@kubitnodes/stellaris 0.4.0 → 0.4.2

package/dist/server/index.js

@@ -398,6 +398,21 @@ function quotaLevel(quota, now) {
   const high = quota.windows.some((window) => windowCurrent(window, now) && window.usedPercent !== null && window.usedPercent >= QUOTA_WARNING_PERCENT);
   return quota.status === "warning" || high ? "warning" : "ok";
 }
+var UNKNOWN_LIMIT_HOLD_MS = 30 * 6e4;
+function stopsTurns(quota) {
+  return quota.status === "limited" && !(quota.source === "read" && quota.extraUsage?.enabled === true);
+}
+function limitHold(quota, now) {
+  if (!stopsTurns(quota)) {
+    return null;
+  }
+  const known = quota.limitedUntil !== null;
+  const until = quota.limitedUntil ?? new Date(Date.parse(quota.observedAt) + UNKNOWN_LIMIT_HOLD_MS).toISOString();
+  return Date.parse(until) > now.getTime() ? { until, known } : null;
+}
+function limitLapsed(quota, now) {
+  return stopsTurns(quota) && quota.limitedUntil === null && limitHold(quota, now) === null;
+}
 var WINDOW_NAMES = {
   five_hour: "5h",
   seven_day: "7d",
@@ -751,12 +766,16 @@ var RunnerSchema = z5.object({
 function runnerPause(runner, cli) {
   return runner.paused ?? runner.pausedClis?.[cli];
 }
-function heldOn(runners2, runner, cli) {
+function runnerLimitHold(runner, cli, now) {
+  const quota = runner.quotas?.[cli];
+  return quota === void 0 ? null : limitHold(quota, now);
+}
+function heldOn(runners2, runner, cli, now) {
   if (runner === void 0 || cli === null) {
     return false;
   }
   const record = runners2.find((each) => each.name === runner);
-  return record !== void 0 && runnerPause(record, cli) !== void 0;
+  return record !== void 0 && (runnerPause(record, cli) !== void 0 || runnerLimitHold(record, cli, now) !== null);
 }
 var ProposalKindSchema = z5.enum([
   "role",
@@ -1082,6 +1101,12 @@ var IMAGE_MEDIA_TYPES = {
   gif: "image/gif",
   webp: "image/webp"
 };
+var IMAGE_KIND_NAMES = {
+  png: "PNG",
+  jpeg: "JPEG",
+  gif: "GIF",
+  webp: "WebP"
+};
 function startsWith(bytes, prefix, at = 0) {
   for (let index = 0; index < prefix.length; index += 1) {
     if (bytes[at + index] !== prefix[index]) {
@@ -1303,7 +1328,7 @@ var VERB_DESCRIPTIONS = {
   release_task: "Let go of the stage you hold so someone else can take it.",
   update_task: "Move a task back to an earlier stage (the current stage's holder, the user, the steward, or the concierge; anyone else asks the concierge in the task's thread, with a mention), abandon it, set the tasks it is blocked by (blocked_by: its stage wakes nobody until they have all ended), or link its pull request (pull_request: url, with the merge commit's merge_subject and merge_body), which a ghpr task needs before its last stage completes. A note is posted to the task's thread.",
   get_task: "Read a task with its plan, its brief, and the messages of its thread.",
-  subscribe: "Subscribe to a channel. Subscriptions feed your digest; they never wake you.",
+  subscribe: "Subscribe to a channel. Its posts feed your digest, read at your next turn there; in a project's channel, one that asks nothing of you wakes you only once it is a day old.",
   unsubscribe: "Unsubscribe from a channel.",
   propose: "Propose a member, role, channel, reallocation, retirement, skill, or a project's archive. The charter shape per kind is in your instructions. Opens the proposal's thread in governance with your rationale; approval provisions it.",
   approve: "Approve a proposal; the board then provisions it, posts the decision in the proposal's thread, and closes it. User and steward only, never on your own proposal.",
@@ -1324,7 +1349,7 @@ var VERB_DESCRIPTIONS = {
   update_cron: "Pause or resume a cron, or change its title, note, or schedule; resuming or rescheduling starts it afresh from now. Yours, or anyone's for the user, the steward, and the concierge.",
   remove_cron: "End a cron for good, with a reason. Yours, or anyone's for the user, the steward, and the concierge. A cron also ends with its conversation, and a one-time cron once it fires.",
   remove_skill: "Remove a skill from the society's skills, with a reason, when it is wrong, superseded, or no longer used: no skills index lists it from the next turn, and a notice in general says so with the reason. Its proposer's own copy stays in its home. Steward and user only; the board keeps its text aside for the user to restore.",
-  upload_image: "Upload an image file, such as a screenshot or a chart, from the machine your turn runs on: a PNG, JPEG, GIF, or WebP of at most 8 MB, in your worktree, your home, or the system temp folder. Returns its id and the markdown that shows it in a post, `![what it shows](image:<id>)`; write what it shows as the alt text.",
+  upload_image: "Upload an image file, such as a screenshot or a chart, from the machine your turn runs on: a PNG, JPEG, GIF, or WebP of at most 8 MB once its metadata is left out, in your worktree, your home, or the system temp folder. Returns its id and the markdown that shows it in a post, `![what it shows](image:<id>)`; write what it shows as the alt text.",
   read_image: "Open an image the board keeps, as a post shows it, `![what it shows](image:<id>)`, by its id: the board writes it to a file of this turn's own on the machine it runs on, removed when the turn ends, and returns its path, type, and size. Open the path with your file tools to see the image."
 };
 
