@intentic/sandbox-contract 1.345.0 → 1.347.0

package/src/models/plan-pools.ts

@@ -1,4 +1,5 @@
 import type { AccountState, AccountUsage, ProviderRefusal, UsageWindow, WindowGates } from "../schemas/providers/plan-limits.js";
+import { humanizeModelId } from "./model-label.js";
 
 // Single reading of which account pool gates a given model (or, with none named, the account's tightest pool), shared
 // by the daemon's picker/refusal logic and the browser's rings and rail. A pool gated `none` is excluded from the
@@ -191,8 +192,9 @@ export const currentWindows = (usage: AccountUsage, now: number): UsageWindow[]
     });
 };
 
-// Whether an account can serve a turn: the one rule every picker and surface reads (AccountState). The daemon runs it and
-// publishes the verdict on each account row; the editor runs it only on a row from a daemon older than that field.
+// Whether an account can serve a turn, and what one provider's accounts can serve together: the one rule every picker,
+// gate, listing and surface reads. The daemon and the editor run it on the same facts (the account rows and every
+// refusal on file); neither keeps a judged copy, so the two cannot disagree.
 
 /** Everything the serviceability rule reads of one account, as the account rows already carry it. */
 export interface ServiceFacts {
@@ -209,6 +211,9 @@ export interface ServiceFacts {
     readonly label?: string | undefined;
 }
 
+/** Every refusal on file for one provider: what its accounts are judged against, each standing until something answers it. */
+export type RefusalsOnFile = readonly ProviderRefusal[];
+
 // A spent allowance is over once a reading with room lands after it; a refused credential once any reading does (the
 // token worked). Nothing a reading says answers an entitlement refusal: a seatless account authenticates and reads fine.
 // Nor does the refused account's own reading answer an allowance it does not measure (`unmetered`: an admin's credit).
@@ -227,10 +232,39 @@ const answers = (refusal: ProviderRefusal, facts: ServiceFacts, measured: boolea
 };
 
 /**
- * How a provider's last refusal stands against everything read since, over every account the provider holds: `gone` once
- * the account it named is disconnected, `answered` once the instant it named has passed or once that account (or, for a
- * refusal naming none, any account) has a later reading that contradicts it, else `standing`. An empty list is one not
- * loaded yet, so the refusal stands.
+ * When the pool a spent allowance that named no instant was refused in reopens, in epoch seconds: the soonest reset of
+ * the binding pool for the model it named (the pool judgedReading pins full) on the accounts it may have refused, its own
+ * where it named one, any where it named none, as any account's room answers a nameless one. The daemon's ledger stamps
+ * it on the refusal as it files it (`poolResetsAt`), while the readings still show that pool open: once it reopens the
+ * reading lapses it to an empty pool and a different one binds, so it cannot be read back off the reading later.
+ * Undefined for a refusal that named its instant, one no reading measures (`unmetered`), a person's mark (lifted by a
+ * person or a turn, not a window), and where no reading publishes a reset still ahead of the refusal.
+ */
+export const refusedPoolReset = (refusal: ProviderRefusal, accounts: readonly ServiceFacts[]): number | undefined => {
+    if (refusal.kind !== "limit" || refusal.resetsAt !== undefined || refusal.unmetered === true || refusal.byHand === true) {
+        return undefined;
+    }
+    const model = refusal.model === undefined ? undefined : { id: refusal.model };
+    const resets = accounts
+        .filter((facts) => refusal.account === undefined || facts.account === refusal.account)
+        .flatMap((facts) => {
+            const reset = bindingWindow(facts.usage, model)?.resetsAt;
+            return reset !== undefined && reset * 1000 > refusal.at ? [reset] : [];
+        });
+    return resets.length === 0 ? undefined : Math.min(...resets);
+};
+
+/**
+ * How a refusal on file stands against everything read since, over every account the provider holds: `gone` once the
+ * account it named is disconnected, `answered` once the instant it named has passed (or, where it named none, the
+ * reset of the pool it was refused in, stamped as it was filed: refusedPoolReset) or once that account (or, for a refusal
+ * naming none, any account) has a later reading that contradicts it, else `standing`. An empty list is one not loaded
+ * yet, so the refusal stands. Judged by the daemon and every open window at the same instant from what the refusal
+ * carries: nothing waits for a fresh reading or a ledger write to flip it. 2026-10-20: a refusal naming no instant stood
+ * past its pool's reset until the next reading landed, up to the 15-minute idle sweep, while the picker already said
+ * "back at" that reset. A stamp is this sandbox's guess, not the provider's word, so a reading taken after it outranks
+ * it: 2026-10-21, a weekly pool read at a rounded 100 once the five-hour one it was stamped with reopened, and the
+ * account read ready with no room, so every turn let through was refused again.
  */
 export const refusalVerdict = (
     refusal: ProviderRefusal,
@@ -241,8 +275,12 @@ export const refusalVerdict = (
     if (refusal.account !== undefined && named.length === 0) {
         return accounts.length === 0 ? "standing" : "gone";
     }
-    // The provider's own "try again at" is over at that instant, whichever account it refused.
-    if (refusal.kind === "limit" && refusal.resetsAt !== undefined && refusal.resetsAt * 1000 <= now) {
+    const whose = refusal.account === undefined ? accounts : named;
+    // The provider's own "try again at" is over at that instant, whichever account it refused; so, where it named none,
+    // is the refused pool's reset the ledger stamped, unless a reading since says otherwise (read below).
+    const over = refusal.resetsAt ?? refusal.poolResetsAt;
+    const readSince = (instant: number): boolean => whose.some((facts) => (facts.usage?.measuredAt ?? 0) > instant * 1000);
+    if (refusal.kind === "limit" && over !== undefined && over * 1000 <= now && (refusal.resetsAt !== undefined || !readSince(over))) {
         return "answered";
     }
     // Where it is known which account it refused (it named one, or there is only one), the provider's own instant
@@ -252,7 +290,7 @@ export const refusalVerdict = (
         return "standing";
     }
     if (known) {
-        return (refusal.account === undefined ? accounts : named).some((facts) => answers(refusal, facts)) ? "answered" : "standing";
+        return whose.some((facts) => answers(refusal, facts)) ? "answered" : "standing";
     }
     /* A nameless refusal over several accounts is one of them saying no, and nothing says which: the translator benches
        the one it refused and routes on, so any of them reading room since answers it, whatever kind of allowance it was
@@ -261,6 +299,22 @@ export const refusalVerdict = (
     return accounts.some((facts) => answers(refusal, facts, true)) ? "answered" : "standing";
 };
 
