@intentic/sandbox-contract 1.345.0 → 1.346.0

package/src/models/agent-standing.ts

@@ -7,7 +7,7 @@ import {
     type LandConflictReason,
     type LandFailure,
 } from "../schemas/agents.js";
-import type { QueuePause } from "../schemas/agent.js";
+import { type AgentNext, goesBySelf } from "../schemas/agent-next.js";
 
 // (2026-10-16) Moved here from the editor (_editor/web/src/models/agent-status/agentStatus-standing.ts, which re-exports
 // it), so the daemon counts what needs the person by the very rules the board draws with (models/agent-lanes.ts): the
@@ -47,78 +47,33 @@ export interface AgentStanding {
     readonly failureCode?: string | undefined;
     // The words that turn died on (AgentSummary.failure), cleared with the code when it runs again.
     readonly failure?: string | undefined;
+    // Whether those words are the sandbox's own sentence (AgentSummary.failureOwn): what a card may lead with.
+    readonly failureOwn?: boolean | undefined;
     /** When the spent allowance reopens, in epoch SECONDS (the wire's unit). Absent when nobody published one. */
     readonly limitResetsAt?: number | undefined;
     /** Whether the refused turn is held whole, so a press re-runs it rather than sending a new message after it. */
     readonly limitHeld?: boolean | undefined;
-    /** Whether a fire is already booked for it (at the reset, or a move now), so no press is needed. */
-    readonly limitScheduled?: boolean | undefined;
-    /** The account the owner's policy is moving the held turn to, while that move is booked (a scheduled card's sentence). */
-    readonly limitMoving?: string | undefined;
-    /** When the booked re-run goes, in epoch SECONDS, while one is booked (limitScheduled): the pass's own instant. */
-    readonly limitNextAt?: number | undefined;
+    // What carries it on with nobody pressing anything, and when (AgentSummary.next): the daemon's one reading, which
+    // every lane, chip and corner below asks, never the hold, the queue or an answer it was derived from.
+    readonly next?: AgentNext | undefined;
     // A land that broke (AgentSummary.landFailure), standing until one goes through whatever turns run after it. Absent
     // from a sandbox older than it, where only a turn's own `failure` can say so.
     readonly landFailure?: LandFailure | undefined;
-    // What waits for its next turn (AgentSummary.queue), read here only for its hold: messages booked to go by
-    // themselves at a time or once another agent's work lands (`scheduled`), which make the conversation one that runs
-    // again by itself. Never the words.
-    readonly queue?: QueueHold | undefined;
     // The conversation whose work this one was opened on, for a fresh session (AgentSummary.fresh): a person's own
     // review, test or ask, which hangs under that conversation's card and is never reported to it
     // (subagents/child-report.ts), so nothing it stops on is that conversation's news. Absent for every other one.
     readonly fresh?: { readonly of: string } | undefined;
 }
 
-// The part of a conversation's queue the board reads: why it holds, and what a scheduled hold waits for. A queue-level
-// `scheduled` with its `until` or `after` is the soonest booked message's; a Stop's or a refusal's hold on the messages
-// with no booking takes that place, so each message's own booking (`items`, from sandboxes that book each message on its
-// own) is read then.
-export interface QueueHold {
-    readonly paused?: QueuePause | undefined;
-    readonly until?: number | undefined;
-    readonly after?: string | undefined;
-    readonly items?: readonly { readonly until?: number | undefined; readonly after?: string | undefined }[] | undefined;
-}
-
-// The soonest booking a queue holds, as a scheduled hold: the queue's own while it reads `scheduled`, else the earliest
-// message's time, else the first message waiting on a land; undefined when nothing is booked. One thing, never both.
-export const soonestHold = (queue: QueueHold | undefined): QueueHold | undefined => {
-    if (queue?.paused === "scheduled") {
-        if (queue.after !== undefined) {
-            return { paused: "scheduled", after: queue.after };
-        }
-        return queue.until === undefined ? { paused: "scheduled" } : { paused: "scheduled", until: queue.until };
-    }
-    const items = queue?.items ?? [];
-    const instants = items.flatMap((item) => (item.until === undefined ? [] : [item.until]));
-    if (instants.length > 0) {
-        return { paused: "scheduled", until: Math.min(...instants) };
-    }
-    const after = items.find((item) => item.after !== undefined)?.after;
-    return after === undefined ? undefined : { paused: "scheduled", after };
-};
-
-// Messages booked to go by themselves (sendLater.ts, or a spent allowance's reopen): the conversation runs again with
-// nobody pressing anything, so it is not finished, and nothing is owed by the reader for it to.
-export const scheduledSend = (agent: Pick<AgentStanding, "queue">): boolean => soonestHold(agent.queue) !== undefined;
-
-// How many messages are booked to go by themselves: each by its own booking, or all of them when an older sandbox booked
-// the queue whole. What an archive by hand cancels (the sandbox's archive.ts), which the card's Archive says first.
-export const scheduledCount = (agent: Pick<AgentStanding, "queue">): number => {
-    const items = agent.queue?.items ?? [];
-    return agent.queue?.paused === "scheduled" ? items.length : items.filter((item) => item.until !== undefined || item.after !== undefined).length;
-};
-
 // A spent allowance, not a failure to fix: nothing broken, and it comes back. Read off `failureCode` rather than
 // the provider's own sentence, which varies per provider; the code is the daemon's own classification
 // (error-frames.ts).
 export const limited = (agent: AgentStanding): boolean => agent.status === "error" && agent.failureCode === "rate_limit";
 
