@intentic/sandbox-contract 1.301.0 → 1.303.0

package/src/policy/fence-paths.ts

@@ -0,0 +1,99 @@
+import { PUBLIC_DIR, STATE_DIR } from "@intentic/constants";
+
+// The path arithmetic a workspace fence is made of: whether a path is inside a folder, whether one set of folders
+// covers another, and what a fenced tree may still list. Pure and shared, because the daemon refuses on these answers
+// and the browser draws on them, and two implementations would disagree at exactly the boundary that matters.
+
+// Workspace-relative, forward-slash, no climb: segments are folded so `a/./b` and `a/b` are one path, and a path that
+// climbs above the root folds to `undefined` rather than to something inside it.
+// The root itself is "" — a real answer, not a missing one.
+export const foldPath = (raw: string): string | undefined => {
+    if (raw.startsWith("/") || /^[A-Za-z]:/.test(raw)) {
+        return undefined;
+    }
+    const segments: string[] = [];
+    for (const segment of raw.split(/[\\/]/)) {
+        if (segment === "" || segment === ".") {
+            continue;
+        }
+        if (segment !== "..") {
+            segments.push(segment);
+            continue;
+        }
+        if (segments.pop() === undefined) {
+            return undefined;
+        }
+    }
+    return segments.join("/");
+};
+
+// Whether `path` is `folder` or lives under it, by segment rather than by string prefix: `app2` is not inside `app`.
+// An unfoldable path is inside nothing.
+export const pathInsideFolder = (folder: string, path: string): boolean => {
+    const outer = foldPath(folder);
+    const inner = foldPath(path);
+    if (outer === undefined || inner === undefined) {
+        return false;
+    }
+    return outer === "" || inner === outer || inner.startsWith(`${outer}/`);
+};
+
+// "Change the sandbox" as paths: the daemon's own configuration, and the outbox the internet reads. One list, read by
+// the persona hook that judges a turn's writes and by the area schema that decides what a grant may name.
+export const SANDBOX_PATHS: readonly string[] = [STATE_DIR, PUBLIC_DIR];
+
+// Whether a path is one of those folders or sits inside one, by segment: `publications` is not `public`.
+// No area may name such a folder, which is what keeps a fence from handing anyone the config that decides what agents
+// may do — the enumerated control-plane table (state/workspace-state.ts) locks named entries, not the whole tree.
+export const isSandboxPath = (path: string): boolean => SANDBOX_PATHS.some((folder) => pathInsideFolder(folder, path));
+
+// A fence: the folders a caller may touch, or undefined for the whole workspace. Undefined and `[]` are deliberately
+// different answers — no fence at all, versus a fence that admits nothing.
+export type Fence = readonly string[] | undefined;
+
+/** Whether the fence admits this path at all: reading it, writing it, searching in it. */
+export const fenceAllows = (fence: Fence, path: string): boolean => fence === undefined || fence.some((folder) => pathInsideFolder(folder, path));
+
+/**
+ * Whether a fenced tree may still LIST this path: everything the fence allows, plus the ancestors leading down to it.
+ * Without the ancestors a fence on `finance/reports` would hide `finance` itself and leave the folder unreachable.
+ */
+export const fenceReaches = (fence: Fence, path: string): boolean => {
+    if (fenceAllows(fence, path)) {
+        return true;
+    }
+    const inner = foldPath(path);
+    return inner !== undefined && (fence ?? []).some((folder) => pathInsideFolder(inner, folder));
+};
+
+/**
+ * Whether `outer` covers `inner`: every folder the inner fence admits is one the outer fence admits too. The question
+ * behind every narrowing-only rule — handing work across, inheriting a fence — since a fence that covers another can
+ * safely stand in for it.
+ */
+export const fenceCovers = (outer: Fence, inner: Fence): boolean => {
+    if (outer === undefined) {
+        return true;
+    }
+    if (inner === undefined) {
+        return false;
+    }
+    return inner.every((folder) => fenceAllows(outer, folder));
+};
+
+/**
+ * The tighter of two fences: what a turn may touch when a persona's folders meet the member's own. Undefined on both
+ * sides is the whole workspace; either side alone narrows to itself.
+ */
+export const fenceIntersection = (left: Fence, right: Fence): Fence => {
+    if (left === undefined) {
+        return right;
+    }
+    if (right === undefined) {
+        return left;
+    }
+    // A folder survives only where one side contains it; the containing side's folder is already the narrower of the
+    // pair, so taking each side's contained folders and deduping gives the intersection with no overlap left over.
+    const kept = [...left.filter((folder) => fenceAllows(right, folder)), ...right.filter((folder) => fenceAllows(left, folder))];
+    return [...new Set(kept.map((folder) => foldPath(folder) ?? folder))];
+};

