@intentic/sandbox-contract 1.344.0 → 1.345.0

package/src/protocol/peer-dial.ts

@@ -58,8 +58,9 @@ export interface PeerDialSpec<S extends SocketLike> {
     readonly hello: () => Promise<Record<string, unknown>> | Record<string, unknown>;
     // Hand the open socket to the oRPC handler serving the door's contract.
     readonly attach: (socket: S) => void;
-    // The retry ladder: how long to wait after a drop, given how long the socket had held.
-    readonly backoff: { readonly next: (heldMs: number) => number };
+    // The retry ladder: how long to wait after a drop, given how long the socket had held; `reset` puts it back on its
+    // floor (`retryNow`).
+    readonly backoff: { readonly next: (heldMs: number) => number; readonly reset: () => void };
 /* How long this socket may hear nothing before the link is presumed dead: `peerLinkSilenceMs` of the heartbeat the door's own hub pings on. */
     readonly silenceMs: number;
     readonly log: (message: string) => void;
@@ -86,8 +87,71 @@ export interface PeerLink {
     readonly stop: (reason?: string) => void;
     readonly state: () => PeerLinkState;
     readonly outage: () => PeerOutage | undefined;
+    /* SOMEBODY KNOWS THE FAR END IS BACK, so the link need not wait to find out (2026-10-19). A machine agent that has
+       just woken a sleeping sandbox knows it is starting, but the link to it had spent the sleep on the ladder: past
+       LONG_OUTAGE_ATTEMPTS each try rests a quarter of an hour, and on rog a sandbox woken at 16:48 had its link back at
+       17:12, 24 minutes with no device tools. This ends a wait on the ladder (the long rest included) and dials now,
+       and puts the outage behind it as an answer would (`failures`, the quiet rule, its `since`, the ladder's rung), so
+       a dial that finds the sandbox still booting retries on the fast floor. A dial in flight is left to finish and
+       only its ladder is reset, so a failure of it retries fast too; an open or stopped link is untouched. */
+    readonly retryNow: () => void;
 }
 