-// A message held at the door because the sandbox is short of memory (turn-admission): nothing ran and nothing failed,
-// it waits for a person's "send anyway". The daemon files it as an `error`, so this is read off the code, as `limited`
-// is, and the chip and glyph say held rather than error; the lane stays Attention, since the press is the reader's,
-// until its words are booked for later (bookingAnswers).
+// A message held at the door because the sandbox is short of memory (turn-admission): nothing ran and nothing failed.
+// The daemon files it as an `error`, so this is read off the code, as `limited` is, and the chip and glyph say held
+// rather than error. Its lane is any ending's: Attention until something carries it on (`next`, a send once memory
+// frees or a booking for later), Active from then.
 export const memoryHeld = (agent: Pick<AgentStanding, "status" | "failureCode">): boolean =>
     agent.status === "error" && agent.failureCode === "sandbox-memory-low";
 
@@ -127,16 +82,6 @@ export const memoryHeld = (agent: Pick<AgentStanding, "status" | "failureCode">)
 export const limitClosed = (agent: AgentStanding, now: number = Date.now()): boolean =>
     limited(agent) && agent.limitResetsAt !== undefined && agent.limitResetsAt * 1_000 > now;
 
-// A booked fire needs no press: the held turn goes again at the reset by itself. Only where this conversation's answer
-// for the limit says so (`resend` or `move`); that answer starts at `wait`. Nothing is owed then, so it leaves Attention
-// for Active, as an armed watch does: a card counted in the badge and the tab title for the hours until a reset the
-// reader already answered was a call nobody could answer. The stall still shows, on the card's own chip and clock.
-export const limitScheduled = (agent: AgentStanding): boolean => limited(agent) && agent.limitScheduled === true;
-
-// A booked move: the owner's policy is already carrying the held turn to another account, on the resume pass's next
-// beat, seconds away, so the card names where it is going rather than when it goes.
-export const limitMoveBooked = (agent: AgentStanding): boolean => limitScheduled(agent) && agent.limitMoving !== undefined;
-
 // A refused land nothing the agent does can clear: every blocker left is a file the user has uncommitted edits on,
 // which only a commit or stash releases (git cannot merge through unstaged work, and the agent's checkout cannot
 // even see it). The distinction the board used to lack: it offered "have the agent resolve it" for every conflict,
@@ -224,44 +169,35 @@ export const writingNow = (agent: AgentStanding): boolean => agent.status === "r
 // "Blocked on you": the agent cannot proceed (or has failed) until the user acts. Not the same as unread.
 // `stopped`/`interrupted` leave a half-written worktree only a new message can carry forward; `stopping` is
 // counted the moment the press lands rather than once the unwind finishes, since it settles in the same lane
-// either way; `failed` is the same kind of dead end one step earlier, before a worktree existed. A spent allowance
-// counts until something is booked to carry it on (limitScheduled): a resend at the reset, or a move now. Any settled
-// dead end counts until a booking answers it (bookingAnswers).
+// either way; `failed` is the same kind of dead end one step earlier, before a worktree existed.
 const BLOCKING_ENDINGS: ReadonlySet<AgentStatus | ClientAgentStatus> = new Set(["error", "interrupted", "stopping", "stopped", "failed"]);
 
 // A land that broke and still stands: its work is stuck on the branch, whatever the turn after it did, so the card is
 // the reader's to look at. Not while a turn or a land is under way, which ends in another land of its own.
 export const landBroken = (agent: AgentStanding): boolean => agent.landFailure !== undefined && !turnInFlight(agent);
 
-// The settled dead ends a booking can answer. Not `stopping`, which is still unwinding and rests in Attention whatever
-// waits behind it.
-const ANSWERABLE_ENDINGS: ReadonlySet<AgentStatus | ClientAgentStatus> = new Set(["error", "interrupted", "stopped", "failed"]);
-
 /**
- * A turn that ended badly, with something booked to go by itself after it: a message for a time, a continuation at a
- * spent allowance's reopen, words held for memory re-timed to that reopen. That booking is the person's answer to the
- * ending, or the sandbox's on their standing word, so the next move is the sandbox's, at the booking, and the ending no
- * longer calls the reader: the card is Active, and its corner says when it goes. Before 2026-10-18 only the sandbox's own
- * booked resend after a spent allowance (limitScheduled) answered an ending, so an expired account's card stayed in
- * Attention under a clock already saying "sends Sun 05:00", the reader's answer to it booked and not counted. Answers
- * only the ending: an ask (a plan, a question, a permission, a land only the reader can clear) still calls them.
+ * A turn that ended badly, with nothing set to carry it on: a dead end the reader owes a press. Once something will
+ * (`next`: a held turn re-run at its reopen or moved, a send once memory frees, a message booked for later), that is the
+ * answer to the ending, the person's or the sandbox's on their standing word, so the card is Active and its corner says
+ * when it goes. Before 2026-10-20 the lane asked two of those, the card's corner three, the chat's bar one more, and
+ * they disagreed. Not `stopping`, still unwinding, which rests in Attention whatever waits behind it. Answers only the
+ * ending: an ask (a plan, a question, a permission, a land only the reader can clear) still calls the reader.
  */
-export const bookingAnswers = (agent: AgentStanding): boolean => ANSWERABLE_ENDINGS.has(agent.status) && scheduledSend(agent);
+const deadEnd = (agent: AgentStanding): boolean => agent.status === "stopping" || (BLOCKING_ENDINGS.has(agent.status) && !goesBySelf(agent));
 
