@inetafrica/open-claudia 3.5.20 → 3.5.23

package/.env.example

@@ -74,12 +74,17 @@ USAGE_ALERT_COOLDOWN_MS=1800000
 # when a window's use passes these percentages, once per window (off = never).
 LIMIT_WARN_PERCENTS=80,95
 # A message a usage limit stopped is picked up when the limit resets, unless
-# the person writes again first: on (default) | off.
+# the person writes again first: on (default) | off. Scheduled runs and the
+# dream's AI step always wait for the reset.
 LIMIT_PICKUP=on
-# Seconds after the reset before it runs (default 120); a reset further out
-# than LIMIT_PICKUP_MAX_WAIT_H hours (default 192) is not waited for.
+# Seconds after the reset before waiting work runs (default 120); a reset
+# further out than LIMIT_PICKUP_MAX_WAIT_H hours (default 192) is not waited
+# for. One rule for chat messages, scheduled runs and the dream.
 LIMIT_PICKUP_DELAY_S=120
 LIMIT_PICKUP_MAX_WAIT_H=192
+# Messages sent while a conversation is busy run together as one turn when it
+# ends (on, default); off runs them one at a time.
+QUEUE_BATCH=on
 MEMORY_RECALL_MAX_CHARS=9000
 # Default recall engine when a chat hasn't picked one with /engine: classic | discoverer
 RECALL_ENGINE=classic

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 3.5.23
+
+Usage limits as one rule, /stop as a real cancel, the queue's ✕ and run-together, and background checks on Haiku 5.5 and Sonnet 5.5 (Sumeet, 9 Oct 15:56 EAT: "yeh release and upgrade all the bots, include rahil for the updates going forward"). 3.5.20 below, the Browser app, only ever went out as a canary build, so this is the first release that brings it to everyone. 3.5.21 and 3.5.22 were tagged with the same changes but never published: 3.5.21's build stopped on the new /stop and queue test, which needed the fake agent its neighbours run on (CI has no Claude or Codex installed), and 3.5.22's builds stopped on two timing checks that busy build machines pushed past their limits (the boot matrix's 30 s per boot, the /stop test's 3 s and 2.5 s windows); those checks now allow more time.
+
+Usage limits as one runtime rule (Sumeet, 9 Oct 2026 after the 07:00 dream failed on his bots: "it should use whatever the active model is … if the Claude model's out of usage … we can't assume that the other will be available … do the standard wake up, the delay until the bot's session has been replenished … the handling of session limits working as a foundational concept rather than just being hacks"). On 9 Oct the 07:00 dream's AI step failed on 18 of 24 fleet bots: Codex bots dreamed on a signed-out Claude, used-up limits failed instead of waiting, and Claude Code's refresh-lock race was final. No chats failed.
+
+- **Work a usage limit stops waits for the reset, the same way everywhere.** One rule (`core/usage-limits.js` `limitRetryAt`: 2 minutes after the reset, `LIMIT_PICKUP_DELAY_S`; never a reset more than `LIMIT_PICKUP_MAX_WAIT_H`, 192 h, away) now serves a chat message (the 3.5.18 pick-up), a scheduled run and the dream. Never on the other provider: it may not be signed in, or be used up too.
+- **A scheduled run a limit stops waits for the reset.** A wake-up, watch or cron that hit a limit used to retry every 30 s and give up after its attempts ("gave up and will not fire"). It now waits in the jobs store until the reset ("⏳ Claude's weekly limit is used up, so this scheduled run waits. I'll run it at 11:02, when it resets."), without using up an attempt; a cron's ticks meanwhile start nothing; the run after the reset is told it waited, and a reset that is used up again waits again, at most 5 times.
+- **The dream's AI step waits for the reset.** The automatic filing and graph upkeep run on time; the AI-led merges and self-review run after the reset ("⏳ Codex's weekly limit is used up, so the AI-led merges wait for its reset: I'll run them tomorrow at 11:02."), on a timer kept in the dream state, so a restart keeps it. A sign-in that died says so plainly ("Claude's sign-in on this bot has expired (send /login to sign in again)").
+- **Background work with nobody behind it runs on the bot's own provider.** The dream, introspection and other checks outside any chat now use the provider the owner chats on (`/backend`, `/login`), else the one a new chat starts on. They used to take the first provider that did not look signed out, which on a Codex bot was a signed-out Claude.
+- **A signed-out Claude reads as signed out.** `claude auth status` prints `{"loggedIn": false}` (Claude Code 2.1), which no check matched, so the bot read it as "unknown" and still chose Claude.
+- **One reading of a provider's failure for chats and background calls** (`providerFailureCode`). Background calls now see a plan limit as `PROVIDER_USAGE_LIMIT` with its reset time (it was a plain `UTILITY_PROVIDER_ERROR`). A dead sign-in ("Failed to authenticate: OAuth session expired and could not be refreshed", "OAuth access token is invalid", Codex's "Your authentication token has expired") is a sign-in error in chats and background calls alike, so a chat gets the /login help instead of a raw error. Claude Code's refresh-lock race ("another Claude Code process is refreshing it") gets one more try, 20 s later, in work nobody waits on (the dream, memory review, sub-agents); a chat's own checks go without rather than hold the reply up.
+- **A limit is recorded for every waiter.** Any run a limit stops (a chat turn, a scheduled run, a background call) records the provider as used up until its reset (`usage-limits.json` `blocks`); background calls do not start it until then, and any run on it that works clears the record. Chat turns never read the record: they always try, so the provider stays the judge. A weekly Opus limit stops only Opus calls.
+- **Tests:** `test-limit-waits.js` (new: background calls through the fake Claude CLI, scheduled runs, the dream and its timer, provider choice with nobody behind a call, the signed-out status), `test-usage-limits.js` (the rule and the record), `test-provider-events.js` (Claude Code 2.1.280's own sign-in and refresh-race wording); the fake agent CLI gains a `provider-error` scenario (`FAKE_AGENT_ERROR_TEXT`, `FAKE_AGENT_ERROR_ONCE_FILE`).
+
+/stop and the queue (Sumeet, 9 Oct 14:18 EAT, with a screenshot of home pi: "it doesn't seem to understand i cancelled something … one for a queued message a small card with delete queued … i can delete message 2 and 4 arbitrarily from the queue … when the turn finishes … get all the messages that are queued at once? no point of them coming in series is there?").
+
+- **A /stop is a cancel, not a cut.** /stop kills the provider mid-turn. On the next message Claude Code resumes the session and writes the stopped turn into the history the way a restart's cut reads ("[Request interrupted by user for tool use]", then "Continue from where you left off."), and the system prompt (since 3.5.11) says to finish work a restart cut off. So the stopped request came back: home pi answered the message after "/stop" on "ok play big bang" with "Big Bang didn't start … Just say if you still want it." /stop now marks the conversation in its turn-journal file (kept across a restart), and the conversation's next turn opens with a note that the person stopped that request and it is cancelled; the system prompt says so too. A stop before the provider started, or of a compaction, leaves no note; `/new`, `/end` and a project change drop it.
+- **Each "Queued." notice has a ✕ Remove from queue button.** It takes that one message out of the queue, so of four queued messages the second and fourth can go while the others stay ("Removed from the queue: "…""). Only the person who sent it, or the owner, can remove it; a message that already started says so.
+- **Queued messages run together.** When a turn ends, the messages the person sent meanwhile run as one turn ("3 messages arrived while you were busy … where a later one changes or cancels an earlier one, the later one wins"), in order, with every image and file, the reply answering the newest. They used to run one turn each, in series, each without the others. Only the same person's plain chat messages in the same session, project, provider and model join (a scheduled run, a side chat's follow-up, a limit pick-up and a live call run on their own), at most 10 per turn. `QUEUE_BATCH=off` runs them one at a time again.
+- **Tests:** `test-stop-queue.js` (new: the note after a /stop, once, kept on disk, not after `/new` or a stop before the provider started; three queued messages as one turn with no journal leftovers; ✕ on two of four; who may press; what joins a batch), `test-turn-journal.js` (the stop survives a restart's boot pass); the fake agent CLI logs every `[[tag:…]]` in a prompt and `FAKE_AGENT_PROMPT_PROBES` matches.
+
+Background checks on Claude Haiku 5.5 and Sonnet 5.5 (Sumeet, 9 Oct 14:51 EAT: "check if anything using haiku and have it shifted to the new haiku 5.5", then 15:36: "sonnet should also be just 5.5").
+
+- **The low tier is Claude Haiku 5.5** (`claude-haiku-5-5`, was `claude-haiku-4-5-20251001`): the recall router and its warm walker, the recall filter, passive group replies, thread titles, the memory duplicate check and the agency deliberation. List price $0.10 / $0.50 per million tokens for prompts up to 100,000 tokens ($0.50 / $2.50 above), against $1 / $5 for Haiku 4.5. Checked live through the utility agent and Claude Code 2.1.280: a structured duplicate-check reply and a plain thread title, about 5 s each. The /model picker offers Haiku 5.5 instead of 4.5; a typed `/model claude-haiku-4-5-20251001` still works.
+- **The medium tier is Claude Sonnet 5.5** (`claude-sonnet-5-5`, was `claude-sonnet-4-6`): the post-turn memory reviewer, the tool-rule guard and `open-claudia agent` sub-agents. List price $2 / $10 per million tokens, cache reads $0.10, against $3 / $15 and $0.30 for Sonnet 4.6; Sonnet 5.5 uses the newer tokenizer (about 30% more tokens for the same text), so a call costs roughly 15% less on fresh input and output and over half less on cache reads. The /model picker offers Sonnet 5.5 instead of 4.6; a typed `/model claude-sonnet-4-6` still works. A weekly Sonnet limit still stops only Sonnet work.
+
 ## 3.5.20
 
