hash_go_vs_oracle(mem_dir):
+    got = _put(cache_mod, "k2", "v2", scope="research", source_hash="abc")
+    oracle = cache_mod._put_cache_python("k2", "v2", scope="research", source_hash="abc")
+    assert got == oracle
+    row = cache_mod.get_cache("k2")
+    assert row["scope"] == "research"
+
+
+# -- invalidation ------------------------------------------------------------
+
+
+def test_invalidate_go_vs_oracle(mem_dir):
+    _put(cache_mod, "k3", "v3")
+    got = cache_mod.invalidate("k3", "gone")
+    assert got["invalidated"] == "k3"
+    assert cache_mod.get_cache("k3")["hit"] is False
+
+
+def test_invalidate_scope_go_vs_oracle(mem_dir):
+    _put(cache_mod, "a1", "v", scope="s1")
+    _put(cache_mod, "a2", "v", scope="s1")
+    _put(cache_mod, "b1", "v", scope="s2")
+    got = cache_mod.invalidate_scope("s1")
+    assert got["invalidated_scope"] == "s1" and got["count"] == 2
+    assert cache_mod.get_cache("a1")["hit"] is False
+    assert cache_mod.get_cache("a2")["hit"] is False
+    assert cache_mod.get_cache("b1")["hit"] is True
+
+
+def test_invalidate_all_go_vs_oracle(mem_dir):
+    _put(cache_mod, "x1", "v")
+    _put(cache_mod, "x2", "v")
+    got = cache_mod.invalidate_all("reset")
+    assert got["invalidated_all"] == 2
+    assert cache_mod.get_cache("x1")["hit"] is False
+    assert cache_mod.get_cache("x2")["hit"] is False
+
+
+# -- stats + hook --------------------------------------------------------------
+
+
+def test_cache_stats_go_vs_oracle(mem_dir):
+    _put(cache_mod, "s1", "v")
+    _put(cache_mod, "s2", "v", scope="other")
+    stats = cache_mod.cache_stats()
+    oracle = cache_mod._cache_stats_python()
+    assert stats["active"] == oracle["active"] == 2
+    assert stats["scopes"] == oracle["scopes"]
+
+
+def test_handle_hook_go_vs_oracle(mem_dir):
+    got = cache_mod.handle_hook("memory.write", {"key": "h1"})
+    oracle = cache_mod._handle_hook_python("memory.write", {"key": "h1"})
+    assert got["handler"] == oracle["handler"] == "cache"
+    assert got["status"] == oracle["status"] == "ok"
+
+
+# -- cross-engine coherence -----------------------------------------------------
+
+
+def test_engine_write_oracle_read(mem_dir, monkeypatch):
+    _put(cache_mod, "cross1", "via engine")
+    monkeypatch.setenv("RUNE_CACHE_ENGINE", "python")
+    assert cache_mod.get_cache("cross1")["full"] == "via engine"
+
+
+def test_oracle_write_engine_read(mem_dir, monkeypatch):
+    monkeypatch.setenv("RUNE_CACHE_ENGINE", "python")
+    cache_mod.put_cache("cross2", "via oracle")
+    monkeypatch.delenv("RUNE_CACHE_ENGINE")
+    assert cache_mod.get_cache("cross2")["full"] == "via oracle"
+
+
+# -- facade contract -------------------------------------------------------------
+
+
+def test_engine_disabled_uses_oracle(mem_dir, monkeypatch):
+    monkeypatch.setenv("RUNE_CACHE_ENGINE", "python")
+    r = cache_mod.put_cache("esc", "v")
+    assert r["stored"] == "esc"
+
+
+def test_missing_binary_fails_loud(mem_dir, monkeypatch, tmp_path):
+    monkeypatch.setenv("RUNE_CACHE_BIN", str(tmp_path / "nope"))
+    with pytest.raises(RuntimeError, match="binary missing"):
+        cache_mod.get_cache("k")
+
+
+def test_bad_op_fails_loud():
+    with pytest.raises(RuntimeError, match="go engine"):
+        cache_mod._go_eval([{"op": "definitely_not_an_op", "memory_dir": "/tmp"}])

