@intentic/sandbox-contract 1.345.0 → 1.346.0

package/src/events/agent-events.ts

@@ -8,6 +8,7 @@ import { FastModeStateSchema } from "../schemas/providers/fast-mode.js";
 import { NeedSchema } from "../schemas/needs.js";
 import { PromptCacheOpeningSchema, PromptFingerprintSchema } from "../schemas/keep-warm.js";
 import { AgentReplySchema, UsageWindowSchema } from "../schemas/providers/plan-limits.js";
+import { PrivacyBypassSchema } from "../schemas/privacy-egress.js";
 import { SubagentKindSchema, SubagentSdkRecordSchema, SubagentStatusSchema, SubagentVerificationSchema } from "../schemas/terminal.js";
 import { RetryLadderSchema } from "../schemas/turn-break.js";
 import { HandedOffSchema, HandoffOfferSchema } from "../schemas/providers/handoff.js";
@@ -19,6 +20,87 @@ import { agentNoticeEvent, agentStatusEvent } from "./agent-ui.js";
 // Every frame an agent turn streams, as one `kind`-discriminated union: turn facts (session, standing, cost) and the
 // attach stream a window joins through. One closed vocabulary, kept in one file.
 
+// What a failure is, by name: the one vocabulary every runtime's failure is read into at its boundary (a runtime's typed
+// error, or the shared reading of its words), and the one a reader draws a failure's line from. A failure none of these
+// names goes out with no code: the unclassified kind, said as such, never a guess.
+export const AgentErrorCodeSchema = z.enum([
+    "session-not-found",
+    "rate_limit",
+    // Codex ran the turn but warned about it (fallback model metadata); a notice, not a failure.
+    "codex-advisory",
+    "codex-reauth",
+    // An ACP capability requires its own loginCommand, not a native provider account reconnect.
+    "acp-auth-required",
+    // The Claude subscription credential is dead; only a reconnect fixes it, unlike no account connected.
+    "claude-reauth",
+    // The API refused this turn's token mid-flight, usually superseded by a rotation already re-minting.
+    "claude-token-refused",
+    // The account authenticates and has real usage pools, but the org disabled Claude Code for this seat.
+    "claude-not-entitled",
+    // Any other provider's account signs in but is refused service outright, for every model (Cursor's
+    // `[role_forbidden]` for a non-billable admin): filed against the account, so placement skips it.
+    "account-not-entitled",
+    // The provider failed transiently and in-turn retries did not outlast it; the daemon retries on
+    // backoff.
+    "provider-outage",
+    // The platform-owned free-trial pool failed after its bounded key walk; the failed call is refunded.
+    "trial-unavailable",
+    // The trial answered, but the selected upstream model/request cannot run through this sandbox.
+    "trial-model-unavailable",
+    // This account's platform-owned daily trial allowance is spent until its UTC reset.
+    "trial-exhausted",
+    // The harness read the message as a slash command it doesn't have; the model never saw it.
+    "unknown-command",
+    "grok-model-invalid",
+    "codex-model-invalid",
+    // The model is real and listed, but this plan's subscription does not have access to it.
+    "model-unavailable",
+    // The model cannot hold a turn this size, refused before sending; retrying the same request never
+    // helps.
+    "context-window-too-small",
+    // The model can only write one-shot jobs (Model.helperOnly: its server says it cannot call tools, or
+    // it is the quick-jobs local model), refused before sending; the words wait for another model.
+    "model-helper-only",
+    // The privacy shield is on, the provider is untrusted, and the runtime is one it cannot read by content at
+    // all (an ACP agent, Pi), refused before sending; the words wait for a covered provider.
+    "privacy-unshielded",
+    // The turn carries a tool list (an automation's `allowedTools`) and its runtime cannot keep one
+    // (AgentCapabilities.toolAllowlist), refused before sending; the words wait for a runtime that can.
+    "tools-unenforced",
+    // The protected execution-domain policy is unsupported or unreadable; refused before any model/helper ran.
+    "agent-domain-refused",
+    // The privacy shield found personal data in instructions the runtime loads itself, past every channel it
+    // could mask (Cursor's project rules, AGENTS.md), refused before sending; the words wait for the owner to
+    // let the provider read this conversation, trust it, or take the data out of those files.
+    "privacy-instructions",
+    // The session outgrew the model's context window mid-turn; resuming that session only overflows again,