 export const blocked = (agent: AgentStanding): boolean =>
-    limitScheduled(agent)
-        ? false
-        : agent.attention.plan ||
-          agent.attention.question ||
-          agent.attention.permission ||
-          agent.attention.capability ||
-          agent.attention.conflict ||
-          // A need outlives its turn (docs/architecture/needs.md): a conversation still running carries on beside it
-          // and stays in Active, one that stopped is waiting on nothing but the answer.
-          (agent.attention.need === true && agent.status !== "running") ||
-          landBroken(agent) ||
-          heldByPrompt(agent) ||
-          (BLOCKING_ENDINGS.has(agent.status) && !bookingAnswers(agent));
+    agent.attention.plan ||
+    agent.attention.question ||
+    agent.attention.permission ||
+    agent.attention.capability ||
+    agent.attention.conflict ||
+    // A need outlives its turn (docs/architecture/needs.md): a conversation still running carries on beside it and
+    // stays in Active, one that stopped is waiting on nothing but the answer.
+    (agent.attention.need === true && agent.status !== "running") ||
+    landBroken(agent) ||
+    heldByPrompt(agent) ||
+    deadEnd(agent);
 
 // The half of `blocked` that is literally waiting on an answer (plan, question, permission, capability), narrower
 // than `blocked`: dead ends (a failed turn, an unlandable conflict) want looking at but owe the user nothing, so
@@ -296,9 +232,8 @@ export const heardByParent = (child: AgentStanding & { readonly updatedAt: numbe
     BLOCKING_ENDINGS.has(child.status) &&
     // Still unwinding: its ending has not reached anyone yet.
     child.status !== "stopping" &&
-    // Booked to run again by itself: not over, whatever its parent made of the pause.
-    !limitScheduled(child) &&
-    !bookingAnswers(child) &&
+    // Carried on by itself: not over, whatever its parent made of the pause.
+    !goesBySelf(child) &&
     !child.attention.question &&
     !child.attention.conflict &&
     !landBroken(child) &&

package/src/models/model-pins.test.ts

@@ -1,4 +1,5 @@
-import { type ModelSource, modelPinKey, parsePinned, readyChain } from "./model-pins.js";
+import { type ModelSource, modelPinKey, openingRung, parsePinned, readyChain, rungModel } from "./model-pins.js";
+import type { FleetCapacity } from "./plan-pools.js";
 import type { ModelPin } from "../schemas/agent.js";
 
 // Which models a job spends, and in what order: the owner's own list decides, nothing is derived for an empty one, and
@@ -84,3 +85,32 @@ test("honours a pin on a configured endpoint: the whole id, not the half before
     // parsePinned splits on the first colon; an id with its own colon needs the slash form or parsing breaks.
     expect(modelPinKey({ provider: `endpoint/ollama`, model: `qwen3-coder` })).toBe(`endpoint/ollama:qwen3-coder`);
 });
+
+// The rung a chain opens on, read by the daemon's run roles and the editor's job button alike.
+describe("openingRung", () => {
+    const chain = [`codex:gpt-6.1-sol`, `claude:claude-opus-5`, `kimi:kimi-k3`].map(pin);
+    const spent: FleetCapacity = { kind: `spent`, accounts: 1, reopensAt: 5_000, pool: undefined };
+    const serving: FleetCapacity = { kind: `serving`, serving: 1, accounts: 1 };
+    const capacities = (spentOn: readonly string[]) => (rung: ModelPin): FleetCapacity | undefined => (spentOn.includes(rung.provider) ? spent : serving);
+
+    test("opens on the first rung no account is spent on, stepping over a spent head", () => {
+        expect(openingRung(chain, capacities([]))).toBe(chain[0]);
+        expect(openingRung(chain, capacities([`codex`]))).toBe(chain[1]);
+        expect(openingRung(chain, capacities([`codex`, `claude`]))).toBe(chain[2]);
+    });
+
+    test("an unread capacity steps nothing over, and the caller's own reason does", () => {
+        expect(openingRung(chain, () => undefined)).toBe(chain[0]);
+        expect(openingRung(chain, capacities([]), (rung) => rung.provider === `codex`)).toBe(chain[1]);
+    });
+
+    test("opens on the head when every rung is stepped over, and on nothing for an empty chain", () => {
+        expect(openingRung(chain, capacities([`codex`, `claude`, `kimi`]))).toBe(chain[0]);
+        expect(openingRung([], capacities([]))).toBeUndefined();
+    });
+
+    test("an agent with no model id asks about its provider's accounts as a whole", () => {
+        expect(rungModel({ provider: `cursor`, model: `` })).toBeUndefined();
+        expect(rungModel({ provider: `codex`, model: `gpt-6.1-sol` })).toEqual({ id: `gpt-6.1-sol` });
+    });
+});