+// A stamp a reading has outlived (refusalVerdict) says nothing of when the pool now holding the refusal reopens: that
+// pool's own reset does.
+const unstampedPast = (refusal: ProviderRefusal, now: number): ProviderRefusal => {
+    if (refusal.poolResetsAt === undefined || refusal.poolResetsAt * 1000 > now) {
+        return refusal;
+    }
+    const { poolResetsAt: _outlived, ...standing } = refusal;
+    return standing;
+};
+
+/** The refusals still standing over each of a provider's accounts: those naming it, and those naming none. */
+export const standingOver = (accounts: readonly ServiceFacts[], refusals: RefusalsOnFile, now: number = Date.now()): ((account: string) => RefusalsOnFile) => {
+    const standing = refusals.filter((refusal) => refusalVerdict(refusal, accounts, now) === "standing").map((refusal) => unstampedPast(refusal, now));
+    return (account) => standing.filter((refusal) => (refusal.account ?? account) === account);
+};
+
 // The account reopens for this question when the pools holding it shut do: all of them for a model's own question (or
 // the pools gating every model), the first to reopen when only per-model slices are full. Unknown if any is unpublished.
 const reopening = (full: readonly UsageWindow[], first: boolean): number | undefined => {
@@ -268,7 +322,20 @@ const reopening = (full: readonly UsageWindow[], first: boolean): number | undef
     return resets.length === full.length && resets.length > 0 ? (first ? Math.min(...resets) : Math.max(...resets)) : undefined;
 };
 
-const spent = (reopensAt: number | undefined): AccountState => (reopensAt === undefined ? { kind: "spent" } : { kind: "spent", reopensAt });
+// Spent until the pools holding it reopen, named by the one that decides when, where the plan meters it apart (an
+// undivided allowance is just "the allowance").
+const spentOn = (holding: readonly UsageWindow[], first: boolean): AccountState => {
+    const state: AccountState & { kind: "spent" } = { kind: "spent" };
+    const reopensAt = reopening(holding, first);
+    if (reopensAt !== undefined) {
+        state.reopensAt = reopensAt;
+    }
+    const deciding = holding.find((window) => window.resetsAt === reopensAt) ?? holding[0];
+    if (deciding !== undefined && deciding.gates !== "all" && deciding.label !== undefined) {
+        state.pool = deciding.label;
+    }
+    return state;
+};
 
 // A turn on the model this reading was contradicted for went through while the pool read full: the pool is at the line,
 // not proven empty, exactly as a rounded one is (provenFull).
@@ -289,17 +356,15 @@ const holdingPools = (full: readonly UsageWindow[], open: readonly UsageWindow[]
 };
 