 The Browser app in Kazee Chat, bot apps v1 (Sumeet, 9 Oct 12:02 EAT: "fine go ahead and push but also ensure you clear the images after they all done"). Kazee Chat opens it through Agent Space, which calls these pod routes with the control token.

package/README.md

@@ -346,7 +346,7 @@ Unsupported optional controls return a provider-specific explanation and do not
 
 ## Utility provider policy
 
-Background intelligence—sub-agents, recall, memory review, dream/introspection, and the external-person enforcer—uses one provider-selection policy. A per-purpose override is checked first, then `UTILITY_PROVIDER` (default `active`), the active foreground provider when a chat exists, and `DEFAULT_PROVIDER` for global jobs. Providers translate the neutral `low`, `medium`, and `high` tiers to their own models; exact per-provider model overrides remain available.
+Background intelligence—sub-agents, recall, memory review, dream/introspection, and the external-person enforcer—uses one provider-selection policy. A per-purpose override is checked first, then `UTILITY_PROVIDER` (default `active`): the speaker's provider when a chat exists, and for work with nobody behind it (the dream, introspection) the provider the owner chats on, else `DEFAULT_PROVIDER`, else the one a new chat starts on. A provider a usage limit has used up is not started for background work until its reset; such work waits for the reset (the dream) or goes without (a recall check), and never moves to the other provider. Providers translate the neutral `low`, `medium`, and `high` tiers to their own models; exact per-provider model overrides remain available.
 
 Foreground turns never silently fall back to a different provider. Utility work uses `PROVIDER_FALLBACKS` only when the operator explicitly supplies an ordered list, starts a fresh provider session, and records the provider/model used. The relationship enforcer may try that configured list, but total failure always fails closed and asks the owner to decide.
 
