feat(realism): LLM enrichment for user-class file bodies

Stage 6 of the realism migration. User-class file bodies (note,
todo, draft, script) optionally get LLM-authored content; system
classes (cron / daemon logs, /tmp caches) stay template-only because
formulaic *is* the right look for them.

New surface:

- realism.llm.circuit.LLMCircuitBreaker — process-local sliding-window
  breaker. 3 consecutive failures trip open; 60s cooldown to half-open;
  half-open success closes, failure re-opens. Protects the orchestrator
  tick from sustained Ollama wedges (per-call timeout already covers
  one-shot hangs).
- realism.prompts._style — em-dash suppression lifted from the
  email prompt. Persona.uses_llms_heavily opts out per the
  feedback_em_dash_llm_tell.md memory. Includes strip_em_dashes
  belt-and-braces sub for output that slipped past the prompt rule.
- realism.prompts.filebody — class-conditioned prompts (note / todo
  / draft / script) with persona context, language pinning, output
  shape rule.
- realism.bodies.make_body_with_llm — async wrapper around make_body
  that calls the LLM when one is provided AND the breaker allows.
  Falls back to template on timeout / error / empty / system-class.

Wiring:

- scheduler.pick_file accepts optional llm + llm_breaker + llm_timeout.
  When the planner picks a create action and the content_class is a
  user-class, the body_hint is replaced with the LLM-authored body
  (or falls back to the deterministic body_hint).
- orchestrator.worker constructs get_llm() at startup gated by
  DECNET_REALISM_LLM env var (any non-empty value enables; empty /
  "off" / "none" / "0" disables). Passes llm + breaker through every
  tick.
- decnet orchestrate gains --llm/--no-llm flag overriding the env var.

tests/realism/test_bodies_llm.py

@@ -0,0 +1,128 @@
+"""LLM-enriched body generation with deterministic fallback."""
+from __future__ import annotations
+
+import asyncio
+
+import pytest
+
+from decnet.realism.bodies import make_body_with_llm
+from decnet.realism.llm.base import LLMResult, LLMTimeout
+from decnet.realism.llm.circuit import LLMCircuitBreaker
+from decnet.realism.personas import EmailPersona
+from decnet.realism.taxonomy import ContentClass
+
+
+def _persona(uses_llms: bool = False) -> EmailPersona:
+    return EmailPersona(
+        name="admin", email="admin@corp.com", role="ops",
+        tone="direct", mannerisms=["uses bullets"],
+        active_hours="00:00-00:00",
+        uses_llms_heavily=uses_llms,
+    )
+
+
+class _StubLLM:
+    """Async stub: returns canned LLMResult; no subprocess work."""
+
+    def __init__(self, *, text: str = "stub body\n", success: bool = True):
+        self.model = "stub-model"
+        self.timeout = 1.0
+        self._result = LLMResult(
+            success=success, text=text, model=self.model, latency_ms=1,
+        )
+        self.calls = 0
+
+    async def generate(self, prompt: str) -> LLMResult:
+        self.calls += 1
+        return self._result
+
+
+class _TimeoutLLM:
+    model = "timeout-model"
+    timeout = 0.05
+
+    async def generate(self, prompt: str) -> LLMResult:
+        raise LLMTimeout("simulated")
+
+
+@pytest.mark.asyncio
+async def test_no_llm_falls_back_to_template() -> None:
+    body = await make_body_with_llm(ContentClass.NOTE, _persona(), llm=None)
+    assert body.strip()  # template path returns non-empty
+
+
+@pytest.mark.asyncio
+async def test_llm_success_returns_llm_text() -> None:
+    llm = _StubLLM(text="LLM-produced note body\n")
+    body = await make_body_with_llm(
+        ContentClass.NOTE, _persona(), llm=llm,
+    )
+    assert "LLM-produced note body" in body
+    assert llm.calls == 1
+
+
+@pytest.mark.asyncio
+async def test_em_dashes_are_stripped_for_default_persona() -> None:
+    llm = _StubLLM(text="Hi — quick update — see attached.\n")
+    body = await make_body_with_llm(
+        ContentClass.NOTE, _persona(uses_llms=False), llm=llm,
+    )
+    assert "—" not in body
+
+
+@pytest.mark.asyncio
+async def test_em_dashes_pass_through_for_llm_heavy_persona() -> None:
+    llm = _StubLLM(text="Hi — quick update — see attached.\n")
+    body = await make_body_with_llm(
+        ContentClass.NOTE, _persona(uses_llms=True), llm=llm,
+    )
+    assert "—" in body
+
+
+@pytest.mark.asyncio
+async def test_timeout_falls_back_to_template_and_records_failure() -> None:
+    breaker = LLMCircuitBreaker(failure_threshold=3, cooldown_seconds=10.0)
+    body = await make_body_with_llm(
+        ContentClass.NOTE, _persona(),
+        llm=_TimeoutLLM(), breaker=breaker, timeout=0.01,
+    )
+    assert body.strip()  # template fallback returned non-empty
+    assert breaker.state == "closed"  # one failure isn't enough to trip
+
+
+@pytest.mark.asyncio
+async def test_breaker_open_skips_llm_call() -> None:
+    breaker = LLMCircuitBreaker(failure_threshold=1, cooldown_seconds=60.0)
+    breaker.record_failure()  # trip immediately
+    assert breaker.allow_call() is False
+
+    llm = _StubLLM()
+    body = await make_body_with_llm(
+        ContentClass.NOTE, _persona(),
+        llm=llm, breaker=breaker,
+    )
+    # LLM was NOT called (breaker open) — fallback to template.
+    assert llm.calls == 0
+    assert body.strip()
+
+
+@pytest.mark.asyncio
+async def test_system_class_never_invokes_llm() -> None:
+    llm = _StubLLM()
+    body = await make_body_with_llm(
+        ContentClass.LOG_CRON, _persona(), llm=llm,
+    )
+    # System-class content is supposed to look formulaic; LLM-authored
+    # cron logs would be a regression in realism.
+    assert llm.calls == 0
+    assert "CRON[" in body  # template path
+
+
+@pytest.mark.asyncio
+async def test_empty_llm_response_falls_back() -> None:
+    llm = _StubLLM(text="", success=True)
+    body = await make_body_with_llm(
+        ContentClass.NOTE, _persona(), llm=llm,
+    )
+    # LLM ran but produced empty output → template fallback.
+    assert body.strip()