+    // so the daemon re-runs the turn once in a fresh session carrying the hand-off.
+    "context-overflow",
+    "subscription-required",
+    "agent-busy",
+    // The sandbox is short of memory, held before anything spawned: a person once per spell, after which
+    // their sends run; background work on every short reading. Transient, no clock.
+    "sandbox-memory-low",
+    // The conversation's own view of the workspace (its mount namespace) did not come up in time, twice,
+    // before anything ran: the sandbox too loaded to set it up. Held like a memory hold, and sent again by
+    // itself once the sandbox has had room for a while (the memory wall's answer).
+    "workspace-setup",
+    // The history volume cannot fit a new conversation checkout while keeping its free-space floor.
+    "sandbox-disk-low",
+    // The runtime hit its own iteration ceiling and stopped; the work may be half done, so the user
+    // decides.
+    "turn-cap",
+    // The harness ended the turn without succeeding, with no modelled reason; the vendor's subtype rides
+    // verbatim.
+    "harness-incomplete",
+    // The installed engine is too old for the model; the provider names the version required, on `engine`.
+    "engine-version-floor",
+    // The provider's safety classifier stopped the turn partway, often a false positive on ordinary work.
+    // Held for a person: retry on the same model without the stopped response, or go on with another.
+    "safeguard-flagged",
+]);
+export type AgentErrorCode = z.infer<typeof AgentErrorCodeSchema>;
+
 // One frame per emission, `kind`-discriminated; the daemon maps SDK message types onto this closed set, dropping any
 // without a UI mapping. `plan`/`question`/`permission` pause until `resolved` names the same requestId.
 export const AgentEventSchema = z.discriminatedUnion("kind", [
@@ -271,84 +353,13 @@ export const AgentEventSchema = z.discriminatedUnion("kind", [
     z.object({
         kind: z.literal("error"),
         message: z.string(),
-        code: z
-            .enum([
-                "session-not-found",
-                "rate_limit",
-                // Codex ran the turn but warned about it (fallback model metadata); a notice, not a failure.
-                "codex-advisory",
-                "codex-reauth",
-                // An ACP capability requires its own loginCommand, not a native provider account reconnect.
-                "acp-auth-required",
-                // The Claude subscription credential is dead; only a reconnect fixes it, unlike no account connected.
-                "claude-reauth",
-                // The API refused this turn's token mid-flight, usually superseded by a rotation already re-minting.
-                "claude-token-refused",
-                // The account authenticates and has real usage pools, but the org disabled Claude Code for this seat.
-                "claude-not-entitled",
-                // Any other provider's account signs in but is refused service outright, for every model (Cursor's
-                // `[role_forbidden]` for a non-billable admin): filed against the account, so placement skips it.
-                "account-not-entitled",
-                // The provider failed transiently and in-turn retries did not outlast it; the daemon retries on
-                // backoff.
-                "provider-outage",
-                // The platform-owned free-trial pool failed after its bounded key walk; the failed call is refunded.
-                "trial-unavailable",
-                // The trial answered, but the selected upstream model/request cannot run through this sandbox.
-                "trial-model-unavailable",
-                // This account's platform-owned daily trial allowance is spent until its UTC reset.
-                "trial-exhausted",
-                // The harness read the message as a slash command it doesn't have; the model never saw it.
-                "unknown-command",
-                "grok-model-invalid",
-                "codex-model-invalid",
-                // The model is real and listed, but this plan's subscription does not have access to it.
-                "model-unavailable",
-                // The model cannot hold a turn this size, refused before sending; retrying the same request never
-                // helps.
-                "context-window-too-small",
-                // The model can only write one-shot jobs (Model.helperOnly: its server says it cannot call tools, or
-                // it is the quick-jobs local model), refused before sending; the words wait for another model.
-                "model-helper-only",
-                // The privacy shield is on, the provider is untrusted, and the runtime is one it cannot read by content at