tui/bridge/bridge.go

@@ -191,6 +191,12 @@ type Bridge struct {
 	ctxUsed  int64
 	ctxLimit int64
 
+	// governor (D56): the latest status round's dispatch-governor
+	// readout — measured tok/s and lanes in use vs the learned cap.
+	govTok   float64
+	govLanes int
+	govCap   int
+
 	// chatDepth is the chat-channel window depth (messages) — the
 	// scrollback deeper-page knob (depth.go), grow-only, wake-armed.
 	chatDepth int
@@ -257,6 +263,7 @@ func (b *Bridge) pollOnce(p *tea.Program) {
 	b.record(pongMsg(b.nextID(), nonce))
 	b.record(snapshotMsg(b.nextID(), body))
 	b.setCtx(body.Context.Used, body.Context.Limit)
+	b.setGovernor(body.Governor.TokensPerSec, body.Governor.LanesActive, body.Governor.LanesCap)
 
 	msgs, err := b.serve.Conversation(ctx, DefaultChannel, convWindow)
 	if err != nil {
@@ -373,6 +380,22 @@ func (b *Bridge) Ctx() (used, limit int64) {
 	return b.ctxUsed, b.ctxLimit
 }
 
+// setGovernor stores the latest status round's governor readout (D56).
+func (b *Bridge) setGovernor(tokPerSec float64, lanes, cap int) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.govTok, b.govLanes, b.govCap = tokPerSec, lanes, cap
+}
+
+// Governor reports the dispatch governor's honest live state: the
+// measured tok/s (0 = nothing measured yet — the bar renders '—',
+// never a guess) and the lanes in use against the learned cap.
+func (b *Bridge) Governor() (tokPerSec float64, lanes, cap int) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.govTok, b.govLanes, b.govCap
+}
+
 // Token reports the honest connection state for the identity line.
 func (b *Bridge) Token() string {
 	b.mu.Lock()

tui/bridge/client.go

@@ -43,6 +43,16 @@ type StatusBody struct {
 		Used  int64 `json:"used"`
 		Limit int64 `json:"limit"`
 	} `json:"context"`
+	// Governor (D56): the dispatch governor's honest live state —
+	// tok/s measured (0 = nothing measured yet), lanes in use vs cap.
+	Governor GovernorState `json:"governor"`
+}
+
+// GovernorState is the /v1/status governor section the TUI renders.
+type GovernorState struct {
+	TokensPerSec float64 `json:"tokens_per_sec"`
+	LanesActive  int     `json:"lanes_active"`
+	LanesCap     int     `json:"lanes_cap"`
 }
 
 // ConvMessage is one GET /v1/conversation window entry — the durable

tui/bridge/d56_governor_test.go

@@ -0,0 +1,57 @@
+package bridge
+
+// d56_governor_test.go — the D56 governor readout's seam laws on BOTH
+// paths: /v1/status's governor section lands in Governor() (serve),
+// and the library seam carries the StatusRow governor fields the same
+// way (the info bar reads both).
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"rune.dev/rune/tui/runtime/lib"
+)
+
+func TestServeSeamCarriesGovernor(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"identity": "rune", "role": "assistant", "current_task": nil,
+			"context":  map[string]int{"used": 1, "limit": 2},
+			"governor": map[string]any{"tokens_per_sec": 38.6, "lanes_active": 2, "lanes_cap": 5},
+		})
+	}))
+	defer srv.Close()
+	b := New(NewServeClient(srv.URL), 5*time.Millisecond)
+	b.Start(nil)
+	t.Cleanup(b.Close)
+	waitFor(t, "governor readout (serve seam)", func() bool {
+		tok, lanes, cap := b.Governor()
+		return int(tok+0.5) == 39 && lanes == 2 && cap == 5
+	})
+}
+
+func TestLibrarySeamCarriesGovernor(t *testing.T) {
+	fl := &fakeLib{
+		st: lib.StatusRow{Identity: "rune", GovTokPerSec: 12.5, GovLanes: 1, GovCap: 3},
+	}
+	b := NewLibrary(fl, 5*time.Millisecond)
+	b.Start(nil)
+	t.Cleanup(b.Close)
+	waitFor(t, "governor readout (lib seam)", func() bool {
+		tok, lanes, cap := b.Governor()
+		return int(tok) == 12 && lanes == 1 && cap == 3
+	})
+}
+
+func TestGovernorDefaultsHonestZero(t *testing.T) {
+	// a bridge that never polled reports zeros — never a guessed rate
+	b := New(NewServeClient("http://127.0.0.1:1"), time.Hour)
+	tok, lanes, cap := b.Governor()
+	if tok != 0 || lanes != 0 || cap != 0 {
+		t.Fatalf("unpolled bridge governor = %v/%d/%d, want zeros", tok, lanes, cap)
+	}
+}