@@ -455,7 +455,8 @@ All stored in `~/.open-claudia/`:
 | `USAGE_ALERT_BASELINE_TURNS` / `USAGE_ALERT_MIN_BASELINE_TURNS` / `USAGE_ALERT_COOLDOWN_MS` | No | Tune token-rate baseline size, minimum sample size, and alert cooldown |
 | `LIMIT_WARN_PERCENTS` | No | Plan-limit warnings in the chat: comma-separated percentages of a 5-hour or weekly window (default `80,95`, `off` disables). Each is said once per window, after the reply that crossed it; never to an outside contact |
 | `LIMIT_PICKUP` | No | `on` (default) or `off`. A message a Claude or Codex usage limit stopped is picked up when the limit resets; the person writing again in that conversation, `/stop`, `/new` or `/end` drops it, and a new limit hit arms it again |
-| `LIMIT_PICKUP_DELAY_S` / `LIMIT_PICKUP_MAX_WAIT_H` | No | Seconds after the reset before the pick-up runs (default `120`); resets further out than this many hours (default `192`) are not waited for |
+| `LIMIT_PICKUP_DELAY_S` / `LIMIT_PICKUP_MAX_WAIT_H` | No | Seconds after the reset before waiting work runs (default `120`); resets further out than this many hours (default `192`) are not waited for. One rule for a picked-up message, a scheduled run a limit stopped (it waits instead of failing) and the dream's AI step |
+| `QUEUE_BATCH` | No | `on` (default) or `off`. Messages a person sends while their conversation is busy run together as one turn when it ends (the same person's plain chat messages, at most 10); `off` runs them one at a time. Each "Queued." notice has a ✕ Remove from queue button either way |
 | `MEMORY_RECALL_MAX_CHARS` | No | Hard cap for auto-injected pack/entity memory per turn (default `9000`, `off` disables auto recall injection) |
 | `RECALL_ENGINE` | No | Default recall engine when a chat hasn't set one via `/engine` (`classic` or `discoverer`, default `discoverer`) |
 | `RECALL_GRAPH_DB` / `RECALL_METRICS` | No | Override the discoverer graph DB path; `off` on metrics disables per-turn recall logging |
@@ -468,11 +469,11 @@ All stored in `~/.open-claudia/`:
 | `TRANSCRIPT_MAX_ENTRY_CHARS` | No | Max chars per transcript entry (default `12000`) |
 | `TRANSCRIPTS_DIR` / `PACKS_DIR` / `ENTITIES_DIR` | No | Override storage directories |
 | `PACK_REVIEW` | No | `off` disables the post-turn pack/entity reviewer (default on) |
-| `PACK_REVIEW_MODEL` | No | Model for the reviewer (default `haiku`) |
+| `PACK_REVIEW_MODEL` | No | Model for the reviewer (default: the provider's medium tier, `claude-sonnet-5-5` on Claude). Background checks without a model of their own use the low tier: `claude-haiku-5-5` on Claude |
 | `PACK_MATCH_THRESHOLD` / `ENTITY_MATCH_THRESHOLD` | No | Router match score thresholds (default `2`) |
 | `DREAM` | No | `off` disables the nightly memory consolidation pass (default on) |
 | `DREAM_CRON` | No | Schedule for the dream pass (default `0 4 * * *`) |
-| `DREAM_PROVIDER` | No | Provider for dream and introspection (`claude` or `codex`); otherwise scheduled work resolves through `DEFAULT_PROVIDER` |
+| `DREAM_PROVIDER` | No | Provider for dream and introspection (`claude` or `codex`); otherwise the provider the owner chats on, then `DEFAULT_PROVIDER` |
 | `DREAM_MODEL_CLAUDE` / `DREAM_MODEL_CODEX` | No | Exact per-provider dream model override; legacy `DREAM_MODEL` remains a Claude-only compatibility alias |
 | `DREAM_TIER` | No | Provider-owned model tier for the dream pass: `low`, `medium`, or `high` (default) |
 | `DREAM_FULL_SWEEP_DAYS` | No | Days between full-corpus dream sweeps; other nights are cheap deltas over recently-touched packs (default `30`) |

package/core/actions.js

@@ -918,6 +918,10 @@ async function handleAction(envelope) {
   if (d.startsWith("rq:")) {
     return require("./turn-journal").handleRunDropped(d, envelope, { isOwner: isChatOwner(envelope.channelId) });
   }
+  // The ✕ on a "Queued." notice: take that message out of the queue.
+  if (d.startsWith("qx:")) {
+    return require("./runner").handleQueueRemove(d, envelope, { isOwner: isChatOwner(envelope.channelId) });
+  }
   if (d.startsWith("grd:")) {
     // Guardrail capture buttons (Track C). Owner-only: standing rules layer
     // above lessons and are never editable by an external speaker.

package/core/auth-flow.js

@@ -109,7 +109,12 @@ function looksLikeOpenAIKey(value) {
 
 function isClaudeAuthErrorText(text) {
   const lower = String(text || "").toLowerCase();
-  return lower.includes("unauthorized") ||
+  // `claude auth status` prints JSON in Claude Code 2.1: signed out it is
+  // {"loggedIn": false, "authMethod": "none"} (exit 1), which no phrase below
+  // matched, so a signed-out Claude read as "unknown" and was still chosen
+  // (9 Oct 2026: the dream of every Codex-only bot ran on Claude).
+  return /"loggedin"\s*:\s*false/.test(lower) ||
+    lower.includes("unauthorized") ||
     lower.includes("not logged in") ||
     lower.includes("login required") ||
     lower.includes("reauthenticate") ||
@@ -145,7 +150,7 @@ function summarizeAuthOutput(output, ok) {
 function summarizeClaudeAuthStatus(output, exitCode, tokenInfo) {
   const text = String(output || "");
   const lower = text.toLowerCase();
-  const loggedOut = /not (logged in|authenticated)|unauthenticated|no auth|login required/.test(lower);
+  const loggedOut = /not (logged in|authenticated)|unauthenticated|no auth|login required|"loggedin"\s*:\s*false/.test(lower);
   const loggedIn = !loggedOut && (exitCode === 0 || /logged in|authenticated|claude\.ai|anthropic/.test(lower));
   const email = (text.match(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/i) || [null])[0];
   const provider = /claude\.ai|claudeai/.test(lower) ? "Claude.ai" : (/anthropic/.test(lower) ? "Anthropic" : "unknown");