package/src/models/model-pins.ts

@@ -1,4 +1,5 @@
 import type { AgentProvider, ModelPin } from "../schemas/agent.js";
+import type { FleetCapacity, ModelRef } from "./plan-pools.js";
 
 // The order to try models in for a job's setup (model-setups.ts), shared by daemon and browser so both agree what a job
 // will spend before it runs. An empty list resolves to nothing: the caller decides what that means (a helper is off; a
@@ -50,3 +51,19 @@ export const readyChain = (sources: readonly ModelSource[], pinned: readonly Mod
     }
     return chain;
 };
+
+// The model a rung asks capacity about (plan-pools.ts fleetCapacity): an ACP agent's empty id asks about the provider's
+// accounts as a whole.
+export const rungModel = (choice: ModelChoice): ModelRef | undefined => (choice.model === `` ? undefined : { id: choice.model });
+
+// The rung a ready chain opens on: the first whose capacity no connected account is spent on and that `steppedOver`
+// (what else the caller knows, the daemon's failing streaks) lets through, else the head, since every reading that
+// stepped one over is a snapshot that may already be stale. The daemon's run roles open on it (run-role-model.ts) and
+// the editor names it on the job's button (roleModel.ts), each over the same capacity verdict, so the button never
+// names a rung the run would step over. 2026-10-20: the editor took the head by readiness alone, and named a spent
+// account's model while the run opened on the next.
+export const openingRung = <T extends ModelChoice>(
+    chain: readonly T[],
+    capacityOf: (rung: T) => FleetCapacity | undefined,
+    steppedOver: (rung: T) => boolean = () => false,
+): T | undefined => chain.find((rung) => capacityOf(rung)?.kind !== `spent` && !steppedOver(rung)) ?? chain[0];

package/src/models/plan-pools.test.ts

@@ -4,11 +4,12 @@ import {
     currentWindows,
     gatesModel,
     gatingWindows,
-    pinRefused,
+    judgedReading,
+    fleetCapacity,
     readingHeadroom,
     preferredAccount,
     refusalVerdict,
-    refusedHeadroom,
+    refusedPoolReset,
     roomiestAccount,
     scopedWindow,
     uncoveredModels,
@@ -166,7 +167,7 @@ test("spent is the contract's one line: 99.5% still has room, 100% is spent unti
     expect(readingHeadroom(usage(window({ kind: "five_hour", utilization: 100 })))).toEqual({ kind: "spent" });
     expect(readingHeadroom(undefined)).toEqual({ kind: "unknown" });
     expect(readingHeadroom(CLAUDE, { id: "claude-haiku-4-5" })).toEqual({ kind: "ready", room: 70 });
-    expect(readingHeadroom(CLAUDE, { id: "claude-opus-4-6" })).toEqual({ kind: "spent" });
+    expect(readingHeadroom(CLAUDE, { id: "claude-opus-4-6" })).toEqual({ kind: "spent", pool: "Opus" });
 });
 
 // Anthropic reports whole percents: an account read at 100 kept serving turns for hours, so that reading is the line,
@@ -182,7 +183,7 @@ test("a pool read at 100 in whole percents is at the line with no room, until a
     const facts = { account: "a", usage: { ...atLine, measuredAt: 2_000 } };
     const refused = refusal({ kind: "limit", account: "a" });
     expect(refusalVerdict(refused, [facts])).toBe("standing");
-    expect(serviceStates([facts], refused).get("a")).toEqual({ kind: "spent", reopensAt: 900 });
+    expect(serviceStates([facts], [refused]).get("a")).toEqual({ kind: "spent", reopensAt: 900 });
 });
 
 test("with no model named, an account is spent only when no model can run on it", () => {
@@ -233,15 +234,15 @@ test("a revoked sign-in outranks a lost seat, which outranks a bench, whatever t
 