 /**
- * What the polled reading ALONE says, never whether the account can serve: that is `serviceState`, which also reads the
- * refusals on file, ask it through the daemon's `serviceability`/`allowanceWall` or the editor's `accountState`. A
- * provider that rounds its percentages (Claude does, every pool) is never proven spent here, so a caller reading this
- * as the verdict sees every spent account as open: a pick between two spent accounts re-booked a held turn for "now"
- * that way (2026-10-19). Imported only by the few modules lint allows (.oxlintrc.json, no-restricted-imports), and was
- * named `headroomState` until then.
+ * What a reading says, at the contract's one spent line, never whether the account can serve: that is `serviceStates`,
+ * which first lays every standing refusal on the reading (judgedReading). A provider that rounds its percentages (Claude
+ * does, every pool) is never proven spent here, so a caller reading a polled reading's verdict as the account's sees every
+ * spent account as open: a pick between two spent accounts re-booked a held turn for "now" that way (2026-10-19).
+ * Imported only by the few modules lint allows (.oxlintrc.json, no-restricted-imports).
  *
- * The plan-limit half of the verdict, at the contract's one spent line. With a model, the pools that model spends: spent
- * once any is full, else the room the fullest leaves. With none, whether the account can serve SOME turn: spent once a
- * pool gating every model is full, or every per-model slice is; a full slice alone (Opus at 100%) leaves the other
- * models their room, which is then read off the fullest pool still open.
+ * With a model, the pools that model spends: spent once any is full, else the room the fullest leaves. With none, whether
+ * the account can serve SOME turn: spent once a pool gating every model is full, or every per-model slice is; a full
+ * slice alone (Opus at 100%) leaves the other models their room, which is then read off the fullest pool still open.
  */
 export const readingHeadroom = (usage: AccountUsage | undefined, model?: ModelRef): AccountState => {
     const windows = gatingWindows(usage, model).map((window) => (answeredDespite(usage, window) ? { ...window, rounded: true } : window));
@@ -319,101 +384,168 @@ export const readingHeadroom = (usage: AccountUsage | undefined, model?: ModelRe
     if (sliced && (usage?.uncovered?.length ?? 0) > 0) {
         return { kind: "unknown" };
     }
-    return spent(reopening(holding, sliced));
+    return spentOn(holding, sliced);
 };
 
-/**
- * A reading as a standing limit refusal leaves it, for every surface that draws or judges it: the pool the refused turn's
- * model spends (else the one asked about, else the tightest) read full, since a polled reading freezes the moment a pool
- * actually empties, and reopening when the provider said to try again, where it said, over whatever the polled pool last
- * said. Never another model's allowance. The reading as it was where it has no such pool.
- */
-export const pinRefused = (usage: AccountUsage | undefined, refusal: ProviderRefusal, model?: ModelRef): AccountUsage | undefined => {
+// What a person calls a refused pool no reading names: the model it refused, or the allowance as a whole.
+const REFUSED_ALLOWANCE = "Allowance";
+
+// The pool a limit refusal proves full where no pool of the reading gates the model it refused: a plan that publishes
+// nothing (Cursor's, Devin's) or names no pool for that model. Its own, gating only that model (every model, where it
+// named none), reopening when the provider said.
+const refusedPool = (refusal: ProviderRefusal): UsageWindow => {
+    const pool: UsageWindow = {
+        kind: `refused:${refusal.model ?? "all"}`,
+        label: refusal.model === undefined ? REFUSED_ALLOWANCE : humanizeModelId(refusal.model),
+        utilization: SPENT_UTILIZATION,
+        gates: refusal.model === undefined ? "all" : { models: [refusal.model] },
+    };
+    if (refusal.resetsAt !== undefined) {
+        pool.resetsAt = refusal.resetsAt;
+    }
+    return pool;
+};
+
+// One limit refusal laid on a reading: the pool the refused turn's model spends (else the one asked about, else the
+// tightest) read full, since a polled reading freezes the moment a pool actually empties, and reopening when the provider
+// said to try again, where it said, over whatever the polled pool last said. Never another model's allowance.
+const pinRefusal = (usage: AccountUsage | undefined, refusal: ProviderRefusal, model: ModelRef | undefined): AccountUsage => {
     const binding = bindingWindow(usage, refusal.model === undefined ? model : { id: refusal.model });
     if (usage === undefined || binding === undefined) {
-        return usage;
+        return { ...(usage ?? { measuredAt: refusal.at }), windows: [...(usage?.windows ?? []), refusedPool(refusal)] };
+    }
+    const pinned = pinnedFull(binding);
+    // Reopening when the refusal ends (refusalVerdict), so the "back at" every surface draws is when it flips.
+    const over = refusal.resetsAt ?? refusal.poolResetsAt;
+    if (over !== undefined) {
+        pinned.resetsAt = over;
     }
-    const pinned = (window: UsageWindow): UsageWindow =>
-        refusal.resetsAt === undefined ? pinnedFull(window) : { ...pinnedFull(window), resetsAt: refusal.resetsAt };
-    return { ...usage, windows: usage.windows.map((window) => (window === binding ? pinned(window) : window)) };
+    return { ...usage, windows: usage.windows.map((window) => (window === binding ? pinned : window)) };
 };
 