package/core/dream.js

@@ -26,6 +26,7 @@ const daySeeds = require("./day-seeds");
 const packGuard = require("./pack-guard");
 const persona = require("./persona");
 const { spawnUtilityAgent } = require("./utility-agent");
+const usageLimits = require("./usage-limits");
 const recallMetrics = require("./recall/metrics");
 const recallTuning = require("./recall/tuning");
 const recallGraphLib = require("./recall/graph");
@@ -1117,6 +1118,40 @@ function failedIntelligenceMetadata(error) {
   };
 }
 
+// Waits in a row for a limit (a reset that is used up again at once) before
+// the dream gives up until its next nightly run.
+const DREAM_LIMIT_MAX_WAITS = 5;
+
+// A dream AI step a usage limit stopped waits for the reset, like a chat
+// message or a scheduled run (core/usage-limits limitRetryAt), never on
+// another provider. Null when the failure was not a limit, or its reset is
+// unknown or too far out to wait for.
+function dreamLimitWait(error, { now = Date.now() } = {}) {
+  const result = error?.result || null;
+  if ((error?.code || result?.error?.code) !== "PROVIDER_USAGE_LIMIT") return null;
+  const provider = result?.provider || null;
+  const hit = usageLimits.limitHitDetails({ provider, error: result?.error || error, now });
+  const runAt = usageLimits.limitRetryAt(hit?.resetsAt, { now });
+  if (!hit || runAt === null || !usageLimits.canWaitFor(runAt, { now })) return null;
+  return { provider, limitType: hit.limitType || null, resetsAt: hit.resetsAt, runAt };
+}
+
+function limitName(provider, limitType) {
+  return `${usageLimits.providerLabel(provider)}'s ${usageLimits.windowLabel(limitType)}`;
+}
+
+// The "Heads up — <note>, so I skipped the AI-led merges" note of an AI step
+// that failed for good: plain words for a sign-in that died or a limit with
+// no reset, the provider's own message otherwise.
+function dreamFailNote(error) {
+  const result = error?.result || null;
+  const code = error?.code || result?.error?.code;
+  const label = usageLimits.providerLabel(result?.provider);
+  if (code === "PROVIDER_UNAUTHENTICATED") return `${label}'s sign-in on this bot has expired (send /login to sign in again)`;
+  if (code === "PROVIDER_USAGE_LIMIT") return `${label}'s usage limit is used up and it gave no reset time`;
+  return `the AI consolidation step didn't finish (${error?.message || "unknown error"})`;
+}
+
 async function previewDreamWith(runUtility, { provider = null } = {}) {
   const result = await runUtility(buildDreamPrompt(), dreamUtilityOptions("dream", {
     provider,
@@ -1189,6 +1224,14 @@ async function runDreamMutation({ trigger = "manual", provider = null, runUtilit
     // decision (applyDream no-ops), note it for the report, and carry on.
     let decision = null;
     let modelFailNote = "";
+    let limitWait = null;
+    // Waits in a row so far: a run after a reset that is used up again counts on.
+    const waitsBefore = trigger === "limit-reset" ? Number(dreamState.limitWait?.attempts) || 0 : 0;
+    const limitWaitFor = (error) => {
+      const wait = dreamLimitWait(error);
+      if (!wait || waitsBefore + 1 <= DREAM_LIMIT_MAX_WAITS) return { wait, note: "" };
+      return { wait: null, note: `${limitName(wait.provider, wait.limitType)} is still used up after ${DREAM_LIMIT_MAX_WAITS} waits (the next nightly dream tries again)` };
+    };
     let consolidationIntelligence = intelligenceMetadata(null, "not_run");
     try {
       const dreamRun = await runUtility(
@@ -1208,7 +1251,10 @@ async function runDreamMutation({ trigger = "manual", provider = null, runUtilit
       }
     } catch (e) {
       consolidationIntelligence = failedIntelligenceMetadata(e);
-      modelFailNote = `the AI consolidation step didn't finish (${e.message})`;
+      const waiting = limitWaitFor(e);
+      limitWait = waiting.wait;
+      if (limitWait) consolidationIntelligence.status = "waiting_for_limit";
+      else modelFailNote = waiting.note || dreamFailNote(e);
     }
     if (!decision) decision = { report: "" };
 
@@ -1266,7 +1312,9 @@ async function runDreamMutation({ trigger = "manual", provider = null, runUtilit
     catch (e) { console.warn(`[dream] certification proposals failed: ${e.message}`); }
     const consolidationLines = applied.concat(nestLines, journalLines, coRescueLines, hebbianLines, prospectiveLines, regressionLines, costLines, certLines, knobLines);
     let report = decision.report || (consolidationLines.length > 0 ? "Tidied up my memory overnight." : "");
-    if (modelFailNote) {
+    if (limitWait) {
+      report = `⏳ ${limitName(limitWait.provider, limitWait.limitType)} is used up, so the AI-led merges wait for its reset: I'll run them ${usageLimits.whenPhrase(limitWait.runAt)}. The automatic filing + graph upkeep ran now.${report ? " " + report : ""}`;
+    } else if (modelFailNote) {
       report = `Heads up — ${modelFailNote}, so I skipped the AI-led merges this round but still ran the automatic filing + graph upkeep.${report ? " " + report : ""}`;
     }
 