+/* ONE OUTAGE'S BOOKKEEPING: the attempts that have failed since the link was last open, when the first of them was, and
+   what each may say (the quiet rule above). An answer clears it, and so does `retryNow`. */
+const failureRun = (log: (message: string) => void) => {
+    let failures = 0;
+    // When the loop last complained out loud, and when the CURRENT outage began.
+    let quietSince = 0;
+    let since: number | undefined;
+    return {
+        count: (): number => failures,
+        // One more failed attempt; answers how many that makes.
+        fail: (): number => {
+            failures += 1;
+            since ??= Date.now();
+            return failures;
+        },
+        /* What ONE failed attempt is allowed to say. */
+        complain: (said: string, delay: number): void => {
+            const every = `retrying every ${Math.round(delay / 1000)}s`;
+            if (failures <= LOUD_ATTEMPTS) {
+                log(`${said}; reconnecting in ${Math.round(delay / 1000)}s`);
+                return;
+            }
+            if (failures === LOUD_ATTEMPTS + 1) {
+                quietSince = Date.now();
+                log(`${said}; still nothing after ${failures} attempts — ${every}, and saying so at most every ${Math.round(QUIET_LOG_MS / 60_000)} minutes from here`);
+                return;
+            }
+            if (Date.now() - quietSince >= QUIET_LOG_MS) {
+                quietSince = Date.now();
+                log(`${said}; ${failures} failed attempts, ${every}`);
+            }
+        },
+        clear: (): void => {
+            failures = 0;
+            quietSince = 0;
+            since = undefined;
+        },
+        reading: (): PeerOutage | undefined => (since === undefined ? undefined : { failures, since }),
+    };
+};
+
+/* THE WAIT ON THE LADDER hangs off the loop's stop, so a link stopped during it is done at once and never dials again,
+   and off a controller of its own, which `retryNow` aborts to dial at once. Cutting a wait already over does nothing. */
+const ladderWaits = (stopping: AbortSignal) => {
+    let resting: AbortController | undefined;
+    return {
+        wait: (delay: number, dial: () => Promise<void>): void => {
+            const rest = new AbortController();
+            resting = rest;
+            void sleep(delay, { signal: anySignal(stopping, rest.signal) }).then(() => (stopping.aborted ? undefined : dial()));
+        },
+        cut: (): void => resting?.abort(),
+    };
+};
+
 export const dialPeer = <S extends SocketLike>(spec: PeerDialSpec<S>): PeerLink => {
     // The loop's whole life: every way it ends (a stop, a revocation, a pairing gone) aborts this, and everything the
     // loop arms hangs off it, so nothing it left behind can dial, wait or fire once it is over. A stopped link that
@@ -96,32 +160,8 @@ export const dialPeer = <S extends SocketLike>(spec: PeerDialSpec<S>): PeerLink
     const done = new Promise<void>((resolve) => void whenAborted(stopping.signal, () => resolve()));
     let socket: S | undefined;
     let openedAt: number | undefined;
-    // Consecutive attempts that have failed since this link was last open, and when the loop last complained out
-    // loud: between them they are the whole of the quiet rule above.
-    let failures = 0;
-    let quietSince = 0;
-    // When the CURRENT outage began, as opposed to when this link was last complained about.
-    let failingSince: number | undefined;
-
-/* What ONE failed attempt is allowed to say. */
-    const complain = (said: string, delay: number): void => {
-        const every = `retrying every ${Math.round(delay / 1000)}s`;
-        if (failures <= LOUD_ATTEMPTS) {
-            spec.log(`${said}; reconnecting in ${Math.round(delay / 1000)}s`);
-            return;
-        }
-        if (failures === LOUD_ATTEMPTS + 1) {
-            quietSince = Date.now();
-            spec.log(
-                `${said}; still nothing after ${failures} attempts — ${every}, and saying so at most every ${Math.round(QUIET_LOG_MS / 60_000)} minutes from here`,
-            );
-            return;
-        }
-        if (Date.now() - quietSince >= QUIET_LOG_MS) {
-            quietSince = Date.now();
-            spec.log(`${said}; ${failures} failed attempts, ${every}`);
-        }
-    };
+    const outage = failureRun(spec.log);
+    const ladder = ladderWaits(stopping.signal);
 
     const open = async (): Promise<void> => {
         const attempt = await spec.open(stopping.signal);
@@ -155,14 +195,11 @@ export const dialPeer = <S extends SocketLike>(spec: PeerDialSpec<S>): PeerLink
             }
             const rung = spec.backoff.next(openedAt === undefined ? 0 : Date.now() - openedAt);
             openedAt = undefined;
-            failures += 1;
-            failingSince ??= Date.now();
             // The rest is added to the ladder's draw rather than replacing it: a flat fifteen minutes would bring back in
             // lockstep every link that entered the long outage together.
-            const delay = failures >= LONG_OUTAGE_ATTEMPTS ? LONG_OUTAGE_MS + rung : rung;
-            complain(said, delay);
-            // The wait hangs off the stop: a link stopped during it is done at once and never dials again.
-            void sleep(delay, { signal: stopping.signal }).then(() => (stopping.signal.aborted ? undefined : open()));
+            const delay = outage.fail() >= LONG_OUTAGE_ATTEMPTS ? LONG_OUTAGE_MS + rung : rung;
+            outage.complain(said, delay);
+            ladder.wait(delay, open);
         };
 
         const arm = (): void => {
@@ -189,9 +226,7 @@ export const dialPeer = <S extends SocketLike>(spec: PeerDialSpec<S>): PeerLink
             openedAt = Date.now();
             // A link that is up owes nothing to the failures behind it: the next outage is news again, and the
             // "connected to …" line this open is about to log is what reports the recovery.
-            failures = 0;
-            quietSince = 0;
-            failingSince = undefined;
+            outage.clear();
             arm();
             spec.attach(ws);
             const send = (hello: Record<string, unknown>): void => {
@@ -230,7 +265,7 @@ export const dialPeer = <S extends SocketLike>(spec: PeerDialSpec<S>): PeerLink
 