-                // all (an ACP agent, Pi), refused before sending; the words wait for a covered provider.
-                "privacy-unshielded",
-                // The turn carries a tool list (an automation's `allowedTools`) and its runtime cannot keep one
-                // (AgentCapabilities.toolAllowlist), refused before sending; the words wait for a runtime that can.
-                "tools-unenforced",
-                // The protected execution-domain policy is unsupported or unreadable; refused before any model/helper ran.
-                "agent-domain-refused",
-                // The privacy shield found personal data in instructions the runtime loads itself, past every channel it
-                // could mask (Cursor's project rules, AGENTS.md), refused before sending; the words wait for the owner to
-                // let the provider read this conversation, trust it, or take the data out of those files.
-                "privacy-instructions",
-                // The session outgrew the model's context window mid-turn; resuming that session only overflows again,
-                // so the daemon re-runs the turn once in a fresh session carrying the hand-off.
-                "context-overflow",
-                "subscription-required",
-                "agent-busy",
-                // The sandbox is short of memory, held before anything spawned: a person once per spell, after which
-                // their sends run; background work on every short reading. Transient, no clock.
-                "sandbox-memory-low",
-                // The conversation's own view of the workspace (its mount namespace) did not come up in time, twice,
-                // before anything ran: the sandbox too loaded to set it up. Held like a memory hold, and sent again by
-                // itself once the sandbox has had room for a while (the memory wall's answer).
-                "workspace-setup",
-                // The history volume cannot fit a new conversation checkout while keeping its free-space floor.
-                "sandbox-disk-low",
-                // The runtime hit its own iteration ceiling and stopped; the work may be half done, so the user
-                // decides.
-                "turn-cap",
-                // The harness ended the turn without succeeding, with no modelled reason; the vendor's subtype rides
-                // verbatim.
-                "harness-incomplete",
-                // The installed engine is too old for the model; the provider names the version required, on `engine`.
-                "engine-version-floor",
-                // The provider's safety classifier stopped the turn partway, often a false positive on ordinary work.
-                // Held for a person: retry on the same model without the stopped response, or go on with another.
-                "safeguard-flagged",
-            ])
-            .optional(),
+        // Who worded `message`. Absent, it is the provider's or the harness's own words, which a reader keeps behind a
+        // press and leads with a line of its own for the code: nothing the sandbox forgot to mark is ever a raw headline.
+        own: z
+            .boolean()
+            .optional()
+            .describe("The message is the sandbox's own sentence, fit to be the notice's line. Absent, it is what the provider or the harness said."),
+        code: AgentErrorCodeSchema.optional(),
         // safeguard-flagged only: what the classifier named, and where a retry resumes the session from.
         refusal: z
             .object({
@@ -359,6 +370,12 @@ export const AgentEventSchema = z.discriminatedUnion("kind", [
                     .describe("The last session entry before the stopped response: a retry resumes the session there, so the model never sees what was stopped."),
             })
             .optional(),
+        // A privacy refusal only: the route the shield's verdict refused (shieldVerdict's `refuse.route`), typed, so a
+        // reader acts on where the bytes would have gone rather than on the sentence. Absent for a policy that could
+        // not be read, which refuses whatever the route.
+        privacyRoute: PrivacyBypassSchema.optional().describe(
+            "Where the bytes would have gone past the privacy shield: a runtime it cannot read, a runner calling its provider from its own machine, the container's own key, or a shared server started before the shield was on.",
+        ),
         // Which engine, the version refused, and the floor the provider requires; lets the client offer an install.
         engine: z
             .object({