@@ -1278,8 +1326,9 @@ async function runDreamMutation({ trigger = "manual", provider = null, runUtilit
     let introReport = "";
     let introApplied = [];
     let introProposed = null;
-    let introspectionIntelligence = intelligenceMetadata(null, introspectEnabled() ? "not_run" : "disabled");
-    if (introspectEnabled()) {
+    let introspectionIntelligence = intelligenceMetadata(null, introspectEnabled() ? (limitWait ? "waiting_for_limit" : "not_run") : "disabled");
+    // A used-up limit stops this step too: it runs with the dream after the reset.
+    if (introspectEnabled() && !limitWait) {
       try {
         const introRun = await runUtility(buildIntrospectionPrompt(), dreamUtilityOptions("introspection", {
           provider,
@@ -1300,6 +1349,11 @@ async function runDreamMutation({ trigger = "manual", provider = null, runUtilit
         }
       } catch (e) {
         introspectionIntelligence = failedIntelligenceMetadata(e);
+        limitWait = limitWaitFor(e).wait;
+        if (limitWait) {
+          introspectionIntelligence.status = "waiting_for_limit";
+          introReport = `⏳ ${limitName(limitWait.provider, limitWait.limitType)} ran out during my self-review: I'll run the dream again ${usageLimits.whenPhrase(limitWait.runAt)}, when it resets.`;
+        }
         console.warn(`[dream] introspection phase failed: ${e.message}`);
       }
     }
@@ -1493,6 +1547,12 @@ async function runDreamMutation({ trigger = "manual", provider = null, runUtilit
       dreamState.fallbackUsed = consolidationIntelligence.fallbackUsed;
       dreamState.lastRunStatus = consolidationIntelligence.status;
       dreamState.introspection = introspectionIntelligence;
+      // The AI step waits for a limit's reset (createDreamLimitWait runs the
+      // dream then); a run that got past the limit, or failed another way,
+      // leaves nothing waiting. Waits in a row are counted and capped.
+      dreamState.limitWait = limitWait
+        ? { ...limitWait, attempts: waitsBefore + 1, since: (waitsBefore && dreamState.limitWait?.since) || nowISO }
+        : null;
       writeDreamState(dreamState);
     } catch (e) { console.warn(`[dream] state write failed: ${e.message}`); }
 
@@ -1553,6 +1613,7 @@ async function runDreamMutation({ trigger = "manual", provider = null, runUtilit
     introspectionProvider: introspectionIntelligence.provider,
     introspectionModel: introspectionIntelligence.model,
     introspectionFallbackUsed: introspectionIntelligence.fallbackUsed,
+    limitWait,
   };
 }
 
@@ -1622,10 +1683,11 @@ async function dreamSummaryTarget(adapters, deps = {}) {
   return null;
 }
 
-// One scheduled dream (cron or catch-up) with its summary.
+// One scheduled dream (cron, catch-up, or after a limit's reset) with its summary.
 async function runScheduledDream(trigger, adapters, deps = {}) {
   try {
     const res = await (deps.runDream || runDream)({ trigger });
+    try { deps.afterRun?.(res); } catch (_) { /* arming the next wait is best effort */ }
     if (res.skipped) { console.log(`dream: skipped — ${res.skipped}`); return res; }
     console.log(`dream: applied ${(res.applied || []).length} change(s)`);
     if (!summaryEnabled()) { console.log("dream: summary muted (DREAM_SUMMARY=off)"); return res; }
@@ -1670,6 +1732,63 @@ function createDreamCatchUp(adapters, deps = {}) {
   };
 }
 
+// The dream whose AI step a usage limit stopped runs again after the reset
+// (dream state limitWait.runAt), as a whole dream: its automatic steps are
+// safe to repeat. Armed at boot, after every scheduled run, and hourly (a
+// manual /dream may have recorded a wait), so a restart never loses it.
+function createDreamLimitWait(adapters, deps = {}) {
+  const now = deps.now || Date.now;
+  const readState = deps.readState || readDreamState;
+  const setTimer = deps.setTimer || setTimeout;
+  const clearTimer = deps.clearTimer || clearTimeout;
+  const isDreaming = deps.isDreaming || defaultDreamService.isDreaming;
+  // setTimeout's ceiling is ~24.8 days; a week's wait fits, the rest re-arms.
+  const MAX_TIMER_MS = 2 ** 31 - 1;
+  let timer = null;
+  let armedFor = null;
+
+  function disarm() {
+    if (timer) clearTimer(timer);
+    timer = null;
+    armedFor = null;
+  }
+
+  function arm() {
+    let runAt = NaN;
+    try { runAt = Number(readState()?.limitWait?.runAt); } catch (_) { runAt = NaN; }
+    if (!Number.isFinite(runAt)) { disarm(); return null; }
+    if (timer && armedFor === runAt) return runAt;
+    disarm();
+    armedFor = runAt;
+    timer = setTimer(() => { fire().catch((e) => console.warn(`dream: limit-reset run failed: ${e.message}`)); }, Math.min(Math.max(runAt - now(), 0), MAX_TIMER_MS));
+    timer?.unref?.();
+    console.log(`dream: AI step waits for a usage limit; runs ${new Date(runAt).toISOString()}`);
+    return runAt;
+  }
+
+  async function fire() {
+    timer = null;
+    armedFor = null;
+    let wait = null;
+    try { wait = readState()?.limitWait || null; } catch (_) { wait = null; }
+    const runAt = Number(wait?.runAt);
+    if (!Number.isFinite(runAt)) return { skipped: "nothing waits" };
+    if (runAt - now() > 1000) return { skipped: "not yet", runAt: arm() };
+    if (isDreaming()) {
+      // A dream is running now: look again in a minute.
+      timer = setTimer(() => { fire().catch(() => {}); }, 60000);
+      timer?.unref?.();
+      armedFor = runAt;
+      return { skipped: "a dream is already running" };
+    }
+    const res = await runScheduledDream("limit-reset", adapters, deps);
+    arm();
+    return res;
+  }
+
+  return { arm, fire, disarm };
+}
+
 // In-bot scheduler: one quiet-hours cron (tolerating a late start up to
 // DREAM_LATE_TOLERANCE_MS, see core/cron-schedule), a boot + hourly catch-up
 // check, and the summary to the owner's channel (dreamSummaryTarget). When the
@@ -1685,18 +1804,20 @@ function initDream(adapters, deps = {}) {
   }
   const { DREAM_LATE_TOLERANCE_MS } = require("./config");
   const toleranceMs = Number.isFinite(deps.toleranceMs) ? deps.toleranceMs : DREAM_LATE_TOLERANCE_MS;
-  const task = scheduleTolerant(DREAM_CRON, () => runScheduledDream("cron", adapters, deps), {
+  const limitWait = createDreamLimitWait(adapters, deps);
+  const runDeps = { ...deps, afterRun: () => limitWait.arm() };
+  const task = scheduleTolerant(DREAM_CRON, () => runScheduledDream("cron", adapters, runDeps), {
     cron: cronLib, toleranceMs, noOverlap: true, label: "dream",
   });
-  const catchUp = createDreamCatchUp(adapters, deps);
+  const catchUp = createDreamCatchUp(adapters, runDeps);
   const setTimer = deps.setTimer || setTimeout;
   const setRepeat = deps.setInterval || setInterval;
-  const boot = setTimer(() => { catchUp("boot").catch(() => {}); }, Number.isFinite(deps.bootDelayMs) ? deps.bootDelayMs : 60000);
-  const hourly = setRepeat(() => { catchUp("hourly").catch(() => {}); }, 3600000);
+  const boot = setTimer(() => { limitWait.arm(); catchUp("boot").catch(() => {}); }, Number.isFinite(deps.bootDelayMs) ? deps.bootDelayMs : 60000);
+  const hourly = setRepeat(() => { limitWait.arm(); catchUp("hourly").catch(() => {}); }, 3600000);
   boot?.unref?.();
   hourly?.unref?.();
   console.log(`dream: scheduled (${DREAM_CRON}, late tolerance ${Math.round(toleranceMs / 60000)} min, provider policy tier ${dreamTier()}, effort ${DREAM_EFFORT}, introspect ${introspectEnabled() ? "on" : "off"})`);
-  return { task, catchUp };
+  return { task, catchUp, limitWait };
 }
 