tui/bridge/library.go

@@ -80,6 +80,7 @@ func (b *Bridge) pollLibrary(p *tea.Program) {
 	b.record(pongMsg(b.nextID(), nonce))
 	b.record(libSnapshotMsg(b.nextID(), st))
 	b.setCtx(st.CtxUsed, st.CtxLimit)
+	b.setGovernor(st.GovTokPerSec, st.GovLanes, st.GovCap)
 
 	taskRows, _, err := b.libSrc.Tasks(ctx)
 	var ownerOrder []string

tui/cmd/rune-tui/d56_governor_test.go

@@ -0,0 +1,122 @@
+package main
+
+// d56_governor_test.go — the D56 readout's frozen laws: the info bar
+// carries the governor's measured tok/s after the context readout
+// ("context 4.2k/32k (13%) · 38 tok/s"), a governor with nothing
+// measured renders NOTHING (the bar never guesses), and the
+// sub-agents section shows the governor's own state row (lanes in
+// use vs cap, measured tok/s, '—' honest gap). Hermetic: fake serve,
+// no PTY, no live core.
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"rune.dev/rune/tui/bridge"
+	"time"
+)
+
+func d56Serve(t *testing.T, governor map[string]any) *httptest.Server {
+	t.Helper()
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/v1/status":
+			body := map[string]any{
+				"identity": "rune", "role": "assistant", "current_task": nil,
+				"active_model": "stub-model-a",
+				"context":      map[string]int{"used": 4200, "limit": 32000},
+			}
+			if governor != nil {
+				body["governor"] = governor
+			}
+			_ = json.NewEncoder(w).Encode(body)
+		case "/v1/conversation":
+			_ = json.NewEncoder(w).Encode(map[string]any{"messages": []any{}})
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+}
+
+func d56BootModel(t *testing.T, srv *httptest.Server) model {
+	t.Helper()
+	bootServeBase = srv.URL
+	t.Cleanup(func() { bootServeBase = "" })
+	m := sized(t, initialModel(), 100, 24)
+	if m.rt == nil {
+		t.Fatal("no bridge booted with bootServeBase set")
+	}
+	m.rt.Start(nil)
+	t.Cleanup(m.rt.Close)
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) &&
+		m.rt.Token() != bridge.TokenConnected && m.rt.Token() != bridge.TokenFeed {
+		time.Sleep(5 * time.Millisecond)
+	}
+	return m
+}
+
+func d56WaitGovernor(t *testing.T, m model, want float64) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if tok, _, _ := m.rt.Governor(); tok == want {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("governor tok/s never reached %v", want)
+}
+
+func TestD56InfoBarTokPerSecAfterContext(t *testing.T) {
+	srv := d56Serve(t, map[string]any{
+		"tokens_per_sec": 38.4, "lanes_active": 2, "lanes_cap": 5})
+	m := d56BootModel(t, srv)
+	d56WaitGovernor(t, m, 38.4)
+	next, _ := m.Update(bridge.EventMsg{})
+	got := next.(model)
+	content := got.View().Content
+	if !strings.Contains(content, "(13%) · 38 tok/s") || !strings.Contains(content, "context 4.") {
+		t.Errorf("info bar missing the context+tok/s readout:\n%s", tailLine(content))
+	}
+}
+
+func TestD56InfoBarNoMeasurementRendersNothing(t *testing.T) {
+	// a status with NO governor section at all — the bar shows only
+	// the context pair, never a guessed rate
+	srv := d56Serve(t, nil)
+	m := d56BootModel(t, srv)
+	d56WaitGovernor(t, m, 0)
+	next, _ := m.Update(bridge.EventMsg{})
+	got := next.(model)
+	content := got.View().Content
+	if strings.Contains(content, "tok/s") {
+		t.Errorf("info bar invented a tok/s with no measurement:\n%s", tailLine(content))
+	}
+	if !strings.Contains(content, "(13%)") || !strings.Contains(content, "context 4.") {
+		t.Errorf("context readout lost: %s", tailLine(content))
+	}
+}
+
+func TestD56InfoBarZeroRateIsHonestGap(t *testing.T) {
+	// governor present but tok/s 0 — the '—' honesty, not "0 tok/s"
+	srv := d56Serve(t, map[string]any{
+		"tokens_per_sec": 0, "lanes_active": 1, "lanes_cap": 1})
+	m := d56BootModel(t, srv)
+	d56WaitGovernor(t, m, 0)
+	next, _ := m.Update(bridge.EventMsg{})
+	got := next.(model)
+	if strings.Contains(got.View().Content, "tok/s") {
+		t.Errorf("zero measurement rendered as a rate:\n%s", tailLine(got.View().Content))
+	}
+}
+
+// tailLine returns the info bar row (the view's last line).
+func tailLine(content string) string {
+	lines := strings.Split(strings.TrimRight(content, "\n"), "\n")
+	return lines[len(lines)-1]
+}