package/src/events/failure-rows.ts

@@ -0,0 +1,148 @@
+import type { AgentEvent } from "./agent-events.js";
+import { type FailureSaid, type NoticeCode, noticeCode } from "./sandbox-notice.js";
+import type { TranscriptRow } from "./transcript.js";
+import { anotherModelClears, turnedAwayCode } from "../policy/turned-away.js";
+
+/* EVERY ROW A FAILURE LEAVES, in one place: the fold's one way from an `error` frame to a notice. Each row is coded,
+   whatever the frame carried, so no reader ever has to guess from a row's words whether it is a failure, or what kind:
+   a failure nobody named is `failed` with no `error`, the unclassified kind, never bare text (2026-10-20: a week of
+   transcripts held 105 failure rows written as bare provider words, a spent allowance's among them, against 34 coded). */
+
+type ErrorFrame = Extract<AgentEvent, { kind: "error" }>;
+type FailureRow = TranscriptRow & { readonly noticeCode: NoticeCode };
+
+// A failure's own sentence, its code and who worded it, which every failure row carries ahead of the clause it adds.
+const failureOf = (event: ErrorFrame): FailureSaid => ({ message: event.message, error: event.code, own: event.own === true ? true : undefined });
+
+const failedRow = (event: ErrorFrame): FailureRow => ({
+    role: "notice",
+    text: event.message,
+    noticeCode: noticeCode({ code: "failed", params: failureOf(event) }),
+});
+
+// The row a refusal that ran nothing leaves when the conversation's queue holds the words (heldRow). A turn somebody typed
+// is held in its conversation's queue for another press; a turn that started itself (an automation, a loop, a watch wake)
+// has no typed message and nobody watching, so promising a resend there names a composer the reader is not looking at.
+// Neither version promises a retry: whether one comes is the scheduler's decision, not this row's to state.
+const undeliveredRow = (said: FailureSaid, unattended: boolean): FailureRow => ({
+    role: "notice",
+    text: unattended
+        ? `${said.message} Nothing ran, and nothing is held: this run started on its own, so there is no message waiting to be sent again.`
+        : `${said.message} Your message was not delivered: it is held for you to send again.`,
+    noticeCode: noticeCode({ code: "undelivered", params: { ...said, unattended: unattended || undefined } }),
+});
+
+// The row the same refusal leaves once the turn had already run: a trial spent, or a model refused, on a later step. The
+// message was read and acted on, so it is neither undelivered nor held (turn-runs keeps only a turn turned away at the
+// door), and saying so invited a resend of something that had already changed files (onboarding review 2026-10-18,
+// F07). What it did stays in the conversation's copy; the press, when another model gets past the refusal, carries on there.
+const stoppedPartwayRow = (said: FailureSaid, switchModel: boolean): FailureRow => {
+    const row: FailureRow = {
+        role: "notice",
+        text: switchModel
+            ? `${said.message} The run stopped partway. The changes it made so far are kept: continue with another model to pick up from here.`
+            : `${said.message} The run stopped partway. The changes it made so far are kept: send a message to pick up from here.`,
+        noticeCode: noticeCode({ code: "stoppedPartway", params: { ...said, switchModel: switchModel || undefined } }),
+    };
+    if (switchModel) {
+        row.noticeAction = "switchModel";
+    }
+    return row;
+};
+
+// The press a memory hold offers: the raise rides along only when the hold carried a ceiling to size it by, since a
+// stall names none and raising one would not clear it.
+const memoryPress = (event: ErrorFrame): "sendAnyway" | "sandboxMemory" => (event.memory === undefined ? "sendAnyway" : "sandboxMemory");
+
+// A memory hold is asked once and never again that spell (resource-budget.ts), so the next send always runs. A turn the
+// sandbox started itself (a fix press, a peer's message, a re-run) was never in a composer: its message stays above, and
+// the press asks the sandbox to run the turn it kept rather than sending a queue that holds nothing.
+const heldRow = (event: ErrorFrame): FailureRow => {
+    const unattended = event.unattended === true;