         /* Socket errors record a cause; the close event owns retry scheduling. */
         ws.addEventListener("error", () => {
-            if (failures < LOUD_ATTEMPTS) {
+            if (outage.count() < LOUD_ATTEMPTS) {
                 spec.log("connection error");
             }
         });
@@ -251,6 +286,15 @@ export const dialPeer = <S extends SocketLike>(spec: PeerDialSpec<S>): PeerLink
         // ladder) and a finished one is closed: read off the loop itself, not a flag kept beside it that a redial
         // firing after the stop could set back.
         state: () => (socket?.readyState === OPEN ? "open" : stopping.signal.aborted ? "closed" : "connecting"),
-        outage: () => (failingSince === undefined ? undefined : { failures, since: failingSince }),
+        outage: outage.reading,
+        retryNow: () => {
+            if (stopping.signal.aborted || socket?.readyState === OPEN) {
+                return;
+            }
+            outage.clear();
+            spec.backoff.reset();
+            // Waiting on the ladder: the wait ends now and its dial follows. A dial in flight has no wait to end.
+            ladder.cut();
+        },
     };
 };

package/src/protocol/raw/raw-json-routes.ts

@@ -17,6 +17,15 @@ import { HostsListSchema } from "../../schemas/hosts.js";
 import { VoicesViewSchema } from "../../schemas/voice.js";
 import { MemberEmailSchema, MemberGrantSchema, MemberSelfSchema, MembersListSchema, MembersRosterSchema } from "../../schemas/members.js";
 import { PhonesListSchema, PhoneWakeRegistrationSchema } from "../../schemas/phone.js";
+import {
+    PhoneKeyringsResultSchema,
+    PhonePasswordsCaptureResultSchema,
+    PhonePasswordsCaptureSchema,
+    PhonePasswordsFillResultSchema,
+    PhonePasswordsFillSchema,
+    PhonePasswordsPairResultSchema,
+    PhonePasswordsPairSchema,
+} from "../../schemas/phone-passwords.js";
 import { OkSchema } from "../../schemas/shared.js";
 import { EnrollCodeAnswerSchema, EnrollCodeRequestSchema, PeerPairingAnswerSchema, SyncPairAnswerSchema, SyncPairRequestSchema } from "../../schemas/short-codes.js";
 import { SpeechStatusSchema, SpeechTranscriptSchema, SpeechWakeClaimSchema, SpeechWakeGrantSchema } from "../../schemas/speech.js";
@@ -133,6 +142,10 @@ export const RAW_JSON_ROUTES = {
     "POST /system/phones/pair": { output: PeerPairingAnswerSchema },
     "DELETE /system/phones/{id}": { output: OkSchema },
     "POST /system/phones/{id}/wake": { input: PhoneWakeRegistrationSchema, output: OkSchema },
+    "GET /system/phones/passwords/keyrings": { output: PhoneKeyringsResultSchema },
+    "POST /system/phones/passwords/pair": { input: PhonePasswordsPairSchema, output: PhonePasswordsPairResultSchema },
+    "POST /system/phones/passwords/capture": { input: PhonePasswordsCaptureSchema, output: PhonePasswordsCaptureResultSchema },
+    "POST /system/phones/passwords/fill": { input: PhonePasswordsFillSchema, output: PhonePasswordsFillResultSchema },
     "GET /system/runners": { output: RunnersListSchema },
     "DELETE /system/runners/{id}": { output: OkSchema },
     "POST /system/runners/{id}/definition/sync": { output: RunnerDefinitionAppliedSchema },