tui/cmd/rune-tui/main.go

@@ -2889,7 +2889,7 @@ func (m model) View() tea.View {
 	// the version (hidden at zero, clickable to open the sub-agent tab),
 	// the compacted active model (D44-A: local truncated name+size+style-
 	// if-applicable+ablation; cloud full), and the context window.
-	fmt.Fprintf(&b, "%s%s%s%s", versionToken(m), wavesToken(m), modelToken(m), ctxToken(m))
+	fmt.Fprintf(&b, "%s%s%s%s%s", versionToken(m), wavesToken(m), modelToken(m), ctxToken(m), tokToken(m))
 	v := tea.NewView(b.String())
 	// ALTERNATE SCREEN LAW (owner ruling 2026-10-19: on exit the TUI
 	// must DISAPPEAR — the terminal restores the pre-boot command line,
@@ -2940,6 +2940,22 @@ func ctxToken(m model) string {
 	return fmt.Sprintf(" · context %s/%s (%d%%)", compactTokens(used), compactTokens(limit), ctxPercent(used, limit))
 }
 
+// tokToken renders the governor's live tok/s readout (D56): " · 38
+// tok/s" after the context readout — the measured rate from the
+// core's governor (production samples only). Idle shows the last
+// measured value; nothing measured renders nothing — the bar never
+// guesses.
+func tokToken(m model) string {
+	if m.rt == nil {
+		return ""
+	}
+	tok, _, _ := m.rt.Governor()
+	if tok <= 0 {
+		return ""
+	}
+	return fmt.Sprintf(" · %d tok/s", int(tok+0.5))
+}
+
 // ctxPercent is the usage percentage: integer 0-100, floor-rounded.
 func ctxPercent(used, limit int64) int {
 	if limit <= 0 {
@@ -3493,6 +3509,19 @@ func (m *model) syncWaves() {
 	// rows carry the journal + observations detail waveRows derived.
 	rows := waveRows(lib.DefaultRepoRoot(), fl)
 	avs := make([]lanes.AgentView, 0, len(rows))
+	// THE GOVERNOR'S ROW (D56 item 6): the section shows the machine's
+	// own decision — lanes in use against the learned cap and the
+	// measured tok/s ('—' when nothing was measured; honesty, not a
+	// guess).
+	if m.rt != nil {
+		tok, usedLanes, cap := m.rt.Governor()
+		rate := "—"
+		if tok > 0 {
+			rate = fmt.Sprintf("%d tok/s", int(tok+0.5))
+		}
+		avs = append(avs, lanes.AgentView{ID: "governor", State: "governor",
+			Title: fmt.Sprintf("%s · lanes %d/%d", rate, usedLanes, cap)})
+	}
 	for _, r := range rows {
 		avs = append(avs, lanes.AgentView{ID: r.ID, Title: r.Title, State: r.State, Detail: r.Detail})
 	}

tui/runtime/lib/lib.go

@@ -111,6 +111,12 @@ type StatusRow struct {
 	Completed int64
 	CtxUsed   int64
 	CtxLimit  int64
+	// Governor (D56): the dispatch governor's measured tok/s and lane
+	// state — zeros when the core has nothing measured (the bar shows
+	// '—', never a guess).
+	GovTokPerSec float64
+	GovLanes     int
+	GovCap       int
 }
 