+    const memory = event.code === "sandbox-memory-low";
+    const said = failureOf(event);
+    if (event.held !== undefined && !unattended) {
+        return {
+            role: "notice",
+            text: memory
+                ? `${event.message} Nothing has run yet: the message above is kept here, and sending it anyway starts it.`
+                : `${event.message} Nothing has run yet: the message above is kept here to send again once that is sorted.`,
+            noticeAction: memory ? memoryPress(event) : "sendAgain",
+            sandboxHeld: true,
+            noticeCode: noticeCode({ code: "kept", params: { ...said, memory: memory || undefined } }),
+        };
+    }
+    if (!memory || unattended) {
+        return undeliveredRow(said, unattended);
+    }
+    return {
+        role: "notice",
+        text: `${event.message} Your message is held: send it again to start anyway.`,
+        noticeAction: memoryPress(event),
+        noticeCode: noticeCode({ code: "memoryHeld", params: said }),
+    };
+};
+
+// What an armed credential renewal promises, and what its row says instead once a later failure in the same run took
+// that promise back (TranscriptFold.withdrawRenewal).
+export const RENEWING = "The credential is being renewed and this turn continues automatically.";
+export const RENEWAL_WITHDRAWN =
+    "The credential was being renewed, but the turn stopped before it could continue: it will not carry on by itself, so press Continue to pick it back up.";
+
+// What a laddered wall's automatic re-runs are doing, said on the failure's own row so the count stays in the record.
+const retryClause = (event: ErrorFrame): { text: string; code: NoticeCode } | undefined => {
+    const { retries } = event;
+    if (retries === undefined) {
+        return undefined;
+    }
+    const said = failureOf(event);
+    if (event.autoResume === "scheduled") {
+        return {
+            text: `Retrying by itself: attempt ${retries.made + 1} of ${retries.max}.`,
+            code: noticeCode({ code: "retrying", params: { ...said, attempt: retries.made + 1, of: retries.max } }),
+        };
+    }
+    return retries.made >= retries.max
+        ? {
+              text: `Retried ${retries.made} of ${retries.max} times by itself; nothing more is sent automatically.`,
+              code: noticeCode({ code: "retried", params: { ...said, made: retries.made, of: retries.max } }),
+          }
+        : undefined;
+};
+
+/** The row a turn-ending failure leaves: its own sentence plus one clause on what happens next, coded whatever it was.
+ *  The live wait itself is drawn by the chat, not stored here. `ran`: an assistant row stands, so a door refusal stopped
+ *  the turn partway. */
+export const errorRow = (event: ErrorFrame, ran: boolean): FailureRow => {
+    const { message, code } = event;
+    const said = failureOf(event);
+    if (code === "provider-outage") {
+        const retry = retryClause(event);
+        return retry === undefined
+            ? {
+                  role: "notice",
+                  text: `${message} Nothing is retrying it, so the turn is waiting here.`,
+                  noticeCode: noticeCode({ code: "outageWaiting", params: said }),
+              }
+            : { role: "notice", text: `${message} ${retry.text}`, noticeCode: retry.code };
+    }
+    if (code === "claude-token-refused") {
+        return event.autoResume === "scheduled"
+            ? {
+                  role: "notice",
+                  text: `${message} ${RENEWING}`,
+                  noticeWait: "credentialRenewal",
+                  noticeCode: noticeCode({ code: "renewing", params: said }),
+              }
+            : {
+                  role: "notice",
+                  text: `${message} Reconnect the account to pick this conversation back up.`,
+                  noticeCode: noticeCode({ code: "reconnect", params: said }),
+              };
+    }
+    if (!turnedAwayCode(code)) {
+        const retry = retryClause(event);
+        return retry === undefined ? failedRow(event) : { role: "notice", text: `${message} ${retry.text}`, noticeCode: retry.code };
+    }
+    return ran && event.held === undefined ? stoppedPartwayRow(said, anotherModelClears(code)) : heldRow(event);
+};