package/src/protocol/raw/raw-routes.ts

@@ -13,6 +13,8 @@ export const RAW_ROUTES = {
     // A person opening this sandbox's own address in a browser: sent to the app's /open on it, the address being what
     // they may still hold when the platform has lost the rest. Anything else gets the same 401 as before it existed.
     "GET /": { auth: "door", beforeBoot: true },
+    // The tab icon a browser asks for on that address: the lotus in the sandbox green, the same bytes for everyone.
+    "GET /favicon.ico": { auth: "door", beforeBoot: true },
     "GET /diff/raw": { lane: "bulk" },
     // Arming the dictation model is a read any tier makes; dictating is writing a message, the collaborator's grant.
     "GET /speech/status": { guest: true },
@@ -149,9 +151,11 @@ export const RAW_ROUTES = {
     "POST /children/delegate": { agent: true, control: "never" },
     "GET /children/links": { agent: true, control: "never" },
     "GET /children": { agent: true, control: "never" },
-    // The fleet reads, and the one write: words in front of another conversation, which a person can do by typing.
+    // The fleet reads, and its two writes: words in front of another conversation, which a person can do by typing, and
+    // the Continue a person can press on one a spent allowance or a stop held (`agents resume`).
     "GET /fleet": { agent: true },
     "POST /fleet/message": { agent: true },
+    "POST /fleet/resume": { agent: true },
     "GET /fleet/{handle}": { agent: true },
     // The `devices push` CLI: a program the agent built, carried to one of the owner's computers in chunks; held to the
     // devices the calling conversation's turn mounts, and refused by the machine itself unless "Run programs" is on.
@@ -192,6 +196,7 @@ export const RAW_ROUTES = {
     "DELETE /system/hosts/{id}": { control: "never" },
     // A peer's socket reconnects on its own backoff, so it answers before boot.
     "GET /system/hosts/connect": { auth: "door", beforeBoot: true, control: "never" },
+    "POST /system/hosts/keyring-changed": { auth: "door", control: "never" },
     "POST /system/webext/pair": { control: "never" },
     "POST /system/webext/enroll": { auth: "door", control: "never" },
     "GET /system/webext": { control: "never" },
@@ -204,6 +209,11 @@ export const RAW_ROUTES = {
     "GET /system/phones/connect": { auth: "door", beforeBoot: true, control: "never" },
     // The editor hands over the push-relay channel it registered for a phone, so the sandbox can wake it.
     "POST /system/phones/{id}/wake": { control: "never" },
+    // The phone as Android's autofill service (schemas/phone-passwords.ts): each checks the phone's enrollment token itself.
+    "GET /system/phones/passwords/keyrings": { auth: "door", control: "never" },
+    "POST /system/phones/passwords/pair": { auth: "door", control: "never" },
+    "POST /system/phones/passwords/capture": { auth: "door", control: "never" },
+    "POST /system/phones/passwords/fill": { auth: "door", control: "never" },
     "POST /system/runners/pair": { control: "never" },
     "POST /system/runners/enroll": { auth: "door", control: "never" },
     "GET /system/runners": { control: "never" },
@@ -219,6 +229,7 @@ export const RAW_ROUTES = {
     // A secret the browser types for the agent (`type_secret` aimed at it): one value for one ticket the daemon minted
     // for this browser and one host, handed back on the browser's own request rather than over the tool socket.
     "POST /system/webext/secret": { auth: "door", control: "never" },
+    "POST /system/webext/grants-changed": { auth: "door", control: "never" },
     // This sandbox's keyring keys (schemas/keyring.ts), public halves only: a keyring fetches them here over TLS, from the
     // sandbox's own address, before it shares anything with it, rather than take them from whoever relays the share.
     "GET /keyring/keys": { auth: "door", control: "never" },

package/src/schemas/agent-place.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+
+// Words put in an agent's mouth (`agents.place`): what is asked, and what the record answers.
+
+// Bounded just above the handoff's per-message render cap, so a line too long to carry whole doesn't reach the agent
+// truncated.
+export const AgentPlaceSchema = z.object({
+    id: z.string().min(1).describe("Which conversation."),
+    text: z
+        .string()
+        .trim()
+        .min(1)
+        .max(8_000)
+        .describe(
+            "The words to put in the agent's mouth. Bounded just above what the next turn can carry whole, because a line too long to be handed over intact would reach the agent truncated and quietly break the very thing this is for.",
+        ),
+});
+// The placed line's own id, so the window that placed it holds the same row its next read of the record brings.
+export const AgentPlacedSchema = z.object({
+    ok: z.literal(true).describe("Always true: the line is on the record."),
+    rowId: z.string().optional().describe("The `rowId` the line was recorded under. Absent from a sandbox older than row ids."),
+});