 /**
- * The plan-limit verdict on a reading a standing limit refusal covers (pinRefused), the one rule the daemon's verdict and
- * the editor's live re-reading both judge by. Spent until the provider's own "try again at" where it named one: the
- * editor once re-judged the pinned pool by its own reset alone, and drew "spent until 19:55" over a daemon verdict, and a
- * model picker, both saying 15:53 (2026-10-20).
+ * An account's reading as the refusals standing over it leave it: what every surface draws and every verdict judges,
+ * never the polled reading alone. Each standing limit refusal is laid on it, oldest first so the newest says when its
+ * pool reopens. `standing` is what standingOver answers for the account; a refusal of another kind pins nothing.
  */
-export const refusedHeadroom = (usage: AccountUsage | undefined, refusal: ProviderRefusal, model?: ModelRef): AccountState => {
-    const pinned = pinRefused(usage, refusal, model);
-    if (pinned === usage) {
-        // No pool to pin: the refusal itself is the evidence, unless it was about a different model than this question.
-        const sameModel = refusal.model === undefined || model === undefined || refusal.model === model.id;
-        return sameModel ? spent(refusal.resetsAt) : readingHeadroom(usage, model);
-    }
-    const state = readingHeadroom(pinned, model);
-    return state.kind === "spent" && refusal.resetsAt !== undefined ? spent(refusal.resetsAt) : state;
-};
+export const judgedReading = (usage: AccountUsage | undefined, standing: RefusalsOnFile, model?: ModelRef): AccountUsage | undefined =>
+    standing
+        .filter((refusal) => refusal.kind === "limit")
+        .toSorted((left, right) => left.at - right.at)
+        .reduce<AccountUsage | undefined>((reading, refusal) => pinRefusal(reading, refusal, model), usage);
+
+/** The newest of some refusals: the latest word, where a surface says one line about a provider or an account. */
+export const newestRefusal = (refusals: RefusalsOnFile): ProviderRefusal | undefined =>
+    refusals.reduce<ProviderRefusal | undefined>((newest, refusal) => (newest === undefined || refusal.at > newest.at ? refusal : newest), undefined);
 