package/src/protocol/routes.test.ts

@@ -47,6 +47,18 @@ describe(`routeNameForRequest`, () => {
         expect(routeNameForRequest(routes, `DELETE`, `/system/terminals/web-1`)).toBe(`system.killTerminal`);
     });
 
+    // Sorted by name, `agents.get` precedes `agents.search`, so first-match would read `/agents/search` as an id.
+    it(`prefers a literal segment over a parameter, whichever the sorted list holds first`, () => {
+        const siblings = contractRoutes({
+            agents: {
+                get: oc.route({ method: "GET", path: "/agents/{id}" }),
+                search: oc.route({ method: "GET", path: "/agents/search" }),
+            },
+        });
+        expect(routeNameForRequest(siblings, `GET`, `/agents/search`)).toBe(`agents.search`);
+        expect(routeNameForRequest(siblings, `GET`, `/agents/abc`)).toBe(`agents.get`);
+    });
+
     it(`strips the query string before matching`, () => {
         expect(routeNameForRequest(routes, `GET`, `/vpn?refresh=1`)).toBe(`vpn.list`);
     });

package/src/protocol/routes.ts

@@ -156,10 +156,17 @@ const pathMatches = (template: string, path: string): boolean => {
 
 // The contract route a request belongs to, or undefined for a hand-written daemon route (/health, /workspace/raw) never
 // gated by the contract. Query string stripped first.
+// How many segments a template leaves open; the tie-breaker below prefers the template that leaves fewest.
+const paramCount = (template: string): number => template.split("/").filter((segment) => segment.startsWith("{") && segment.endsWith("}")).length;
+
 export const routeNameForRequest = (routes: readonly ContractRoute[], method: string, pathWithQuery: string): string | undefined => {
     const path = pathWithQuery.split("?")[0] ?? pathWithQuery;
     const upper = method.toUpperCase();
-    return routes.find((route) => route.method.toUpperCase() === upper && pathMatches(route.path, path))?.name;
+    // A literal segment outranks a parameter: `/agents/search` is the search route, not `get` with an id of "search",
+    // whichever of the two the sorted list happens to hold first.
+    return routes
+        .filter((route) => route.method.toUpperCase() === upper && pathMatches(route.path, path))
+        .toSorted((a, b) => paramCount(a.path) - paramCount(b.path))[0]?.name;
 };
 
 // The route a typed client call belongs to; oRPC addresses a procedure by contract position (`['git','stashApply']`),