 test("a standing refusal blocks by its kind, and a limit refusal pins only the pool its model spends", () => {
     const facts = { account: "a", usage: CLAUDE };
-    expect(serviceState(facts, refusal({ kind: "auth" }))).toEqual({ kind: "blocked", fix: "reconnect", reason: "no." });
-    expect(serviceState(facts, refusal({ kind: "entitlement" }))).toEqual({ kind: "blocked", fix: "admin", reason: "no." });
+    expect(serviceState(facts, [refusal({ kind: "auth" })])).toEqual({ kind: "blocked", fix: "reconnect", reason: "no." });
+    expect(serviceState(facts, [refusal({ kind: "entitlement" })])).toEqual({ kind: "blocked", fix: "admin", reason: "no." });
     // Refused on Haiku: the 5-hour/weekly binding pool (seven_day, 30%) reads full, so Haiku is spent too.
-    expect(serviceState(facts, refusal({ kind: "limit", model: "claude-haiku-4-5" }), { id: "claude-haiku-4-5" })).toEqual({ kind: "spent" });
+    expect(serviceState(facts, [refusal({ kind: "limit", model: "claude-haiku-4-5" })], { id: "claude-haiku-4-5" })).toEqual({ kind: "spent" });
     // Refused on Opus: its own slice was already full; Haiku keeps the room its pools show.
-    expect(serviceState(facts, refusal({ kind: "limit", model: "claude-opus-4-6" }), { id: "claude-haiku-4-5" })).toEqual({ kind: "ready", room: 70 });
+    expect(serviceState(facts, [refusal({ kind: "limit", model: "claude-opus-4-6" })], { id: "claude-haiku-4-5" })).toEqual({ kind: "ready", room: 70 });
     // No reading at all: the refusal is the evidence, unless it was about another model.
-    expect(serviceState({ account: "a" }, refusal({ kind: "limit" }))).toEqual({ kind: "spent" });
-    expect(serviceState({ account: "a" }, refusal({ kind: "limit", model: "opus" }), { id: "haiku" })).toEqual({ kind: "unknown" });
+    expect(serviceState({ account: "a" }, [refusal({ kind: "limit" })])).toEqual({ kind: "spent" });
+    expect(serviceState({ account: "a" }, [refusal({ kind: "limit", model: "opus" })], { id: "haiku" })).toEqual({ kind: "unknown" });
 });
 