 /**
- * One account's verdict. `refusal` is the provider's last refusal only when it still stands and covers this account
- * (serviceStates decides that). Precedence: a revoked sign-in outranks a lost seat (reconnecting fixes one, nothing here
- * fixes the other), both outrank a standing refusal, then a translator bench, then the plan limits.
+ * One account's verdict on everything on file over it. `standing` is the refusals still standing over it (standingOver).
+ * Precedence: a revoked sign-in outranks a lost seat (reconnecting fixes one, nothing here fixes the other), both outrank
+ * the newest standing refusal where it refused the account itself, then a translator bench, then the plan limits on the
+ * reading the refusals leave (judgedReading).
  */
-export const serviceState = (facts: ServiceFacts, refusal?: ProviderRefusal, model?: ModelRef, now: number = Date.now()): AccountState => {
+export const serviceState = (facts: ServiceFacts, standing: RefusalsOnFile = [], model?: ModelRef, now: number = Date.now()): AccountState => {
     if (facts.needsReauth === true) {
         return { kind: "blocked", fix: "reconnect", reason: facts.detail ?? "sign-in expired" };
     }
     if (facts.seatRefusal !== undefined) {
         return { kind: "blocked", fix: "admin", reason: facts.seatRefusal };
     }
-    if (refusal?.kind === "auth") {
-        return { kind: "blocked", fix: "reconnect", reason: refusal.message };
+    // The newest word on the account: a sign-in or an entitlement refused after any spent allowance blocks it, and a
+    // spent allowance refused after either says the account authenticated and was served, so that one is over.
+    const newest = newestRefusal(standing);
+    if (newest?.kind === "auth") {
+        return { kind: "blocked", fix: "reconnect", reason: newest.message };
     }
-    if (refusal?.kind === "entitlement") {
-        return { kind: "blocked", fix: "admin", reason: refusal.message };
+    if (newest?.kind === "entitlement") {
+        return { kind: "blocked", fix: "admin", reason: newest.message };
     }
-    const cooling = facts.cooling;
-    // A bench the provider wants a person for: the account's owner confirms it on the provider's page, and no wait or
-    // reconnect here lifts it. Outranks the retry instant, which is only when the proxy will ask again.
-    if (cooling?.verify !== undefined) {
+    const plan = readingHeadroom(judgedReading(facts.usage, standing, model), model);
+    return facts.cooling === undefined ? plan : benched(facts.cooling, plan, now);
+};
+
+// A translator bench over the plan verdict. One the provider wants a person for: the account's owner confirms it on the
+// provider's page, and no wait or reconnect here lifts it, whatever the retry instant says. One with no instant is one no
+// wait lifts either (a Google account with no project): somebody has to connect again. One with an instant is the
+// translator's own retry, a floor rather than the reopening: a Kimi credential benched for thirty minutes with its
+// five-hour window two hours from reopening was re-run at thirty minutes and refused again (2026-10-17), so it lifts once
+// its pools have reopened too. Past its instant it is over, and the plan speaks.
+const benched = (cooling: NonNullable<ServiceFacts["cooling"]>, plan: AccountState, now: number): AccountState => {
+    if (cooling.verify !== undefined) {
         return { kind: "blocked", fix: "verify", reason: cooling.reason ?? "the provider wants this account verified", url: cooling.verify };
     }
-    // A bench with no instant is one no wait lifts (a Google account with no project): somebody has to connect again.
-    if (cooling !== undefined && cooling.until === undefined) {
+    if (cooling.until === undefined) {
         return { kind: "blocked", fix: "reconnect", reason: cooling.reason ?? "benched by the translator" };
     }
-    if (cooling?.until !== undefined && cooling.until * 1000 > now) {
-        return { kind: "blocked", fix: "wait", reason: cooling.reason ?? "cooling down", until: cooling.until };
+    if (cooling.until * 1000 <= now) {
+        return plan;
     }
-    return refusal?.kind === "limit" ? refusedHeadroom(facts.usage, refusal, model) : readingHeadroom(facts.usage, model);
+    const until = plan.kind === "spent" && plan.reopensAt !== undefined ? Math.max(cooling.until, plan.reopensAt) : cooling.until;
+    return { kind: "blocked", fix: "wait", reason: cooling.reason ?? "cooling down", until };
 };
 