package/src/schemas/agents.ts

@@ -2,6 +2,7 @@
 import { z } from "zod";
 import { AgentHarnessSchema, AgentOriginSchema, AgentProviderSchema, ForkedFromSchema } from "./agent.js";
 import { LoopStateSchema } from "./loops.js";
+import { LimitPolicySchema, RetryPolicySchema, TurnBreakPolicySchema, TurnBreakSchema } from "./turn-break.js";
 import { EMOJI_MAX_LENGTH, isSingleEmoji } from "../text/emoji.js";
 // A fleet agent is any conversation with a registry entry, keyed by conversationId. Isolated ones own a git worktree
 // (branch agent/<id>); workspace conversations have none, but both share one status/activity/cost lifecycle.
@@ -252,15 +253,11 @@ export const AgentSummarySchema = z.object({
         .describe(
             "This conversation's own answer to whether its work merges automatically. Absent means it follows the sandbox-wide setting, which is the common case.",
         ),
-    // Per-conversation override, written by the in-chat retry press (not the settings toggle) so one late-night click
-    // can't arm every agent; absent inherits the sandbox setting.
-    resumeAfterOutage: z.boolean().optional(),
-    // Off by default, unlike its neighbors: firing the moment a spent allowance reopens spends a window the user may be
-    // saving.
-    resumeAfterLimit: z.boolean().optional(),
-    // Per-conversation override for moving a held turn to another account with room the moment it's refused; absent
-    // inherits.
-    moveAfterLimit: z.boolean().optional(),
+    // This conversation's own answer to each ending's one question, written by the in-chat control (not the settings
+    // row) so one late-night click can't arm every agent; absent inherits the sandbox-wide policy.
+    limitPolicy: LimitPolicySchema.optional(),
+    outagePolicy: RetryPolicySchema.optional(),
+    stopPolicy: RetryPolicySchema.optional(),
     // A collaborator's ask to land (collaborators can't merge themselves); cleared by whichever merge or discard
     // answers it.
     landRequested: z
@@ -619,33 +616,15 @@ export const AgentAutoLandSchema = z.object({
             "Whether its work merges automatically when a turn finishes. Null clears the override and goes back to following the sandbox-wide setting, so a conversation does not sit holding a frozen copy of a default it has quietly stopped following.",
         ),
 });
-// Same `null`-clears-the-override shape as autoLand, for this conversation's own outage-resume posture.
-export const AgentResumeAfterOutageSchema = z.object({
+// Same `null`-clears-the-override shape as autoLand, for this conversation's own answer to one ending's question.
+// One route rather than one per ending: they are the same decision asked about different walls, and three near-identical
+// verbs is how the surfaces drifted apart in the first place.
+export const AgentBreakPolicySchema = z.object({
     id: z.string().min(1).describe("Which conversation."),
-    resumeAfterOutage: z
-        .boolean()
-        .nullable()
-        .describe("Whether it retries by itself when the model provider was what failed. Null clears the override back to the sandbox-wide setting."),
-});
-// Same three-state override, for the limit blocker; written by the card's own offer when a limit strands a turn.
-export const AgentResumeAfterLimitSchema = z.object({
-    id: z.string().min(1).describe("Which conversation."),
-    resumeAfterLimit: z
-        .boolean()
-        .nullable()
-        .describe(
-            "Whether the turn a spent allowance refused is sent again by itself once the window reopens. Null clears the override back to the sandbox-wide setting.",
-        ),
-});
-// Same three-state override, for moving a held turn to another account with room.
-export const AgentMoveAfterLimitSchema = z.object({
-    id: z.string().min(1).describe("Which conversation."),
-    moveAfterLimit: z
-        .boolean()
-        .nullable()
-        .describe(
-            "Whether the turn a spent allowance refused is moved to another connected account of the same provider that has room, as soon as the refusal lands. Null clears the override back to the sandbox-wide setting.",
-        ),
+    ending: TurnBreakSchema.describe("Which wall this answers for: a spent usage limit, a provider outage, or a turn that stopped short."),
+    policy: TurnBreakPolicySchema.nullable().describe(
+        "What happens next for that ending. `wait` holds the turn for a press; `retry` re-runs it on a bounded ladder (outage, stop); `resend` sends it again at the published reset and `move` also tries another account with room (limit only). An answer the ending does not allow is refused. Null clears the override and goes back to following the sandbox-wide policy, so a conversation does not sit holding a frozen copy of a default it has quietly stopped following.",
+    ),
 });
 export const AgentFileDiffQuerySchema = z.object({
     id: z.string().min(1).describe("Which conversation."),

package/src/schemas/areas.test.ts

@@ -0,0 +1,40 @@
+import { PUBLIC_DIR, STATE_DIR } from "@intentic/constants";
+import { describe, expect, test } from "vitest";
+import { AreaFolderSchema } from "./areas.js";
+
+// What an area may name. These refusals are load-bearing rather than cosmetic: an area's folders become the fence
+// every file route refuses on, so they are the whole of what keeps a grant below maintainer out of the config that
+// decides what agents may do.
+describe("AreaFolderSchema", () => {
+    test("an ordinary folder, at any depth, is an area", () => {
+        expect(AreaFolderSchema.safeParse("support").success).toBe(true);
+        expect(AreaFolderSchema.safeParse("finance/reports").success).toBe(true);
+    });
+
+    test("the workspace root is not an area: naming no area at all is what granting everything means", () => {
+        expect(AreaFolderSchema.safeParse(".").success).toBe(false);
+        expect(AreaFolderSchema.safeParse("/").success).toBe(false);
+    });
+
+    test("a folder that climbs out of the workspace is refused however it is spelled", () => {
+        expect(AreaFolderSchema.safeParse("../etc").success).toBe(false);
+        expect(AreaFolderSchema.safeParse("support/../..").success).toBe(false);
+    });
+
+    test("the sandbox's own configuration and its outbox can never be named", () => {
+        for (const folder of [
+            STATE_DIR,
+            `${STATE_DIR}/config`,
+            `${STATE_DIR}/config/hooks`,
+            PUBLIC_DIR,
+            `${PUBLIC_DIR}/site`,
+        ]) {
+            expect(AreaFolderSchema.safeParse(folder).success, folder).toBe(false);
+        }
+    });
+
+    test("a folder that merely starts with one of those names is ordinary", () => {
+        expect(AreaFolderSchema.safeParse("publications").success).toBe(true);
+        expect(AreaFolderSchema.safeParse("support/public-notes").success).toBe(true);
+    });
+});