 // ModelRow is one /v1/models entry (the surface the core exposes over
@@ -354,13 +360,19 @@ func (r *Repo) Status(ctx context.Context) (StatusRow, error) {
 			Used  int64 `json:"used"`
 			Limit int64 `json:"limit"`
 		} `json:"context"`
+		Governor struct {
+			TokensPerSec float64 `json:"tokens_per_sec"`
+			LanesActive  int     `json:"lanes_active"`
+			LanesCap     int     `json:"lanes_cap"`
+		} `json:"governor"`
 	}
 	if err := json.NewDecoder(body).Decode(&parsed); err != nil {
 		return StatusRow{}, err
 	}
 	return StatusRow{Identity: parsed.Identity, Role: parsed.Role, ActiveMod: parsed.ActiveModel,
 		Pending: parsed.TasksPending, Running: parsed.TasksRunning, Completed: parsed.TasksCompleted,
-		CtxUsed: parsed.Context.Used, CtxLimit: parsed.Context.Limit}, nil
+		CtxUsed: parsed.Context.Used, CtxLimit: parsed.Context.Limit,
+		GovTokPerSec: parsed.Governor.TokensPerSec, GovLanes: parsed.Governor.LanesActive, GovCap: parsed.Governor.LanesCap}, nil
 }
 
 // Tasks reads GET /v1/tasks — the task-state checkpoint.

verification/integrated/cache-integrated.json

@@ -0,0 +1,32 @@
+{
+ "schema": "integrated-run/1",
+ "capability": "cache",
+ "contract": "ADMIT-wave-rebase-completion",
+ "issue": "Gitea #2587 (REBASE-COMPLETION)",
+ "phase": "building",
+ "method": "PORT → INTEGRATE → REMOVE (owner-amended): live consumers switched to the Go engine; Python oracle retained; NO Python deletion this wave",
+ "integrated_at": "2026-10-24",
+ "parity_basis": "src/go/cache go test -race -short green (incl. frozen_truth.json + truth_hash.json replays) + tests/test_cache_go_parity.py (13 passed, both engines against the SAME cache.db)",
+ "go_engine": {
+  "path": "src/go/cache",
+  "surface": "eval <ops.json> (new this wave: eval.go — get_cache, put_cache, invalidate, invalidate_scope, invalidate_all, cache_stats, handle_hook over the truth-tested Env library; ops carry memory_dir so the facade addresses any cache.db) | CLI + truth replays",
+  "delegation": "src/rune/cache.py: get_cache, put_cache, invalidate, invalidate_scope, invalidate_all, cache_stats, handle_hook resolve through the Go binary; the engine mutates the same cache.db (cross-engine coherence tests pin both directions); escape hatch RUNE_CACHE_ENGINE=python; binary override RUNE_CACHE_BIN",
+  "fail_mode": "fail-loud RuntimeError when the Go engine is missing or errors (no silent Python fallback)"
+ },
+ "contract_note": "the miss contract is the oracle's {hit: false, key} dict — the Go eval's nil-miss is translated at the facade seam so both engines expose the identical shape",
+ "consumers": [
+  {
+   "consumer": "src/rune/memory_continuity.py, memory_store.py, persona_definition.py, rune_tui.py, orchestration/retrieval_benchmark.py",
+   "switched_how": "cache seam call sites (put_cache/get_cache/invalidate*) resolve through the Go engine at runtime",
+   "receipt": "tests/test_cache_go_parity.py green (13)",
+   "blocks_full_switchover": []
+  }
+],
+ "verification": {
+  "go": "go test -race -short ./... green; go vet clean; binary rebuilt from source",
+  "python": "battery 13 passed",
+  "ruff": "check + format clean on touched files",
+  "mutation_flip": "oracle _hash digest-width mutation flips the battery (2 failed); restored green"
+ },
+ "blocks_full_switchover": []
+}