 module.exports = {
@@ -1704,6 +1825,7 @@ module.exports = {
   buildIntrospectionPrompt, parseIntrospection, applyIntrospection, writeDreamReport,
   summaryDelta, healthOf, mergeClusters, selectDumpDirs, journalBackfillDedupe, staleTaskReport,
   dreamSummaryTarget, runScheduledDream, dreamOverdue, createDreamCatchUp, DREAM_CATCHUP_MS,
+  createDreamLimitWait, dreamLimitWait, dreamFailNote, DREAM_LIMIT_MAX_WAITS,
   coRescueEdgesPhase, negativeHebbianPhase, readDreamState, writeDreamState,
   enabled, summaryEnabled, introspectEnabled, selfApplyEnabled, dreamTier,
   DREAM_CRON, DREAM_EFFORT, DREAM_OUTPUT_SCHEMA, INTROSPECTION_OUTPUT_SCHEMA,

package/core/handlers.js

@@ -118,6 +118,8 @@ function dropLaneQueue(lane, reason) {
 // Clears the CURRENT conversation's queue only: /new, /end or a project change
 // in one thread must not drop what another conversation has waiting.
 function clearTransientQueue(state, reason = "Session context changed before the queued run started") {
+  // The stopped turn's history goes with the session: nothing to warn about.
+  if (state) { try { require("./turn-journal").clearStopped(currentLaneKey(state)); } catch (_) {} }
   return dropLaneQueue(state ? peekLane(state) : null, reason).length;
 }
 
@@ -1739,6 +1741,18 @@ function stopLane(state, lane) {
   return null;
 }
 
+// stopLane for /stop: a run killed mid-turn left its request in the session's
+// history, so the conversation's next turn is told it was cancelled (core/
+// turn-journal markStopped). A compaction or a turn still preparing left none.
+function stopAndMarkLane(state, lane) {
+  const killed = lane.runningProcess && lane.activeRunContext ? lane.activeRunContext : null;
+  const stopped = stopLane(state, lane);
+  if (stopped && killed) {
+    try { require("./turn-journal").markStopped(lane.key, { runContext: killed }); } catch (_) {}
+  }
+  return stopped;
+}
+
 const STOP_DROP_REASON = "Dropped by /stop before it started";
 
 // /stop never silently loses a queued message: each dropped one comes back
@@ -1803,7 +1817,7 @@ register({
       const lanes = state.lanes instanceof Map ? [...state.lanes.values()] : [];
       // Drop the queues first, so no stopped lane's unwind admits them.
       const dropped = lanes.flatMap((lane) => dropLaneQueue(lane, STOP_DROP_REASON));
-      const stopped = lanes.filter((lane) => stopLane(state, lane)).length;
+      const stopped = lanes.filter((lane) => stopAndMarkLane(state, lane)).length;
       const sideStopped = await sideCancellation;
       let pickups = [];
       try { pickups = require("./limit-pickup").cancelAllFor(state.userId, "/stop all"); } catch (_) {}
@@ -1827,7 +1841,7 @@ register({
     // A pick-up waiting for a usage limit to reset is dropped too.
     const pickup = dropLimitPickup("/stop", state, lane.key);
     const pickupNote = pickup ? ` ${pickupDroppedNote(1)}` : "";
-    if (stopLane(state, lane)) {
+    if (stopAndMarkLane(state, lane)) {
       await sideCancellation;
       await send(`${dropped.length ? `Cancelled. ${droppedNote(dropped, "queued")}` : "Cancelled."}${pickupNote}`, dropOffer(dropped));
     } else if (dropped.length) {

package/core/limit-pickup.js

@@ -17,6 +17,9 @@
 //     pick it up" prompt. If that run hits a limit again it re-arms, keeping
 //     the original message and counting attempts (MAX_ATTEMPTS at most).
 // LIMIT_PICKUP=off turns it off (the notice then only says when it resets).
+// When to run again is one rule for every kind of work (usage-limits
+// limitRetryAt); a scheduled run a limit stopped waits the same way in the
+// jobs store (core/scheduler.js), with the notice worded here.
 