package/src/schemas/areas.ts

@@ -0,0 +1,49 @@
+import { z } from "zod";
+import { foldPath, isSandboxPath } from "../policy/fence-paths.js";
+import { entryId } from "./internal.js";
+
+// A named part of the workspace: the unit a person's reach is granted in. Named rather than listed per member because
+// a folder list on every row makes each new folder an edit per member, and two rows meant to see the same thing drift
+// apart the first time one is updated and the other isn't.
+// An area is not a credential and holds none; what it holds is a decision about who sees which folders, which is why
+// the file is tracked and a change to it shows up in review.
+
+// Workspace-relative, forward-slash, no climb. Checked rather than rewritten: a transform here would make the route's
+// wire shape inexpressible, and two builds compare surfaces by that shape. The route folds what it writes instead, so
+// two spellings of one folder still cannot make two entries.
+export const AreaFolderSchema = z
+    .string()
+    .min(1)
+    .max(200)
+    .refine((raw) => (foldPath(raw) ?? "") !== "", {
+        message: "a folder is workspace-relative and inside the workspace; the workspace root is what naming no area already means",
+    })
+    // A fence is what a writer's every file route refuses on, so an area naming the control plane would be the one way
+    // a grant below maintainer could reach the config that decides what agents may do, or publish to the internet.
+    .refine((raw) => !isSandboxPath(raw), {
+        message: "an area cannot name the sandbox's own configuration or its public outbox",
+    });
+
+export const AreaSchema = z.object({
+    id: entryId.describe("The area's id, the name a member row points at."),
+    label: z.string().max(60).optional().describe("What to call it on screen. Absent falls back to the id, which somebody chose anyway."),
+    brief: z
+        .string()
+        .max(200)
+        .optional()
+        .describe("What this part of the workspace is, in one line, so whoever grants it can tell what they are handing over."),
+    folders: z
+        .array(AreaFolderSchema)
+        .min(1)
+        .max(50)
+        .describe(
+            "The folders it admits, workspace-relative. At least one: an area naming nothing would be a grant with no reader, and the way to grant everything is to name no area at all.",
+        ),
+});
+export type Area = z.infer<typeof AreaSchema>;
+
+export const AreasListSchema = z.object({
+    areas: z.array(AreaSchema).describe("Every named part of the workspace this sandbox grants access in."),
+});
+
+export const AreaIdParamSchema = z.object({ id: entryId.describe("Which area.") });

package/src/schemas/automations.ts

@@ -4,6 +4,7 @@ import { AgentOriginSchema, ModelPinSchema } from "./agent.js";
 import { AgentSummarySchema } from "./agents.js";
 import { entryId } from "./internal.js";
 import { IssuesConfigSchema } from "./issues.js";
+import { ZoneSchema } from "../time/zone.js";
 // An automation wakes the agent: the daemon fires each enabled one on its trigger, runs the optional guard command
 // (non-zero exit skips the wake), then runs one turn with the prompt. The manifest is user config; run history is
 // daemon-recorded.
@@ -60,6 +61,13 @@ export const TriggerSchema = z.discriminatedUnion("kind", [
     z.object({
         kind: z.literal("schedule").describe("On a clock."),
         cron: z.string().min(1).describe("When, in cron notation."),
+        // A cron is a WALL-CLOCK RULE: "43 20 * * *" is not a moment, it is 20:43 on some clock, and which clock is
+        // not written in it. The composer sends the reader's own zone here; absent, the sandbox's `timezone` setting
+        // answers, and absent that, UTC. Stored per automation rather than only globally so one chore can keep a
+        // colleague's hours, or a market's, without moving everything else.
+        tz: ZoneSchema.optional().describe(
+            "Which clock the times in the cron mean, as a zone name like Europe/Warsaw. Leave it out to use the sandbox's own setting, which is what you want unless this one chore belongs to a different place.",
+        ),
         // Fires only once at least this many other sessions have started since this automation's last wake; a due run
         // short of that is recorded as skipped.
         afterSessions: z