-/** The refusals a provider's accounts are judged against: its last one, or every one on file (each account's own beside it). */
-export type RefusalsOnFile = ProviderRefusal | readonly ProviderRefusal[] | undefined;
-
-const refusalList = (refusals: RefusalsOnFile): readonly ProviderRefusal[] =>
-    refusals === undefined ? [] : "kind" in refusals ? [refusals] : refusals;
-
-/**
- * Every account of one provider, judged together, since a refusal naming no account is answered by any of them. Each
- * account answers to the newest refusal that still stands over it: the provider's last one moves on to whichever account
- * said no next, and an account's own refusal on file stays true of it until something answers it.
- */
+/** Every account of one provider, judged together, since a refusal naming no account is answered by any of them. */
 export const serviceStates = (
     accounts: readonly ServiceFacts[],
-    refusals: RefusalsOnFile,
+    refusals: RefusalsOnFile = [],
     model?: ModelRef,
     now: number = Date.now(),
 ): ReadonlyMap<string, AccountState> => {
-    const standing = refusalList(refusals)
-        .filter((refusal) => refusalVerdict(refusal, accounts, now) === "standing")
-        .toSorted((left, right) => right.at - left.at);
-    return new Map(
-        accounts.map((facts) => [facts.account, serviceState(facts, standing.find((refusal) => (refusal.account ?? facts.account) === facts.account), model, now)]),
-    );
+    const standing = standingOver(accounts, refusals, now);
+    return new Map(accounts.map((facts) => [facts.account, serviceState(facts, standing(facts.account), model, now)]));
+};
+
+/** When an account that cannot serve says it can again, in epoch seconds; undefined where its verdict names no instant. */
+export const reopensAtOf = (state: AccountState): number | undefined => {
+    if (state.kind === "spent") {
+        return state.reopensAt;
+    }
+    return state.kind === "blocked" && state.fix === "wait" ? state.until : undefined;
+};
+
+/**
+ * What one provider's accounts can do for one model, together: the answer every gate, listing, picker and offer reads,
+ * so none can call a model spent that another lets through. An unmeasured account may still answer, so it keeps the
+ * model servable; only every account spent or blocked makes it spent.
+ */
+export type FleetCapacity =
+    // No account to judge: nothing on file says either way, so the model is asked.
+    | { readonly kind: "unknown" }
+    // `serving` of the `accounts` are ready or unmeasured; `roomMeasuredAt` is the newest reading with room among them.
+    | { readonly kind: "serving"; readonly serving: number; readonly accounts: number; readonly roomMeasuredAt?: number | undefined }
+    // Every account is spent or blocked: `reopensAt` is the soonest any is back (any one unblocks the turn), where one
+    // says when, and `pool` what holds that one.
+    | { readonly kind: "spent"; readonly accounts: number; readonly reopensAt?: number | undefined; readonly pool?: string | undefined };
+
+/** A provider's capacity for one model from its accounts as already judged on that model (serviceStates). */
+export const fleetOf = (accounts: readonly ServiceFacts[], states: ReadonlyMap<string, AccountState>): FleetCapacity => {
+    if (accounts.length === 0) {
+        return { kind: "unknown" };
+    }
+    const judged = accounts.map((facts) => ({ facts, state: states.get(facts.account) ?? ({ kind: "unknown" } as const) }));
+    const serving = judged.filter(({ state }) => state.kind === "ready" || state.kind === "unknown");
+    if (serving.length > 0) {
+        const room = serving.flatMap(({ facts, state }) => (state.kind === "ready" && facts.usage !== undefined ? [facts.usage.measuredAt] : []));
+        return { kind: "serving", serving: serving.length, accounts: accounts.length, roomMeasuredAt: room.length === 0 ? undefined : Math.max(...room) };
+    }
+    // The soonest instant any account names; one with none only decides the pool where nothing names an instant.
+    const soonest = judged.reduce<AccountState | undefined>((best, { state }) => {
+        const at = reopensAtOf(state);
+        const bestAt = best === undefined ? undefined : reopensAtOf(best);
+        return best === undefined || (at !== undefined && (bestAt === undefined || at < bestAt)) ? state : best;
+    }, undefined);
+    return {
+        kind: "spent",
+        accounts: accounts.length,
+        reopensAt: soonest === undefined ? undefined : reopensAtOf(soonest),
+        pool: soonest?.kind === "spent" ? soonest.pool : undefined,
+    };
 };
 
+/** A provider's capacity for one model, judged on its accounts and every refusal on file. */
+export const fleetCapacity = (accounts: readonly ServiceFacts[], refusals: RefusalsOnFile = [], model?: ModelRef, now: number = Date.now()): FleetCapacity =>
+    fleetOf(accounts, serviceStates(accounts, refusals, model, now));
+
 // Worst last: proven room, no reading either way, a pool at the line (it may hold a sliver, or nothing), known spent,
 // and nothing a turn can run on.
 const preference = (state: AccountState): number => {
@@ -441,8 +573,8 @@ export const preferredAccount = <T extends { readonly state: AccountState }>(ent
 
 /**
  * The roomiest account with proven room, or none: what a move off a refused account may land on. Ties keep the caller's
- * order. An account at the line is left out: a move there could be refused in turn, and with one refusal remembered per
- * provider, two such accounts would hand the turn back and forth.
+ * order. An account at the line is left out: a move there could be refused in turn, and two such accounts would hand the
+ * turn back and forth.
  */
 export const roomiestAccount = <T extends { readonly state: AccountState }>(entries: readonly T[]): T | undefined =>
     preferredAccount(entries.filter((entry) => entry.state.kind === "ready" && entry.state.room > 0));

package/src/protocol/doors/runner-protocol.ts

@@ -24,6 +24,9 @@ export const RunnerHelloSchema = z.object({
     // tag names its own container (`intentic-sandbox-env-<slug>:<hash>`), so two sides on one base and one overlay
     // never share it. Absent on an old image, which is then compared by `image` alone.
     baseImage: z.string().optional(),
+    // That base's registry digest (SANDBOX_BASE_DIGEST), when the runner's machine could read one; parity then compares
+    // the exact image rather than a tag two machines may have pulled at different moments (state/sandbox-build.ts).
+    baseDigest: z.string().optional(),
     channel: z.string().optional(),
     overlayHash: z.string().optional(),
     // Runner's declared settings-only sandbox.toml (definition.ts), diffed against the parent's to itemize drift;
@@ -147,7 +150,7 @@ export const RunnerSummarySchema = z.object({
     overlayHash: z.string().optional(),
     facts: RunnerFactsSchema.optional(),
     lastSeen: z.number().optional(),
-    // Computed once by the daemon (runners/runner-parity.ts), so every surface shows the same badge.
+    // Computed once by the daemon (buildParity, state/sandbox-build.ts), so every surface shows the same badge.
     parity: RunnerParitySchema,
     // Where the runner's environment differs from this sandbox's, one line per difference; absent if never reported,
     // empty if they agree. A Setting line is fixable live; an overlay line needs a rebuild.