@@ -1546,7 +1571,11 @@ var RunnerHelloSchema = z9.object({
   gitIdentityMissing: z9.array(GitIdentityPartSchema).optional(),
   /** Turns the runner runs at once, or null for no limit. */
   slots: z9.number().int().positive().nullable(),
-  /** Turns the runner is still running, when it registers again; the server fails the rest of its turns. */
+  /**
+   * Turns the runner is still running, when it registers again: the server fails the rest of its
+   * turns, and has any of these it has ended stopped once the stream opens, when the runner lists
+   * a CLI it can stop.
+   */
   turns: z9.array(UlidSchema).default([])
 });
 var RunnerWelcomeSchema = z9.object({ name: NameSchema, version: z9.string() });
@@ -1709,9 +1738,9 @@ var TurnOutcomeSchema = z9.object({
    */
   resumeFailed: ResumeFailureSchema.optional(),
   /**
-   * Set when the model service turned the turn away for now, as when it was overloaded or failed
-   * on its side, which the scheduler answers by sending the same wake again within minutes. A
-   * runner from before never sends it.
+   * Set when the turn failed for now: the model service turned it away or cut it off, or the runner
+   * could not reach the board before the CLI started. The scheduler answers it by sending the same
+   * wake again within minutes. A runner from before never sends it.
    */
   transient: z9.boolean().optional(),
   /** The model the CLI reported, when it reported one. */
@@ -2130,13 +2159,18 @@ var TurnRecordSchema = z10.object({
   stoppedBy: NameSchema.optional(),
   /** Why the CLI could not resume the turn's session, for a turn that failed so. */
   resumeFailed: ResumeFailureSchema.optional(),
-  /** Whether the model service turned the turn away for now: overloaded, or failing on its side. */
+  /**
+   * Whether the turn failed for now, which the same wake may get past in a minute: the model service
+   * turned it away or cut it off, the runner could not reach the board before the CLI started, or
+   * the job never reached the runner.
+   */
   transient: z10.boolean().optional(),
   /** How many turns in a row, this one included, could not resume the session for a `retry`. */
   resumeRetries: z10.number().int().positive().optional(),
   /**
    * Whether the server dropped the conversation's session after this turn, which the next starts
-   * anew: one its CLI could not resume, or a society role's home after a reflection completed.
+   * anew: one its CLI could not resume, or a society role's or a project member's home after a
+   * reflection completed.
    */
   sessionDropped: z10.boolean().optional(),
   /** The crons whose fire started the turn, which record how it ended. */
@@ -2384,6 +2418,11 @@ var ServerConfigSchema = z13.object({
   dataDir: z13.string().min(1),
   host: z13.string().min(1),
   port: z13.number().int().positive().max(65535),
+  /**
+   * A second port, on the same host, that serves Prometheus's counters at `/metrics` and nothing
+   * else, or null for none: the main port's `/metrics` is the interface's page.
+   */
+  metricsPort: z13.number().int().positive().max(65535).nullable(),
   /**
    * An address every runner's agents reach this server at, for example https://board.example, or
    * null for each runner to use the address it reaches the server at itself.
@@ -2435,10 +2474,11 @@ function githubSignIn(env) {
   return GithubSignInSchema.parse({ clientId, clientSecret, users, appleAppId });
 }
 function loadServerConfig(env) {
-  return ServerConfigSchema.parse({
+  const config2 = ServerConfigSchema.parse({
     dataDir: env["STELLARIS_DATA_DIR"] ?? "./data",
     host: env["STELLARIS_HOST"] ?? "127.0.0.1",
     port: Number(env["STELLARIS_PORT"] ?? "4700"),
+    metricsPort: env["STELLARIS_METRICS_PORT"]?.trim() ? Number(env["STELLARIS_METRICS_PORT"]) : null,
     publicUrl: env["STELLARIS_PUBLIC_URL"]?.replace(/\/+$/, "") ?? null,
     logLevel: env["STELLARIS_LOG_LEVEL"] ?? "info",
     concurrency: limit(env["STELLARIS_CONCURRENCY"], null),
@@ -2448,6 +2488,10 @@ function loadServerConfig(env) {
     github: githubSignIn(env),
     trustedProxies: Number(env["STELLARIS_TRUSTED_PROXIES"] ?? "0")
   });
+  if (config2.metricsPort === config2.port) {
+    throw new Error("STELLARIS_METRICS_PORT must differ from STELLARIS_PORT");
+  }
+  return config2;
 }
 var RunnerConfigSchema = z13.object({
   /** The board server, for example http://127.0.0.1:4700. */
@@ -2467,7 +2511,7 @@ var RunnerConfigSchema = z13.object({
 });
 