 test("a refusal stands until a later reading contradicts it, and never past its account's disconnection", () => {
@@ -286,7 +287,7 @@ test("a nameless refusal over several accounts is answered by any of them readin
     ];
     const codex = refusal({ kind: "limit", at: filed, model: "gpt-6.1-sol", resetsAt: Date.parse("2026-10-20T13:53:00Z") / 1000, unmetered: true });
     expect(refusalVerdict(codex, accounts, now)).toBe("answered");
-    expect(Object.fromEntries(serviceStates(accounts, codex, undefined, now))).toEqual({
+    expect(Object.fromEntries(serviceStates(accounts, [codex], undefined, now))).toEqual({
         "free-1": { kind: "ready", room: 100 },
         "free-2": { kind: "ready", room: 100 },
         team: { kind: "ready", room: 100 },
@@ -311,14 +312,92 @@ test("a spent allowance with the provider's own reset stands until that instant,
     // Over several, the translator benches the one it refused and routes on, so another's room still answers it.
     expect(refusalVerdict(refusal(until), [{ account: "a", usage: room }, { account: "b", usage: room }], 9_999)).toBe("answered");
     // Spent until the instant the provider named, not the pool's own reset.
-    expect(serviceStates([{ account: "a", usage: room }], refusal({ ...until, account: "a" }), undefined, 9_999).get("a")).toEqual({ kind: "spent", reopensAt: 10 });
+    expect(serviceStates([{ account: "a", usage: room }], [refusal({ ...until, account: "a" })], undefined, 9_999).get("a")).toEqual({ kind: "spent", reopensAt: 10 });
+});
+
+// 2026-10-20: a spent allowance the provider gave no instant for stood past the reset of the pool it was refused in, the
+// "back at" every surface showed, until the next reading landed (up to the daemon's 15-minute idle sweep).
+test("a spent allowance with no instant named is stamped with its pool's reset, and ends there everywhere at once", () => {
+    const reset = 10;
+    const filling = at(500, window({ kind: "five_hour", utilization: 96, resetsAt: reset }), window({ kind: "seven_day", utilization: 40, resetsAt: 900 }));
+    const accounts = [{ account: "a", usage: filling }];
+    const spent = refusal({ kind: "limit", account: "a", model: "gpt-6.1-sol" });
+    expect(refusedPoolReset(spent, accounts)).toBe(reset);
+    const filed = { ...spent, poolResetsAt: reset };
+    expect(refusalVerdict(filed, accounts, reset * 1000 - 1)).toBe("standing");
+    expect(serviceStates(accounts, [filed], undefined, reset * 1000 - 1).get("a")).toEqual({ kind: "spent", reopensAt: reset });
+    expect(refusalVerdict(filed, accounts, reset * 1000)).toBe("answered");
+    // Even once the reading has lapsed that pool, so the weekly one binds: the stamp, not the reading, says when.
+    const lapsed = at(500, window({ kind: "five_hour", utilization: 0, lapsedAt: reset }), window({ kind: "seven_day", utilization: 40, resetsAt: 900 }));
+    expect(refusedPoolReset(spent, [{ account: "a", usage: lapsed }])).toBe(900);
+    expect(refusalVerdict(filed, [{ account: "a", usage: lapsed }], reset * 1000)).toBe("answered");
+    expect(serviceStates([{ account: "a", usage: lapsed }], [filed], undefined, reset * 1000).get("a")).toEqual({ kind: "ready", room: 60 });
+});
+
+// 2026-10-21: Claude refused at 5h 98% and weekly 97% (rounded) with no time named, so the refusal was stamped with the
+// five-hour reset, the fullest pool then. Once that window reopened the weekly pool read 100, and the passed stamp ended
+// the refusal anyway: a rounded 100 is no proof of empty, so the account read ready with no room and every turn let
+// through was refused again. A stamp ends the refusal where nothing read since says otherwise, never over a reading.
+test("a stamped reset ends a refusal only where no reading since it says the pool is still at the line", () => {
+    const fiveHourReset = 1_800_000_000;
+    const weeklyReset = 1_800_259_200;
+    const refusedIn = at(
+        1_799_989_000_000,
+        window({ kind: "five_hour", utilization: 98, rounded: true, resetsAt: fiveHourReset }),
+        window({ kind: "seven_day", utilization: 97, rounded: true, resetsAt: weeklyReset }),
+    );
+    const spent = refusal({ kind: "limit", account: "a", at: 1_799_990_000_000 });
+    expect(refusedPoolReset(spent, [{ account: "a", usage: refusedIn }])).toBe(fiveHourReset);
+    const stamped = { ...spent, poolResetsAt: fiveHourReset };
+    const now = (fiveHourReset + 700) * 1000;
+    const weeklyFull = at(
+        (fiveHourReset + 600) * 1000,
+        window({ kind: "five_hour", utilization: 4, rounded: true, resetsAt: fiveHourReset + 18_000 }),
+        window({ kind: "seven_day", utilization: 100, rounded: true, resetsAt: weeklyReset }),
+    );
+    const unstampedVerdict = serviceStates([{ account: "a", usage: weeklyFull }], [spent], undefined, now).get("a");
+    expect(unstampedVerdict).toEqual({ kind: "spent", reopensAt: weeklyReset });
+    expect(serviceStates([{ account: "a", usage: weeklyFull }], [stamped], undefined, now).get("a")).toEqual(unstampedVerdict);
+    expect(fleetCapacity([{ account: "a", usage: weeklyFull }], [stamped], undefined, now)).toMatchObject({ kind: "spent", reopensAt: weeklyReset });
+    // Nothing read since the stamp: it ends there. Read with room since: over.
+    expect(serviceStates([{ account: "a", usage: refusedIn }], [stamped], undefined, now).get("a")).toEqual({ kind: "ready", room: 2 });
+    const roomSince = at((fiveHourReset + 600) * 1000, window({ kind: "five_hour", utilization: 4, resetsAt: fiveHourReset + 18_000 }), window({ kind: "seven_day", utilization: 60, resetsAt: weeklyReset }));
+    expect(refusalVerdict(stamped, [{ account: "a", usage: roomSince }], now)).toBe("answered");
+});
+
+test("the stamp is the refused account's pool, or the soonest of any where the refusal named none", () => {
+    const soon = at(500, window({ kind: "five_hour", utilization: 96, resetsAt: 10 }));
+    const later = at(500, window({ kind: "five_hour", utilization: 96, resetsAt: 50 }));
+    const accounts = [{ account: "b", usage: later }, { account: "a", usage: soon }];
+    expect(refusedPoolReset(refusal({ kind: "limit" }), accounts)).toBe(10);
+    expect(refusedPoolReset(refusal({ kind: "limit", account: "b" }), accounts)).toBe(50);
+    // The pool the model spends, not the account's fullest.
+    const opus = at(500, window({ kind: "five_hour", utilization: 20, resetsAt: 10 }), window({ kind: "model:Opus", label: "Opus", utilization: 99, resetsAt: 70, gates: { models: ["Opus"] } }));
+    expect(refusedPoolReset(refusal({ kind: "limit", model: "claude-opus-4-6" }), [{ account: "a", usage: opus }])).toBe(70);
+    expect(refusedPoolReset(refusal({ kind: "limit", model: "claude-haiku-4-5" }), [{ account: "a", usage: opus }])).toBe(10);
+});
+
+test("nothing is stamped where a pool's reset cannot speak for the refusal", () => {
+    const reopening = at(500, window({ kind: "five_hour", utilization: 96, resetsAt: 10 }));
+    // A reading older than the window it was refused in: that reset was over before the refusal came.
+    expect(refusedPoolReset(refusal({ kind: "limit", at: 20_000 }), [{ account: "a", usage: reopening }])).toBeUndefined();
+    expect(refusedPoolReset(refusal({ kind: "limit" }), [{ account: "a", usage: at(500, window({ kind: "monthly", utilization: 96 })) }])).toBeUndefined();
+    expect(refusedPoolReset(refusal({ kind: "limit" }), [{ account: "a" }])).toBeUndefined();
+    expect(refusedPoolReset(refusal({ kind: "limit", account: "gone" }), [{ account: "a", usage: reopening }])).toBeUndefined();
+    // The provider's own instant, an allowance no reading measures, a person's mark, and any refusal but a spent allowance.
+    expect(refusedPoolReset(refusal({ kind: "limit", resetsAt: 5 }), [{ account: "a", usage: reopening }])).toBeUndefined();
+    expect(refusedPoolReset(refusal({ kind: "limit", unmetered: true }), [{ account: "a", usage: reopening }])).toBeUndefined();
+    expect(refusedPoolReset(refusal({ kind: "limit", byHand: true }), [{ account: "a", usage: reopening }])).toBeUndefined();
+    expect(refusedPoolReset(refusal({ kind: "entitlement" }), [{ account: "a", usage: reopening }])).toBeUndefined();
+    // And a refusal filed unstamped keeps standing until a reading answers it, as before.
+    expect(refusalVerdict(refusal({ kind: "limit", account: "a" }), [{ account: "a", usage: reopening }], 9e12)).toBe("standing");
 });
 