package/src/events/sandbox-notice.ts

@@ -16,13 +16,22 @@ export const NoticeCodeSchema = z.object({
 });
 export type NoticeCode = z.infer<typeof NoticeCodeSchema>;
 
+/** A failure's facts as every failure notice carries them (the `failure` params below), before the clause it adds. */
+export interface FailureSaid {
+    readonly message: string;
+    readonly error?: string | undefined;
+    readonly own?: boolean | undefined;
+}
+
 const count = z.number().int().nonnegative();
 
-// A failure's own sentence, which the notice's clause follows: the provider's words, or the sandbox's under `error`, its
-// failure code, for a reader that words a failure it knows itself.
+// A failure's own sentence, which the notice's clause follows, its failure code (`error`; absent for a failure nobody
+// named), and whether the sandbox worded the sentence (`own`). Absent `own`, the sentence is the provider's or the
+// harness's: a reader leads with its own line for the code and keeps those words behind a press.
 const failure = {
     message: z.string(),
     error: z.string().optional(),
+    own: z.boolean().optional(),
 };
 
 // The re-runs a resumed turn's row can name (events/resume.ts); a reason a reader does not know draws the row's text.

package/src/events/system-events.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { AgentSummarySchema } from "../schemas/agents.js";
-import { AccountUsageSchema, ProviderRefusalSchema } from "../schemas/providers/plan-limits.js";
+import { AccountUsageSchema, type ProviderRefusal, ProviderRefusalSchema } from "../schemas/providers/plan-limits.js";
 import { MemberRoleSchema } from "../schemas/shared.js";
 import { WorkspaceTreeDeltaSchema } from "../schemas/workspace/workspace-tree.js";
 
@@ -147,11 +147,21 @@ export const AccountUsageChangedSchema = z.object({
 });
 export type AccountUsageChanged = z.infer<typeof AccountUsageChangedSchema>;
 
-// A provider's last refusal was recorded or settled, the observed half of "can I run on this". `refusal` absent means
-// settled, nothing stands.
-export const ProviderRefusalChangedSchema = z.object({ kind: z.literal("providerRefusal"), provider: z.string(), refusal: ProviderRefusalSchema.optional() });
+// A provider's refusals on file changed (one recorded, settled or forgotten), the observed half of "can I run on this":
+// every one it still holds, so a window judges by exactly what the daemon does. Empty means nothing stands. A daemon at
+// the floor sends only its last `refusal` (absent: settled), so `refusals` stays optional; read both with refusalsOf.
+export const ProviderRefusalChangedSchema = z.object({
+    kind: z.literal("providerRefusal"),
+    provider: z.string(),
+    refusals: z.array(ProviderRefusalSchema).optional(),
+    refusal: ProviderRefusalSchema.optional(),
+});
 export type ProviderRefusalChanged = z.infer<typeof ProviderRefusalChangedSchema>;
 
+// Every refusal a frame says stands, from a daemon that sends the whole list or one at the floor that sends its last.
+export const refusalsOf = (event: ProviderRefusalChanged): readonly ProviderRefusal[] =>
+    event.refusals ?? (event.refusal === undefined ? [] : [event.refusal]);
+
 // What moved in the shared tree, once the daemon's resident copy re-listed a batch: a tab holding the generation it
 // counts from patches its tree, and one holding any other fetches it afresh.
 export const TreeChangedSchema = WorkspaceTreeDeltaSchema.extend({ kind: z.literal("treeChanged") });

package/src/ids/project-dir.test.ts

@@ -59,8 +59,8 @@ test("a project dir is exactly one valid name under the workspace root", () => {
     expect(projectDirNameOf("/srv/work/my-app", "/srv/work")).toBe("my-app");
 });
 
-// A second folder of the same name takes a name that says which one it is: its parent's in front (machine_sandbox.rs
-// `unique_name` takes the first one free). Where a folder is (a drive, a network share) never lends a name.
+// A second folder of the same name takes a name that says which one it is: its parent's in front. Where a folder is (a
+// drive, a network share) never lends a name.
 const NAMED: readonly { readonly path: string; readonly names: string[] }[] = [
     { path: "C:\\Users\\ada\\code\\app", names: ["app-project", "code-app", "ada-code-app"] },
     { path: "C:\\Users\\ada\\work\\My App", names: ["My-App", "work-My-App", "ada-work-My-App"] },

package/src/ids/project-dir.ts

@@ -56,10 +56,10 @@ export const projectDirNameFor = (folderBasename: string): string => {
     return RESERVED_PROJECT_DIR_NAMES.includes(name) ? `${name}-project` : name;
 };
 
-// The names a folder may take in this computer's sandbox, best first: its own name, then its parent's name in front of
-// it, then its grandparent's too (`app`, `code-app`, `radar-code-app`), each one `isProjectDirName` accepts and none
-// twice. The desktop app takes the first one free (machine_sandbox.rs `unique_name`) and numbers only past all of them,
-// so a second folder called `app` reads as `code-app`, which says which one it is, rather than `app-2` (2026-10-12). A
+// The names a folder may take in a sandbox's /work, best first: its own name, then its parent's name in front of it,
+// then its grandparent's too (`app`, `code-app`, `radar-code-app`), each one `isProjectDirName` accepts and none
+// twice. Written (2026-10-12) for the desktop app's one sandbox per computer, where a second folder called `app` read as
+// `code-app` rather than `app-2`; since 2026-10-21 each folder has a sandbox of its own and takes its own name. A
 // drive (`C:`) and a network share's server and share (`\\server\share`, `\\wsl.localhost\<distro>`) are where a folder
 // is, not what it is called, so they never lend a name.
 export const projectDirCandidates = (hostPath: string): string[] => {