tests/realism/test_circuit_breaker.py

@@ -0,0 +1,81 @@
+"""LLMCircuitBreaker — process-local sliding-window breaker."""
+from __future__ import annotations
+
+from decnet.realism.llm.circuit import LLMCircuitBreaker
+
+
+def test_starts_closed_and_allows_calls() -> None:
+    breaker = LLMCircuitBreaker()
+    assert breaker.state == "closed"
+    assert breaker.allow_call() is True
+
+
+def test_trips_open_after_threshold_failures() -> None:
+    clock_value = [0.0]
+    breaker = LLMCircuitBreaker(
+        failure_threshold=3, cooldown_seconds=60.0,
+        clock=lambda: clock_value[0],
+    )
+    breaker.record_failure()
+    assert breaker.state == "closed"
+    breaker.record_failure()
+    assert breaker.state == "closed"
+    breaker.record_failure()
+    assert breaker.state == "open"
+    assert breaker.allow_call() is False
+
+
+def test_success_resets_consecutive_failure_count() -> None:
+    breaker = LLMCircuitBreaker(failure_threshold=3)
+    breaker.record_failure()
+    breaker.record_failure()
+    breaker.record_success()
+    breaker.record_failure()
+    breaker.record_failure()
+    assert breaker.state == "closed"  # only 2 since the success
+
+
+def test_half_open_after_cooldown() -> None:
+    clock_value = [0.0]
+    breaker = LLMCircuitBreaker(
+        failure_threshold=2, cooldown_seconds=10.0,
+        clock=lambda: clock_value[0],
+    )
+    breaker.record_failure()
+    breaker.record_failure()
+    assert breaker.state == "open"
+    assert breaker.allow_call() is False
+
+    clock_value[0] = 11.0
+    assert breaker.allow_call() is True
+    assert breaker.state == "half_open"
+
+
+def test_half_open_failure_re_opens() -> None:
+    clock_value = [0.0]
+    breaker = LLMCircuitBreaker(
+        failure_threshold=2, cooldown_seconds=5.0,
+        clock=lambda: clock_value[0],
+    )
+    breaker.record_failure()
+    breaker.record_failure()
+    clock_value[0] = 6.0
+    breaker.allow_call()
+    assert breaker.state == "half_open"
+    breaker.record_failure()
+    assert breaker.state == "open"
+
+
+def test_half_open_success_closes() -> None:
+    clock_value = [0.0]
+    breaker = LLMCircuitBreaker(
+        failure_threshold=2, cooldown_seconds=5.0,
+        clock=lambda: clock_value[0],
+    )
+    breaker.record_failure()
+    breaker.record_failure()
+    clock_value[0] = 6.0
+    breaker.allow_call()
+    breaker.record_success()
+    assert breaker.state == "closed"
+    assert breaker.allow_call() is True