 test("a provider's accounts are judged together: a standing refusal lands only on the account it names", () => {
     const room = at(500, window({ kind: "five_hour", utilization: 40 }));
-    const states = serviceStates([{ account: "a", usage: room }, { account: "b", usage: room }], refusal({ kind: "entitlement", account: "a" }));
+    const states = serviceStates([{ account: "a", usage: room }, { account: "b", usage: room }], [refusal({ kind: "entitlement", account: "a" })]);
     expect(Object.fromEntries(states)).toEqual({ a: { kind: "blocked", fix: "admin", reason: "no." }, b: { kind: "ready", room: 60 } });
-    const answered = serviceStates([{ account: "a", usage: at(2_000, window({ kind: "five_hour", utilization: 40 })) }], refusal({ kind: "limit", account: "a" }));
+    const answered = serviceStates([{ account: "a", usage: at(2_000, window({ kind: "five_hour", utilization: 40 })) }], [refusal({ kind: "limit", account: "a" })]);
     expect(answered.get("a")).toEqual({ kind: "ready", room: 60 });
 });
 
@@ -339,7 +418,7 @@ test("each account answers to the newest refusal on file that still stands over
         b: { kind: "blocked", fix: "reconnect", reason: "no." },
     });
     // Only the provider's last one: the first account is back at the line, no room but not proven spent.
-    expect(serviceStates(accounts, elsewhere, undefined, 9_999).get("a")).toEqual({ kind: "ready", room: 0 });
+    expect(serviceStates(accounts, [elsewhere], undefined, 9_999).get("a")).toEqual({ kind: "ready", room: 0 });
     // Past the instant the provider named, its refusal is over and the reading speaks alone.
     expect(serviceStates(accounts, [elsewhere, own], undefined, 20_000).get("a")).toEqual({ kind: "ready", room: 0 });
     // A newer refusal on the same account outranks the older one.
@@ -421,19 +500,75 @@ test("a pool the provider stopped reporting is dropped once its window closes, n
 test("a standing refusal pins the pool its model spends, reopening when the provider said, for every surface alike", () => {
     const reading = at(2_000, window({ kind: "five_hour", utilization: 0, resetsAt: 20_000 }), window({ kind: "seven_day", utilization: 0, resetsAt: 600_000 }));
     const said = refusal({ kind: "limit", model: "gpt-6.1-sol", resetsAt: 9_000 });
-    expect(pinRefused(reading, said)?.windows.map((entry) => [entry.kind, entry.utilization, entry.resetsAt])).toEqual([
+    expect(judgedReading(reading, [said])?.windows.map((entry) => [entry.kind, entry.utilization, entry.resetsAt])).toEqual([
         ["five_hour", 100, 9_000],
         ["seven_day", 0, 600_000],
     ]);
-    expect(refusedHeadroom(reading, said)).toEqual({ kind: "spent", reopensAt: 9_000 });
+    expect(serviceState({ account: "a", usage: reading }, [said], undefined, 0)).toEqual({ kind: "spent", reopensAt: 9_000 });
     // Where it named no instant, the pinned pool keeps its own reset, and that is when it reopens.
-    expect(refusedHeadroom(reading, { ...said, resetsAt: undefined })).toEqual({ kind: "spent", reopensAt: 20_000 });
-    // No pool to pin: the refusal itself is the evidence for its own model, and none for another's.
-    expect(pinRefused(undefined, said)).toBeUndefined();
-    expect(refusedHeadroom(undefined, said)).toEqual({ kind: "spent", reopensAt: 9_000 });
-    expect(refusedHeadroom(undefined, said, { id: "gpt-6-luna" })).toEqual({ kind: "unknown" });
-    // The daemon's verdict is this rule.
-    expect(serviceState({ account: "a", usage: reading }, said, undefined, 0)).toEqual(refusedHeadroom(reading, said));
+    expect(serviceState({ account: "a", usage: reading }, [{ ...said, resetsAt: undefined }], undefined, 0)).toEqual({ kind: "spent", reopensAt: 20_000 });
+    // No reading at all (a plan that publishes none): the refusal is a pool of its own, for its own model and no other's.
+    expect(judgedReading(undefined, [said])?.windows).toEqual([
+        { kind: "refused:gpt-6.1-sol", label: "GPT 6.1 Sol", utilization: 100, gates: { models: ["gpt-6.1-sol"] }, resetsAt: 9_000 },
+    ]);
+    expect(serviceState({ account: "a" }, [said], undefined, 0)).toEqual({ kind: "spent", reopensAt: 9_000, pool: "GPT 6.1 Sol" });
+    expect(serviceState({ account: "a" }, [said], { id: "gpt-6-luna" }, 0)).toEqual({ kind: "unknown" });
+});
+
+// 2026-10-09/10-20: a routed model's bench (model-cooldowns.json) and the provider's last refusal were two copies of one