package/src/schemas/capabilities.ts

@@ -3,7 +3,6 @@
 import { z } from "zod";
 import { ExitConfigSchema } from "./exit.js";
 import { entryId } from "./internal.js";
-import { ServiceKindSchema } from "./inventory.js";
 import { NetdiskConfigSchema } from "./netdisk.js";
 import { VpnConfigSchema } from "./vpn.js";
 // One-way: the browser extension bundles webext.js alone, so nothing there may reach back into this file.
@@ -15,8 +14,6 @@ export const CapabilityKindSchema = z.enum([
     "devops",
     "monorepo",
     "mcp",
-    "service",
-    "integration",
     "cli",
     "plugin",
     "extension",
@@ -42,18 +39,6 @@ export const McpConfigSchema = z.object({
     url: z.url().describe("Where the tool server answers."),
     token: z.string().optional().describe("The credential it needs, if any. Stored, never echoed back."),
 });
-export const ServiceConfigSchema = z.object({
-    service: ServiceKindSchema.describe("Which service to provision."),
-    domain: z.string().min(1).describe("The address it should answer on."),
-    on: z.string().min(1).describe("Which machine to put it on."),
-    expose: z.string().min(1).describe("How it should be reachable."),
-});
-// External-app credential injected into deployed apps (i.have.stripe → STRIPE_API_KEY), not agent-facing like `cli`.
-// Closed, unlike `cli`: it becomes an `i.have.<provider>` deploy.config.ts entry, so the vocabulary belongs to the
-// deploy engine, not an extension.
-export const IntegrationConfigSchema = z.object({
-    provider: z.literal("stripe").describe("Which outside service's credential to make available to deployed apps."),
-});
 // Gives the agent an authenticated CLI tool: credential plus any non-secret URL, injected into the agent's env each
 // turn, taught via an .agents/skills/<id> cheatsheet. Provider fields are data in an extension's
 // `contributes.capabilities`, validated at add-time, not by this schema.
@@ -234,6 +219,43 @@ export const LOCAL_MODEL_WINDOW_DEFAULT: LocalModelWindow = "65536";
 // ceiling no shipped GGUF was trained for it.
 export const LOCAL_MODEL_WINDOW_MIN = 2048;
 export const LOCAL_MODEL_WINDOW_MAX = 1_048_576;
+// q8_0 KV cost per token, the rate every window price derives from: 64 KiB, so the rungs come out at exactly 1, 2, 4
+// and 8 GiB. One rate rather than a per-model one, because the true cost varies ~2x across the list (50–60 KB/token
+// measured) and a per-row figure is arithmetic somebody redoes by hand on every model added. Rounded UP into that band
+// rather than down: over-reserving costs a rung, under-reserving costs an allocation failure a card had promised
+// against.
+export const LOCAL_MODEL_KV_BYTES_PER_TOKEN = 65_536;
+// What a rung honestly serves. `instant` is the one the connect view prefetches — it downloads in under a minute and
+// cannot drive a full agent turn, so no surface may sell it as one; `work` is what that view recommends for real use.
+export type LocalModelTier = "instant" | "work";
+export interface LocalModelChoice {
+    // Hugging Face owner/repo/file.gguf, exactly as LocalModelConfig.model carries it.
+    readonly id: string;
+    readonly label: string;