package/src/schemas/agent.ts

@@ -1,12 +1,13 @@
 import { TurnErrandSchema } from "./speaker.js";
 import { z } from "zod";
-import { CONVERSATION_ID } from "../ids/conversation-ids.js";
+import { CONVERSATION_ID, CONVERSATION_TITLE_MAX } from "../ids/conversation-ids.js";
 import { canonicalHarness } from "../models/agent-catalog.js";
 import { ModelRoleSchema } from "../models/model-roles.js";
 import { NATIVE_PROVIDERS } from "../models/provider-specs.js";
 import { AgentPlacementSchema } from "../protocol/doors/runner-protocol.js";
 import { MENTION_LIMIT } from "../text/mentions.js";
 import { entryId } from "./internal.js";
+import { FRESH_OF_DESCRIPTION, FreshOfSchema, freshOfIssues } from "./conversation-links.js";
 // Agent runtimes the daemon can serve: native providers have dedicated adapters, `endpoint/<id>` names an installed
 // endpoint capability, anything else is an ACP agent capability id. A bare string, not an enum, so an unknown id is a
 // clean error, not a contract change.
@@ -66,76 +67,14 @@ export const AgentOriginSchema = z.object({
     author: z.string().optional(),
 });
 export type AgentOrigin = z.infer<typeof AgentOriginSchema>;
-// The class of thing asking to start a session, the admission policy's key space; derived daemon-side, never sent by a
-// client. Chat and loops are absent since both begin with the owner's own click.
-export const WakeSourceSchema = z.enum(["schedule", "event", "listener", "webchat", "issues", "workspace", "workflow"]);
-export type WakeSource = z.infer<typeof WakeSourceSchema>;
-// One admission verdict the owner can configure: let it run, hold it for approval, or refuse it outright.
-export const AdmissionRuleSchema = z.enum(["allow", "hold", "deny"]);
-export type AdmissionRule = z.infer<typeof AdmissionRuleSchema>;
-// Where a command would run; the same string means different things on each machine (rm -rf /usr is recoverable here,
-// fatal on a laptop). Read with a locus (command-classes.ts CommandContext); callers must state one rather than
-// default.
-export const CommandLocusSchema = z.enum([
-    // This sandbox's own shell: a disposable container, /work a git worktree, /history every other agent's.
-    "sandbox",
-    // One of the owner's own computers, reached through the machine agent. Nothing here is disposable.
-    "device",
-]);
-export type CommandLocus = z.infer<typeof CommandLocusSchema>;
-// What kind of thing a shell command is, the command gate's key space under the admission floor; gates one command
-// inside an already-running session. Six classes, chosen because each is hard or impossible to undo somewhere.
-export const CommandClassSchema = z.enum([
-    // Rewrites or discards committed work: force-push, hard reset, force-delete a branch, clean -f, filter-branch.
-    "git.destructive",
-    // Moves a checkout to another branch. Only ever matches in a tree the conversation SHARES with its owner: inside
-    // its own copy a conversation may stand where it likes, and the drift that causes is reported, not refused.
-    "git.branch-switch",
-    // Recursive-force deletion (`rm -rf`), and its spelling in a script (`fs.rm(p, { recursive: true })`).
-    "files.destructive",
-    // State nothing recovers at this locus; which roots count (/, /history in the sandbox) depends on the locus.
-    "system.destructive",
-    // A container volume or its data; the sandbox's blast radius (nested engine) differs sharply from a device's.
-    "container.state",
-    // Reads credential material: a secret reference, or a file confirmed to actually hold one.
-    "secrets.access",
-    // Publishes outward and irreversibly: npm/pnpm/yarn/cargo publish, gh release create, docker push.
-    "package.publish",
-    // A network program (curl, nc, ssh, scp, …) or interpreter one-liner aimed at a non-loopback or run-time-built
-    // destination, the general exfiltration channel under the per-provider actionRules.
-    "network.outbound",
-]);
-export type CommandClass = z.infer<typeof CommandClassSchema>;
-// Workspace-wide admission floor per wake source, consulted on every outside-driven wake; composes with per-automation
-// overrides most-restrictive-wins. `workflow` is allow|deny only, since a hold there is indistinguishable from a CI
-// runner's timeout.
-export const AdmissionPolicySchema = z.object({
-    schedule: AdmissionRuleSchema.default("allow"),
-    event: AdmissionRuleSchema.default("allow"),
-    listener: AdmissionRuleSchema.default("allow"),