+// refusal, and the picker greyed by one while the rail judged by the other. One ledger: every refusal standing over an
+// account is laid on its reading, so two models refused on two pools both read spent.
+test("every refusal standing over an account is laid on it, not only the provider's last", () => {
+    const reading = at(
+        500,
+        window({ kind: "five_hour", utilization: 10, resetsAt: 7_000 }),
+        window({ kind: "model:Opus", label: "Opus", utilization: 40, resetsAt: 8_000, gates: { models: ["opus"] } }),
+    );
+    const opus = refusal({ kind: "limit", account: "a", model: "claude-opus-5-5", at: 1_000 });
+    const sonnet = refusal({ kind: "limit", account: "a", model: "claude-sonnet-5", at: 2_000, resetsAt: 7_000 });
+    const states = (model: string) => serviceStates([{ account: "a", usage: reading }], [opus, sonnet], { id: model }, 5_000).get("a");
+    expect(states("claude-opus-5-5")).toEqual({ kind: "spent", reopensAt: 8_000, pool: "Opus" });
+    expect(states("claude-sonnet-5")).toEqual({ kind: "spent", reopensAt: 7_000 });
+    // A spent allowance refused after a refused sign-in says the sign-in worked: the newest word on the account decides.
+    const revoked = refusal({ kind: "auth", account: "a", at: 1_500 });
+    expect(serviceStates([{ account: "a", usage: reading }], [revoked, sonnet], { id: "claude-sonnet-5" }, 5_000).get("a")).toEqual({ kind: "spent", reopensAt: 7_000 });
+});
+
+// 2026-10-17: a Kimi credential benched for thirty minutes, its five-hour window two hours from reopening, was re-run at
+// thirty minutes and refused again. A bench is a floor under the account's reopening, never the reopening itself.
+test("a translator bench lifts only once the pools it holds have reopened too", () => {
+    const full = at(500, window({ kind: "five_hour", utilization: 100, resetsAt: 9_000 }));
+    expect(serviceState({ account: "a", usage: full, cooling: { until: 2_000, reason: "429" } }, [], undefined, 1_000_000)).toEqual({
+        kind: "blocked",
+        fix: "wait",
+        reason: "429",
+        until: 9_000,
+    });
+});
+
+// The answer every gate, listing and picker reads (2026-10-13: Sol subagents spawned onto a Codex whose every account
+// was refused, while the picker greyed the row; 2026-10-19: Auto read the readings alone).
+test("a provider's capacity for a model is spent only when no account can serve it, and says when one is back", () => {
+    const room = at(5_000, window({ kind: "five_hour", utilization: 30, resetsAt: 9_000 }));
+    const accounts = [
+        { account: "a", usage: room },
+        { account: "b", usage: room },
+    ];
+    const a = refusal({ kind: "limit", account: "a", model: "sol", resetsAt: 8_000, at: 4_000 });
+    const b = refusal({ kind: "limit", account: "b", model: "sol", resetsAt: 7_000, at: 4_000 });
+    expect(fleetCapacity(accounts, [a, b], { id: "sol" }, 6_000_000)).toEqual({ kind: "spent", accounts: 2, reopensAt: 7_000, pool: undefined });
+    expect(fleetCapacity(accounts, [a], { id: "sol" }, 6_000_000)).toEqual({ kind: "serving", serving: 1, accounts: 2, roomMeasuredAt: 5_000 });
+    // An account nothing has measured may still answer: it keeps the model servable.
+    expect(fleetCapacity([...accounts, { account: "c" }], [a, b], { id: "sol" }, 6_000_000)).toEqual({ kind: "serving", serving: 1, accounts: 3, roomMeasuredAt: undefined });
+    // No account at all says nothing either way.
+    expect(fleetCapacity([], [a], { id: "sol" })).toEqual({ kind: "unknown" });
+    // A plan that publishes no reading (Cursor's) is spent for a model every account refused, and only that model.
+    const cursor = [{ account: "x" }, { account: "y" }];
+    const refused = [refusal({ kind: "limit", account: "x", model: "composer-2.5" }), refusal({ kind: "limit", account: "y", model: "composer-2.5" })];
+    expect(fleetCapacity(cursor, refused, { id: "composer-2.5" }, 2_000).kind).toBe("spent");
+    expect(fleetCapacity(cursor, refused, { id: "gpt-6" }, 2_000).kind).toBe("serving");
+    // An account refused outright is blocked for every model.
+    expect(fleetCapacity([{ account: "x" }], [refusal({ kind: "entitlement", account: "x" })], { id: "gpt-6" }, 2_000).kind).toBe("spent");
 });
 
 test("an answer on one model covers another only where every pool the other spends gates it too", () => {