package/src/protocol/raw/raw-routes.ts

@@ -146,6 +146,7 @@ export const RAW_ROUTES = {
     "POST /children/answer": { agent: true, control: "never" },
     "POST /children/cancel": { agent: true, control: "never" },
     "POST /children/merge": { agent: true, control: "never" },
+    "POST /children/settle": { agent: true, control: "never" },
     // Handing a task to another of the owner's sandboxes over a link card (`agents delegate`), and which links this
     // conversation's turn may hand work to (`agents links`); held to the cards the turn was granted, like the tool.
     "POST /children/delegate": { agent: true, control: "never" },

package/src/schemas/agent-next.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+
+// WHAT MOVES A CONVERSATION NEXT WITH NOBODY PRESSING ANYTHING: the one answer every surface reads (AgentSummary.next).
+// Five mechanisms can carry a conversation on by themselves: a spent allowance's held turn re-run at its reopen or moved
+// to another account, a message held for memory sent once memory frees, and messages a person booked for a time or for
+// after another conversation lands. Each used to publish its own raw state on the card (a booking flag copied onto the
+// stored ending and re-synced every beat, the queue's own shadow, a failure code plus an answer the editor looked up in
+// Settings), and each surface rebuilt "does it go by itself" from its own subset: the lane from two of them, the card's
+// corner from three, the chat's bar from one more. They disagreed (a memory hold "sends when room" in the corner and
+// waited in Attention; a booked resend read as Attention after a restart; a booked message cancelled with an archive
+// that never counted it). The daemon now derives this one value from what the conversation holds, every time the card
+// is read (conversation-next.ts), and nothing else on the card says whether or when it goes by itself.
+export const AgentNextSchema = z.discriminatedUnion("kind", [
+    z.object({
+        kind: z.literal("rerun"),
+        at: z.number().describe("When the held turn goes again, in milliseconds: its allowance's reopen, or the next pass for a move. Already past means any moment now."),
+        onto: z.string().optional().describe("The account the owner's answer to the limit is moving it to. Absent when it goes again where it was refused."),
+    }),
+    z.object({ kind: z.literal("room") }).describe("A message, or a turn the sandbox kept, held because memory ran short: it goes once memory has stayed free a while."),
+    z.object({
+        kind: z.literal("send"),
+        at: z.number().describe("When the soonest booked message goes, in milliseconds."),
+        count: z.number().int().min(1).describe("How many messages are booked to go by themselves."),
+    }),
+    z.object({
+        kind: z.literal("land"),
+        after: z.string().describe("The conversation whose landed work the first booked message waits for."),
+        count: z.number().int().min(1).describe("How many messages are booked to go by themselves."),
+    }),
+]);
+export type AgentNext = z.infer<typeof AgentNextSchema>;
+
+/** Whether a conversation carries on by itself, with nobody pressing anything: the one reading of `next`. */
+export const goesBySelf = (agent: { readonly next?: AgentNext | undefined }): boolean => agent.next !== undefined;