+    // The published file's own size, not a rounded guess: the card's label, the fit arithmetic and the download
+    // estimate all read this, so a model cannot be priced two ways.
+    readonly weightsBytes: number;
+    readonly tier: LocalModelTier;
+}
+// The curated list, smallest first. ponytail: these bytes are the Hugging Face tree API's answer for each file — the
+// hand-written labels that predated them overstated gemma-4 12B by 2x and Qwen3.8 27B by a third, which is the class of
+// drift a machine-readable size exists to end.
+export const LOCAL_MODELS: readonly LocalModelChoice[] = [
+    { id: "unsloth/Qwen3.5-2B-GGUF/Qwen3.5-2B-Q4_K_M.gguf", label: "Qwen3.5 2B", weightsBytes: 1_280_835_840, tier: "instant" },
+    {
+        id: "unsloth/Phi-4-mini-instruct-GGUF/Phi-4-mini-instruct-Q4_K_M.gguf",
+        label: "Phi-4-mini 3.8B",
+        weightsBytes: 2_491_874_272,
+        tier: "work",
+    },
+    { id: "unsloth/Qwen3.5-9B-GGUF/Qwen3.5-9B-Q4_K_M.gguf", label: "Qwen3.5 9B", weightsBytes: 5_680_522_464, tier: "work" },
+    { id: "unsloth/gemma-4-12b-it-GGUF/gemma-4-12b-it-Q4_K_M.gguf", label: "Gemma 4 12B", weightsBytes: 7_121_861_440, tier: "work" },
+    { id: "unsloth/Qwen3.8-27B-GGUF/Qwen3.8-27B-UD-Q4_K_M.gguf", label: "Qwen3.8 27B", weightsBytes: 16_464_440_224, tier: "work" },
+];
+export const localModelChoice = (id: string): LocalModelChoice | undefined => LOCAL_MODELS.find((choice) => choice.id === id);
+// Exactly one row carries the instant tier; the fit module and the prefetch route take it from here rather than
+// repeating its id, so the prefetched bytes and the offered option cannot name different files.
+export const LOCAL_MODEL_INSTANT: LocalModelChoice = LOCAL_MODELS.find((choice) => choice.tier === "instant")!;
 export const LocalModelConfigSchema = z.object({
     model: z.string().min(1),
     gpu: z.enum(["on", "off"]).default("off"),
@@ -266,8 +288,6 @@ export const WalletConfigSchema = z.object({
 });
 export type WalletConfig = z.infer<typeof WalletConfigSchema>;
 export type McpConfig = z.infer<typeof McpConfigSchema>;
-export type ServiceConfig = z.infer<typeof ServiceConfigSchema>;
-export type IntegrationConfig = z.infer<typeof IntegrationConfigSchema>;
 export type CliConfig = z.infer<typeof CliConfigSchema>;
 export type PluginConfig = z.infer<typeof PluginConfigSchema>;
 export type ExtensionConfig = z.infer<typeof ExtensionConfigSchema>;
@@ -283,8 +303,6 @@ export const CapabilitySchema = z.discriminatedUnion("kind", [
     // operator panel.
     z.object({ id: entryId, kind: z.literal("monorepo"), config: z.object({}) }),
     z.object({ id: entryId, kind: z.literal("mcp"), config: McpConfigSchema }),
-    z.object({ id: entryId, kind: z.literal("service"), config: ServiceConfigSchema }),
-    z.object({ id: entryId, kind: z.literal("integration"), config: IntegrationConfigSchema }),
     z.object({ id: entryId, kind: z.literal("cli"), config: CliConfigSchema }),
     z.object({ id: entryId, kind: z.literal("plugin"), config: PluginConfigSchema }),
     z.object({ id: entryId, kind: z.literal("extension"), config: ExtensionConfigSchema }),