package/src/models/agent-lanes.ts

@@ -1,17 +1,8 @@
 import type { AgentAttention } from "../schemas/agents.js";
 import type { AutomationApproval } from "../schemas/automations.js";
+import { goesBySelf } from "../schemas/agent-next.js";
 import { parentOf } from "./agent-starter.js";
-import {
-    type AgentStanding,
-    blocked,
-    heardByParent,
-    limitScheduled,
-    onlyOwnerCanAnswer,
-    scheduledSend,
-    turnInFlight,
-    turnWorking,
-    watching,
-} from "./agent-standing.js";
+import { type AgentStanding, blocked, heardByParent, onlyOwnerCanAnswer, turnInFlight, turnWorking, watching } from "./agent-standing.js";
 
 // The lane every surface files a conversation in, and what of a fleet calls the person. Moved here from the editor
 // (_editor/web/src/models/agent-status/agentStatus-lanes.ts, which re-exports it) on 2026-10-16, so the daemon's
@@ -50,7 +41,7 @@ export const NO_ATTENTION: AgentAttention = {
 // "finished" needs no explicit timer since auto-land already flips a cleanly-completed turn to landed/idle within
 // ms, and any follow-up message moves the card back to active. Unread stays a badge, not a lane.
 export const laneOf = (agent: AgentStanding): FleetLane => {
-    // A spent allowance nothing is booked for reaches Attention through `blocked` alone, no branch of its own, and ahead
+    // A spent allowance nothing carries on reaches Attention through `blocked` alone, no branch of its own, and ahead
     // of the `watching` branch below: a watch is the agent's own plan for waiting, a spent allowance an obstacle in
     // the way of it, and a watch firing into a shut window runs nothing (turn-admission.ts holds its words back).
     if (blocked(agent) || agent.status === "awaiting" || agent.status === "conflict") {
@@ -74,15 +65,10 @@ export const laneOf = (agent: AgentStanding): FleetLane => {
     if (watching(agent)) {
         return "active";
     }
-    // A stranded turn booked to go again is Active: at the reset, or on the resume pass's next beat for a move to another
-    // account. Reached only because `blocked` let it through; stated explicitly or the card would fall through to
-    // Finished, which would announce as over work that resumes by itself.
-    if (limitScheduled(agent)) {
-        return "active";
-    }
-    // Messages booked for later are the same: the conversation starts again by itself, at a time or once the agent it
-    // waits for has landed, so filing it Finished would announce as done work that has not started yet.
-    if (scheduledSend(agent)) {
+    // Whatever carries it on by itself (`next`: a held turn re-run or moved, a send once memory frees, messages booked
+    // for a time or another agent's land) is Active: filing it Finished would announce as over work that resumes or has
+    // not started yet. An ending it answers reached here because `blocked` let it through on the same reading.
+    if (goesBySelf(agent)) {
         return "active";
     }
     // `landed`/`idle`/`ready` all finish here: `ready` is work held on the branch because auto-land is off, still

package/src/models/agent-runtimes.ts

@@ -252,7 +252,7 @@ export const ACP: AgentCapabilities = {
     isolation: "cwd",
     commands: true,
     terminals: true,
-    // A failure the agent words as a spent allowance or an outgrown window is coded (acp-agent.ts ACP_FAILURES), but the
+    // A failure the agent words as a spent allowance or an outgrown window is coded (error-frames.ts codedFailure), but the
     // words are each agent's own and the protocol marks no outage, so nothing promises the codes auto-resume keys off.
     recovery: false,
     warm: false,
@@ -332,7 +332,7 @@ export const PI: AgentCapabilities = {
     // session, as the Claude loop's Bash hook does (pi-hooks.ts).
     terminals: true,
     // Pi reports a provider failure as its own event (auto_retry_end, an errored message_end) carrying the provider's
-    // sentence, status code included, which the shared rules code (pi-events.ts PI_FAILURES).
+    // sentence, status code included, which the shared rules code (error-frames.ts codedFailure).
     recovery: true,
     warm: false,
     // `--system-prompt` replaces Pi's base and `--append-system-prompt` adds to it, both per process; `--no-context-files`