-    webchat: AdmissionRuleSchema.default("allow"),
-    // Defaults to hold, unlike the others: a bug-report wake has full repo powers and a stranger's stack trace as its
-    // brief.
-    issues: AdmissionRuleSchema.default("hold"),
-    workspace: AdmissionRuleSchema.default("allow"),
-    workflow: z.enum(["allow", "deny"]).default("allow"),
-});
-export type AdmissionPolicy = z.infer<typeof AdmissionPolicySchema>;
 // How tool calls are gated, the Claude Agent SDK's PermissionMode narrowed to the three the composer offers. Both a
 // turn input and the payload of the `mode` frame, since the agent can move itself between them mid-turn. The SDK's
 // acceptEdits is not one of them: only `default` asks a person here, so it would differ from bypassPermissions in name
 // alone.
 export const PermissionModeSchema = z.enum(["default", "plan", "bypassPermissions"]);
 export type PermissionMode = z.infer<typeof PermissionModeSchema>;
-// Where a conversation was cut from, the durable half of a fork, carried on the registry entry. `index` is the message
-// the cut sat above in the source, so its transcript can put the mark back.
-export const ForkedFromSchema = z.object({
-    conversationId: ConversationIdSchema,
-    index: z.number().int().nonnegative(),
-    // Which files this fork opened on; kept so the fork can still say it later, not only right after the click.
-    files: z.enum(["then", "now"]),
-});
-export type ForkedFrom = z.infer<typeof ForkedFromSchema>;
+// How one conversation relates to another (a fork's cut, a fresh session's origin): conversation-links.ts.
+export * from "./conversation-links.js";
 // The turn's fields before the cross-field refinements below, so a subset (TurnProfileSchema) can be picked from them.
 // How many files one turn may carry. A batch of a person's queued messages joins their files, so the admission splits a
 // batch rather than build a turn past this (turn-admission.ts, together): a turn the daemon makes must parse back.
@@ -158,7 +97,7 @@ const AgentTurnFieldsSchema = z.object({
     // Seeds a fresh registry entry's title; an existing entry's title always wins over this.
     title: z
         .string()
-        .max(80)
+        .max(CONVERSATION_TITLE_MAX)
         .optional()
         .describe("A title for a conversation this turn is opening. Ignored for a conversation that already has one."),
     // Already uploaded via /workspace/upload; Claude reads them via Read, Codex gets images as native input.
@@ -262,6 +201,8 @@ const AgentTurnFieldsSchema = z.object({
         })
         .optional()
         .describe("Where this conversation was cut from, on its first turn only. Only the client knows this, so only the client can say it."),
+    // A fresh session's origin, on its first turn only; requires an isolated conversationId the registry has never seen.
+    freshOf: FreshOfSchema.optional().describe(FRESH_OF_DESCRIPTION),
     // The browser sends the chosen model per turn; the provider token is the sandbox's own stored credential.
     model: z.string().optional().describe("Which model to use. Leave it out for the provider's default."),
     // Audience only, never model routing: `runRole` is what fills a model in. A run somebody pressed and is
@@ -327,6 +268,15 @@ const AgentTurnFieldsSchema = z.object({
         .describe(
             "Hold this message until then (epoch milliseconds) instead of starting a turn now: a time you chose, or the reopen of an allowance you know is spent. It waits in the conversation's queue, where it can be sent early, reworded, rescheduled or removed, and goes by itself at that instant, even for a conversation this message opens or one whose turn is running now. Ignored when already past; at most a month ahead.",
         ),
+    // Why `sendAt` is the instant it is, when it is not a time somebody chose: the composer booked the message for the
+    // spent allowance's reopen. Kept with the booking (`reopenOf` on the queue), so every window can tell an allowance
+    // wait from an appointment without matching instants against whatever the usage feed says now.
+    sendAtReopen: z
+        .literal(true)
+        .optional()
+        .describe(
+            "Says `sendAt` is the reopen of the allowance this message would be refused by, not a time you chose. Recorded with the booking (the queue's `reopenOf` names the account it waits for), so every window can say the message waits on an allowance, and see when the conversation has moved somewhere with room. Only with `sendAt`.",