package/src/schemas/agent-search.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+
+// The board's search over what conversations said: the query, and what came back with its evidence.
+
+// Searches only speech, both sides of the conversation, never thinking, tool output or protocol text, which would
+// otherwise match nearly the whole board. Two-char minimum; `caseSensitive` off means case-insensitive, matching
+// workspace search's own switch.
+export const AgentSearchQuerySchema = z.object({
+    query: z
+        .string()
+        .trim()
+        .min(2)
+        .describe(
+            "What to look for. Searched against what was said, both sides of the conversation, and nothing else: not the thinking, not the tool output, which between them name nearly every identifier in the workspace and would return most of the board.",
+        ),
+    caseSensitive: z.stringbool().optional().describe("Whether capitals matter."),
+});
+// Why a row survived the filter: the matched line, windowed, and who said it. `speaker` rides with the text since agent
+// prose alone can read as something the user typed.
+export const SpeakerSchema = z.enum(["user", "agent"]);
+export type Speaker = z.infer<typeof SpeakerSchema>;
+export const MatchSnippetSchema = z.object({
+    text: z.string().describe("The matching line, with a little either side of it."),
+    speaker: SpeakerSchema.describe(
+        "Who said it. Carried with the words rather than beside them, because a line of the agent's prose under a card reads as something you typed until the row says otherwise.",
+    ),
+});
+export type MatchSnippet = z.infer<typeof MatchSnippetSchema>;
+// One matching agent and its evidence; `snippet` is absent for a title match, which the card already shows.
+export const AgentMatchSchema = z.object({
+    id: z.string().describe("Which conversation matched."),
+    snippet: MatchSnippetSchema.optional().describe(
+        "Why, in its own words. Absent when the title was the match, which the card already shows: repeating it underneath is noise where evidence was wanted.",
+    ),
+});
+export type AgentMatch = z.infer<typeof AgentMatchSchema>;
+// How many agents were actually read, so the board can say a search saw less than the whole fleet.
+export const AgentSearchResultSchema = z.object({
+    matches: z.array(AgentMatchSchema).describe("What matched, from the live fleet and the archive together."),
+    scanned: z
+        .number()
+        .describe(
+            "How many conversations were actually read, so a screen can say when a search saw less than everything rather than implying it saw all of it.",
+        ),
+    indexing: z
+        .boolean()
+        .describe(
+            "Whether what was said is still being read in the background. True means this answer can still grow, so a screen must say it is incomplete rather than presenting it as the whole list.",
+        ),
+});
+export type AgentSearchResult = z.infer<typeof AgentSearchResultSchema>;

package/src/schemas/agent.ts

@@ -80,6 +80,16 @@ export * from "./conversation-links.js";
 // batch rather than build a turn past this (turn-admission.ts, together): a turn the daemon makes must parse back.
 export const ATTACHMENT_LIMIT = 20;
 
+// Where a fork is cut from, as the client that cut it names it (its first turn, or a draft no turn has started yet).
+export const ForkOfSchema = z.object({
+    conversationId: ConversationIdSchema.describe("The conversation this one was cut from."),
+    keep: z.number().int().nonnegative().describe("How many of that conversation's messages to copy in before this turn runs."),
+    files: z
+        .enum(["then", "now"])
+        .describe(
+            'Which files the fork opens on: "now" is the workspace as it stands, "then" is the files as they were at the cut, which needs a private copy.',
+        ),
+});
 const AgentTurnFieldsSchema = z.object({
     prompt: z.string().describe("What to say to the agent. May be empty if you are only attaching files."),
     errand: TurnErrandSchema.optional().describe(
@@ -189,18 +199,7 @@ const AgentTurnFieldsSchema = z.object({
     // the new session from its own conversationId-keyed record.
     // Where a fork was cut from, on its first turn only; requires conversationId, and files:"then" implies
     // isolated.
-    forkOf: z
-        .object({
-            conversationId: ConversationIdSchema.describe("The conversation this one was cut from."),
-            keep: z.number().int().nonnegative().describe("How many of that conversation's messages to copy in before this turn runs."),
-            files: z
-                .enum(["then", "now"])
-                .describe(
-                    'Which files the fork opens on: "now" is the workspace as it stands, "then" is the files as they were at the cut, which needs a private copy.',
-                ),
-        })
-        .optional()
-        .describe("Where this conversation was cut from, on its first turn only. Only the client knows this, so only the client can say it."),
+    forkOf: ForkOfSchema.optional().describe("Where this conversation was cut from, on its first turn only. Only the client knows this, so only the client can say it."),
     // A fresh session's origin, on its first turn only; requires an isolated conversationId the registry has never seen.
     freshOf: FreshOfSchema.optional().describe(FRESH_OF_DESCRIPTION),
     // The browser sends the chosen model per turn; the provider token is the sandbox's own stored credential.
@@ -323,6 +322,16 @@ export type AgentTurn = z.infer<typeof AgentTurnSchema>;
 // What `agent.run` takes: a turn, plus the one field only a request carries and no stored turn keeps. A daemon from before
 // `continues` reads past it and takes `prompt` as the words, which is why a client still sends some.
 export const AgentRunSchema = AgentTurnSchema.safeExtend({
+    // Request-only like `continues`: the draft goes in the same step that takes the message, so it is cleared exactly
+    // once, by the send itself, and a window that closes before its own clear arrives leaves no ghost of sent words.
+    draft: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe(
+            "The revision of your composer draft for this conversation these words were sent from (`agents.drafts`). The sandbox clears that draft as it takes the message, unless it has been written again since. Leave it out to leave your draft as it is.",
+        ),
     continues: z
         .literal(true)
         .optional()