 const path = require("path");
 const crypto = require("crypto");
@@ -37,16 +40,10 @@ function setting(name) {
 function enabled() {
   return !/^(off|false|0|no)$/i.test(String(setting("LIMIT_PICKUP") ?? "on").trim());
 }
-// Wait this long after the reset, so the provider's window has turned over.
-function delayMs() {
-  const n = Number(setting("LIMIT_PICKUP_DELAY_S"));
-  return (Number.isFinite(n) && n >= 0 ? n : 120) * 1000;
-}
-// A reset further out than this (a monthly spend cap) is not waited for.
-function maxWaitMs() {
-  const n = Number(setting("LIMIT_PICKUP_MAX_WAIT_H"));
-  return (Number.isFinite(n) && n > 0 ? n : 192) * 3600000;
-}
+// The shared rule (core/usage-limits.js): LIMIT_PICKUP_DELAY_S after the
+// reset, never for a reset more than LIMIT_PICKUP_MAX_WAIT_H away.
+const delayMs = () => limits.limitRetryDelayMs();
+const maxWaitMs = () => limits.limitMaxWaitMs();
 
 // A test run that did not point the store somewhere else never touches the
 // live bot's pick-ups.
@@ -100,9 +97,10 @@ function limitName(provider, limitType) {
 const PICKUP_PROMPT = (hitAt, provider, original) => `Your ${limits.providerLabel(provider)} usage limit stopped this turn at ${hitAt}. The limit has reset, so pick it up now. The message was: ${original}\n\nCheck what you already did (your history, git, files, tool state, the chat) before acting; never repeat a send, push, deploy or write that already happened; then finish.`;
 
 /**
- * What a turn stopped by a limit should do: arm a pick-up (armable) or only
- * say when the limit lifts. Pure: deliverForegroundResult posts `notice` and
- * then calls arm() with the plan when armable.
+ * What a turn stopped by a limit should do: arm a pick-up (armable), wait in
+ * the scheduler (waits: a scheduled run), or only say when the limit lifts.
+ * Pure: deliverForegroundResult posts `notice` and then calls arm() with the
+ * plan when armable; the scheduler reads `waits` and `runAt`.
  */
 function planFor(result, runContext, { now = Date.now(), windows = [], guarded = false } = {}) {
   const hit = limits.limitHitDetails({
@@ -111,21 +109,27 @@ function planFor(result, runContext, { now = Date.now(), windows = [], guarded =
   if (!hit) return null;
   // An outside contact is not told which model or plan the bot runs on.
   const name = guarded ? "My usage limit" : limitName(hit.provider, hit.limitType);
-  const known = Number.isFinite(hit.resetsAt) && hit.resetsAt > now - 6 * 3600000;
-  const runAt = known ? Math.max(hit.resetsAt, now) + delayMs() : null;
+  const runAt = limits.limitRetryAt(hit.resetsAt, { now });
+  const known = runAt !== null;
   const pickup = runContext?.limitPickup || null;
   const attempts = (pickup?.attempts || 0) + 1;
+  const waitable = known && limits.canWaitFor(runAt, { now }) && attempts <= MAX_ATTEMPTS;
+  // A scheduled run waits in the jobs store for the reset (core/scheduler.js).
+  const waits = waitable && runContext?.purpose === "scheduled";
   const armable = enabled()
-    && known
-    && runAt - now <= maxWaitMs()
-    && attempts <= MAX_ATTEMPTS
+    && waitable
     && runContext?.purpose === "foreground"
     && !runContext?.passive
     && !runContext?.liveCall
     && !!runContext?.origin?.adapterId
     && !!runContext?.channelId;
   let notice;
-  if (known && runContext?.purpose && runContext.purpose !== "foreground") {
+  if (waits) {
+    const again = pickup && pickup.limitType && pickup.limitType === hit.limitType ? "is still used up" : "is used up too";
+    notice = pickup
+      ? `⏳ ${name} ${again}. I'll try this scheduled run again ${at(runAt, now)}.`
+      : `⏳ ${name} is used up, so this scheduled run waits. I'll run it ${at(runAt, now)}, when it resets.`;
+  } else if (known && runContext?.purpose && runContext.purpose !== "foreground") {
     notice = `⏳ ${name} is used up, so this ${runContext.purpose === "scheduled" ? "scheduled run" : "run"} stopped. It resets ${at(hit.resetsAt, now)}.`;
   } else if (armable) {
     const again = pickup && pickup.limitType && pickup.limitType === hit.limitType ? "is still used up" : "is used up too";
@@ -141,7 +145,7 @@ function planFor(result, runContext, { now = Date.now(), windows = [], guarded =
   } else {
     notice = `⏳ ${limits.providerLabel(hit.provider)} says its usage limit is reached ("${String(hit.text || "").slice(0, 160)}"). I can't tell when it resets, so send your message again later.`;
   }
-  return { hit, armable, runAt, attempts, notice };
+  return { hit, armable, waits, runAt, attempts, notice };
 }
 