+        ),
     // The other scheduled send: work that builds on another agent's, held until that agent's work is in the workspace.
     // Held in the queue like `sendAt`; the queue's `after` is this. Never both: a hold waits on exactly one thing.
     sendAfter: ConversationIdSchema.optional().describe(
@@ -362,6 +312,7 @@ export const AgentTurnSchema = AgentTurnFieldsSchema
     .refine((turn) => turn.forkOf?.files !== "then" || turn.isolated === true, {
         message: 'forkOf.files "then" requires isolated',
     })
+    .superRefine(freshOfIssues)
     .refine((turn) => turn.sendAt === undefined || turn.sendAfter === undefined, {
         message: "sendAt and sendAfter are two different holds: name one",
     })
@@ -514,6 +465,25 @@ export type MessageReceipt = z.infer<typeof MessageReceiptSchema>;
 // a job that ended, a land that broke something), or another agent (a child reporting back).
 export const MessageVoiceSchema = z.enum(["person", "sandbox", "agent"]);
 export type MessageVoice = z.infer<typeof MessageVoiceSchema>;
+// The account a message booked for an allowance's reopen waits on: what it waits out, which the booking's instant alone
+// cannot say once the chat has moved somewhere with room.
+export const QueuedReopenSchema = z.object({
+    agent: AgentProviderSchema.describe("The provider whose allowance it waits out."),
+    account: z
+        .string()
+        .optional()
+        .describe("Which of its accounts. Absent when none was named, and every account of the provider read spent."),
+});
+export type QueuedReopen = z.infer<typeof QueuedReopenSchema>;
+// Who a person's waiting message goes on, as its request names it now.
+export const QueuedServingSchema = z.object({
+    agent: AgentProviderSchema.describe("The provider."),
+    harness: AgentHarnessSchema.describe("The agentic loop."),
+    model: z.string().optional().describe("The model. Absent when it named none, and takes the conversation's own."),
+    effort: z.string().optional().describe("How hard it thinks, where the model offers a choice."),
+    account: z.string().optional().describe("The account that pays for it. Absent when it named none, and goes on the conversation's own."),
+});
+export type QueuedServing = z.infer<typeof QueuedServingSchema>;
 // One message waiting for the conversation's next turn, as every window shows it.
 export const QueuedMessageSchema = z.object({
     id: z.string().describe("The message's id: what its sender named it, or what the sandbox did."),
@@ -533,6 +503,12 @@ export const QueuedMessageSchema = z.object({
     after: ConversationIdSchema.optional().describe(
         "The conversation whose finished work must land before this message goes out by itself, in place of `until`.",
     ),
+    reopenOf: QueuedReopenSchema.optional().describe(
+        "The allowance this message's `until` waits out: it was booked for that account's reopen, by the composer or by the sandbox holding words it would not send into a spent allowance, rather than for a time somebody chose. Absent on any other booking, and from sandboxes older than the field.",
+    ),
+    serves: QueuedServingSchema.optional().describe(
+        "Who serves the turn this message starts: the provider, loop, model, effort and account it was sent under, or was moved to since (`agent.queueReroute`, an account switch). Only on a person's words; the sandbox's and an agent's own go on wherever the conversation runs when they go. Absent from sandboxes older than the field.",
+    ),
     continues: z
         .literal(true)
         .optional()
@@ -586,15 +562,3 @@ export const QueueResumedSchema = z.object({
         ),
 });
 export type QueueResumed = z.infer<typeof QueueResumedSchema>;
-// Attaches to a conversation's newest run (live, or finished within retention); no cursor to resume from, the head
-// carries all rows. `run` names what the client was watching, so a newer run's head id tells it to catch up.
-export const AttachTurnSchema = z.object({
-    conversationId: ConversationIdSchema.describe("Which conversation to watch."),
-    run: z
-        .string()
-        .optional()
-        .describe(
-            "The run you were watching. The stream opens on the conversation's newest run whatever you name: if a newer turn has started since, the head names that one instead, and its rows are that turn's.",
-        ),
-});
-export type AttachTurn = z.infer<typeof AttachTurnSchema>;