package/src/schemas/personas.ts

@@ -45,7 +45,11 @@ export const PersonaPowersSchema = z.object({
 });
 export type PersonaPowers = z.infer<typeof PersonaPowersSchema>;
 // `folders` only refuses file-tool calls outside it; it stops a misread instruction, not a shell. The container is the
-// real workspace-wide fence.
+// real workspace-wide fence, and a conversation started by a fenced person is narrower still — the turn works inside
+// this persona's folders AND that person's areas, never the wider of the two.
+// A plain folder list rather than a named area (schemas/areas.ts), because the two answer different questions: a
+// persona's fence is written once for that persona, while an area is a grant several people hold and one edit has to
+// move all of them.
 // No placement field, by decision: every session already opens in its own private copy, never the shared tree.
 export const PersonaWorkspaceSchema = z.object({
     // Absent means the workspace root.
@@ -192,7 +196,9 @@ export const PersonaSchema = z.object({
         .string()
         .max(200)
         .optional()
-        .describe("What this persona is for, in one line. A new chat is routed onto a persona by this sentence, and the Personas page shows it under the name."),
+        .describe(
+            "What this persona is for, in one line. A new chat is routed onto a persona by this sentence, and the Personas page shows it under the name.",
+        ),
     powers: PersonaPowersSchema.optional().describe(
         "What a conversation wearing it may do. Absent means the full toolbox, so a card written before this existed behaves exactly as it did.",
     ),
@@ -221,13 +227,18 @@ export const PersonaSchema = z.object({
 export type Persona = z.infer<typeof PersonaSchema>;
 // Ladder filtered to connected providers, deduplicated. Empty (absent, or every provider disconnected) means the card
 // has no opinion — the caller decides, not "run nothing".
-export const personaModels = (card: Pick<Persona, "models">, sources: readonly ModelSource[]): readonly ModelPin[] => readyChain(sources, card.models ?? []);
+export const personaModels = (card: Pick<Persona, "models">, sources: readonly ModelSource[]): readonly ModelPin[] =>
+    readyChain(sources, card.models ?? []);
 // Asked once per chat, on the message it was sent with; answers with the one card the message belongs to, or none.
 // `folder`/`paths` are the facts a card's `context`/`startIn` can be matched against that words alone can't supply.
 export const PersonaRouteAskSchema = z.object({
     prompt: z.string().min(1).max(20000).describe("The message a new chat is about to open with."),
     folder: z.string().max(200).optional().describe("The workspace folder the chat was opened in, when it was opened in one."),
-    paths: z.array(z.string().min(1).max(500)).max(50).default([]).describe("Workspace paths the message names: uploads, @-mentions, the editor's own file."),
+    paths: z
+        .array(z.string().min(1).max(500))
+        .max(50)
+        .default([])
+        .describe("Workspace paths the message names: uploads, @-mentions, the editor's own file."),
 });
 export type PersonaRouteAsk = z.infer<typeof PersonaRouteAskSchema>;
 export const PersonaRouteSchema = z.object({

package/src/schemas/providers/provider-oauth.ts

@@ -141,6 +141,15 @@ export const ModelSchema = z.object({
     // The served window, not the training length — memory can clamp it lower. Turns are refused against this. Absent
     // means unknown, never unlimited.
     contextWindow: z.number().optional().describe("How many tokens this model will accept in one request, where the server publishes it."),
+    // Epoch seconds. A fact about the MODEL, not about any one account: a routed provider balances across credentials,
+    // so a model every one of them is benched on is unrunnable however much headroom their rings show. Absent is the
+    // ordinary case and means runnable, never "unknown".
+    availableAt: z
+        .number()
+        .optional()
+        .describe(
+            "When this model can be asked again, where every credential that serves it is currently refused. Absent means it can be asked now. A model here is still worth showing, unlike one the plan does not cover at all: the wait is the whole answer.",
+        ),
 });
 export type Model = z.infer<typeof ModelSchema>;
 export const ModelsSchema = z.object({

package/src/schemas/providers/usage.ts

@@ -60,9 +60,18 @@ export const UsageTurnSchema = z.object({
     openingListings: z.number().optional(),
     // Tool calls before the turn first touched a file it later edited; absent (not zero) if it edited nothing.
     callsBeforeTarget: z.number().optional(),
+    // Calls that ended in error, counted once each however many updates reported it; absent means unmeasured, not a
+    // clean turn.
+    failedCalls: z.number().optional(),
     // Arm of the project-map experiment, stable per conversation; mapChars is the note's length when sent.
     mapArm: z.boolean().optional(),
     mapChars: z.number().optional(),
+    // Arm of the field-notes experiment, stable per conversation; notesChars is what the budget let through.
+    notesArm: z.boolean().optional(),
+    notesChars: z.number().optional(),
+    // Hash of the brief that was sent, recorded on control turns too. Load-bearing rather than decorative: the file is
+    // rewritten monthly, so a 30-day window holds two different treatments and pooling them would measure neither.
+    notesCohort: z.string().optional(),
     // What became of pre-turn retrieval on this turn, and how long it took. Assignment and DELIVERY are different
     // facts: the first version of this mechanism was assigned to every eligible turn and reached four in five of them,
     // which is the difference between a null result and a mechanism that never ran. Absent means the flag was off, so