 // ── arm / cancel ────────────────────────────────────────────────────────

package/core/providers/claude.js

@@ -18,15 +18,22 @@ const { createClaudeHookTransport } = require("./claude-hook");
 // consulting this list, so `/model claude-opus-4-8` still works as a rollback.
 // The list is consulted on tapped mb: callbacks (core/actions.js), whose job is
 // to reject a stale button from an old message — that is the intended effect.
-// claude-sonnet-4-6 and claude-haiku-4-5 STAY: they are the tier models for
-// utility work (see tierModel below), not just picker entries.
+// claude-sonnet-5-5 and claude-haiku-5-5 STAY: they are the tier models for
+// utility work (see tierModel below), not just picker entries. Haiku 5.5
+// replaced Haiku 4.5 as the low tier on 9 Oct 2026 (Sumeet: "check if anything
+// using haiku and have it shifted to the new haiku 5.5"), and Sonnet 5.5
+// replaced Sonnet 4.6 as the medium tier the same day ("sonnet should also be
+// just 5.5"); `/model claude-haiku-4-5-20251001` and `/model claude-sonnet-4-6`
+// still work typed.
+const CLAUDE_LOW_TIER_MODEL = "claude-haiku-5-5";
+const CLAUDE_MEDIUM_TIER_MODEL = "claude-sonnet-5-5";
 const CLAUDE_MODELS = Object.freeze([
   "claude-fable-5-1",
   "claude-fable-5",
   "claude-opus-5-5",
   "claude-opus-5",
-  "claude-sonnet-4-6",
-  "claude-haiku-4-5-20251001",
+  CLAUDE_MEDIUM_TIER_MODEL,
+  CLAUDE_LOW_TIER_MODEL,
 ]);
 const CLAUDE_EFFORT_VALUES = Object.freeze(["low", "medium", "high", "xhigh", "max"]);
 // The default governs MAIN turns only: utility work is pinned by tier below
@@ -99,8 +106,8 @@ function appendModelAndLimits(args, context, defaultModel, utility) {
   let model = context.model || settings.model || null;
   if (!model && utility && context.tier) {
     model = context.tier === "low"
-      ? "claude-haiku-4-5-20251001"
-      : (context.tier === "medium" ? "claude-sonnet-4-6" : defaultModel);
+      ? CLAUDE_LOW_TIER_MODEL
+      : (context.tier === "medium" ? CLAUDE_MEDIUM_TIER_MODEL : defaultModel);
   }
   args.push("--model", String(model || defaultModel));
 
@@ -311,8 +318,8 @@ function createClaudeProvider(options = {}) {
     },
     nativeToolsNote: "Claude Code exposes its native tools; Open Claudia's tool hook and approval policy remain authoritative.",
     tierModel(tier) {
-      if (tier === "low") return "claude-haiku-4-5-20251001";
-      if (tier === "medium") return "claude-sonnet-4-6";
+      if (tier === "low") return CLAUDE_LOW_TIER_MODEL;
+      if (tier === "medium") return CLAUDE_MEDIUM_TIER_MODEL;
       return defaultModel;
     },
   };

package/core/providers/events.js

@@ -127,17 +127,40 @@ function createJsonlDecoder(options = {}) {
   return api;
 }
 
+// What a provider's failure means, read in one place for chat turns
+// (core/runner) and background calls (core/utility-agent):
+//   authError  — signed out, or the sign-in died. Waiting does not fix it;
+//                /login does. Claude Code 2.1 words a dead refresh "Failed to
+//                authenticate: OAuth session expired and could not be
+//                refreshed"; Codex "Your authentication token has expired".
+//   usageLimit — a plan limit. Its reset fixes it.
+//   transient  — Claude Code's refresh-lock race ("another Claude Code process
+//                is refreshing it or exited mid-refresh"): a later try works.
+//                Four fleet bots lost the 9 Oct 07:00 dream to it.
 function providerErrorFlags(message) {
   const text = String(message || "").toLowerCase();
+  const transient = /another claude code process is refreshing|exited mid-refresh/.test(text);
   return {
-    authError: /unauthori[sz]ed|not (?:logged in|authenticated)|unauthenticated|login required|authentication failed|auth failed|invalid api key|no credentials|401/.test(text),
+    authError: !transient && /unauthori[sz]ed|not (?:logged in|authenticated)|unauthenticated|login required|authentication failed|auth failed|failed to authenticate|invalid api key|no credentials|401|oauth (?:session|access token|token) (?:expired|has expired|is invalid|is no longer valid)|could not be refreshed|refresh token is no longer valid|authentication token (?:has )?expired/.test(text),
     // "You've hit your limit / session limit / weekly limit / Opus limit · resets …"
     // is how Claude Code words a plan limit; the older patterns never matched it.
     usageLimit: /usage limit|spend limit|monthly cycle|quota|rate limit|hit your (?:[a-z0-9'’-]+ ){0,3}limit/.test(text),
+    transient,
     refusal: /refusals-and-fallback|usage policy|safety classifier|stop_reason['":\s]*refusal/.test(text),
   };
 }
 
+// The error code of a failed run, from its normalized error event's flags.
+// Chat turns pass PROVIDER_EVENT_ERROR as the fallback, background calls
+// UTILITY_PROVIDER_ERROR, so both read a limit or a dead sign-in the same way.
+function providerFailureCode(event, fallback = "PROVIDER_EVENT_ERROR") {
+  if (event?.refusal) return "PROVIDER_REFUSAL";
+  if (event?.authError) return "PROVIDER_UNAUTHENTICATED";
+  if (event?.usageLimit) return "PROVIDER_USAGE_LIMIT";
+  if (event?.transient) return "PROVIDER_TRANSIENT";
+  return fallback;
+}
+
 // The CLI flattens the API's stop_details into the error text; recover the
 // human-readable pieces so the chat message can lead with the actual reason.
 function refusalDetailsFromMessage(message) {
@@ -184,6 +207,7 @@ module.exports = {
   normalizeDecoderError,
   normalizedUsage,
   providerErrorFlags,
+  providerFailureCode,
   refusalDetailsFromMessage,
   selectTerminalText,
   usageFingerprint,