 // packages/shared/dist/version.js
-var STELLARIS_VERSION = "0.4.0";
+var STELLARIS_VERSION = "0.4.2";
 
 // packages/shared/dist/mentions.js
 import { parse, postprocess, preprocess } from "micromark";
@@ -3162,6 +3206,451 @@ function filesOf(lines, status) {
   return [...files.values()];
 }
 
+// packages/shared/dist/image-metadata.js
+function withoutMetadata(bytes) {
+  switch (imageTypeOf(bytes)) {
+    case "jpeg":
+      return jpegWithoutMetadata(bytes);
+    case "png":
+      return pngWithoutMetadata(bytes);
+    case "gif":
+      return gifWithoutMetadata(bytes);
+    case "webp":
+      return webpWithoutMetadata(bytes);
+    default:
+      return null;
+  }
+}
+function exifOrientation(block) {
+  const tiff = startsWith2(block, EXIF_HEADER) ? block.subarray(EXIF_HEADER.length) : block;
+  let little;
+  if (tiff[0] === 73 && tiff[1] === 73) {
+    little = true;
+  } else if (tiff[0] === 77 && tiff[1] === 77) {
+    little = false;
+  } else {
+    return 1;
+  }
+  const number = (offset, size) => offset >= 0 && size <= tiff.length && offset <= tiff.length - size ? numberAt(tiff, offset, size, little) : null;
+  const directory = number(4, 4);
+  const count = directory === null ? null : number(directory, 2);
+  if (number(2, 2) !== 42 || directory === null || count === null) {
+    return 1;
+  }
+  for (let entry = directory + 2; entry < directory + 2 + count * 12; entry += 12) {
+    const tag = number(entry, 2);
+    if (tag === null) {
+      return 1;
+    }
+    if (tag === 274) {
+      const value = number(entry + 8, 2);
+      if (number(entry + 2, 2) !== 3 || number(entry + 4, 4) !== 1 || value === null || value < 1 || value > 8) {
+        return 1;
+      }
+      return value;
+    }
+  }
+  return 1;
+}
+function orientationOnly(orientation) {
+  const block = new Uint8Array([
+    77,
+    77,
+    0,
+    42,
+    0,
+    0,
+    0,
+    8,
+    0,
+    1,
+    1,
+    18,
+    0,
+    3,
+    0,
+    0,
+    0,
+    1,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0
+  ]);
+  block[19] = orientation;
+  return block;
+}
+function crc32(bytes) {
+  let crc = 4294967295;
+  for (const byte of bytes) {
+    crc = (crcTable()[(crc ^ byte) & 255] ?? 0) ^ crc >>> 8;
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+var crcEntries;
+function crcTable() {
+  if (crcEntries === void 0) {
+    crcEntries = new Uint32Array(256);
+    for (let index = 0; index < 256; index += 1) {
+      let crc = index;
+      for (let bit = 0; bit < 8; bit += 1) {
+        crc = crc & 1 ? 3988292384 ^ crc >>> 1 : crc >>> 1;
+      }
+      crcEntries[index] = crc >>> 0;
+    }
+  }
+  return crcEntries;
+}
+var ascii2 = (text) => new TextEncoder().encode(text);
+var EXIF_HEADER = Uint8Array.of(69, 120, 105, 102, 0, 0);
+function startsWith2(bytes, prefix, at = 0) {
+  if (bytes.length - at < prefix.length) {
+    return false;
+  }
+  for (let index = 0; index < prefix.length; index += 1) {
+    if (bytes[at + index] !== prefix[index]) {
+      return false;
+    }
+  }
+  return true;
+}
+function typeAt(bytes, at) {
+  return String.fromCharCode(bytes[at] ?? 0, bytes[at + 1] ?? 0, bytes[at + 2] ?? 0, bytes[at + 3] ?? 0);
+}
+function numberAt(bytes, at, size, little = false) {
+  let value = 0;
+  for (let index = 0; index < size; index += 1) {
+    value = value * 256 + (bytes[at + (little ? size - 1 - index : index)] ?? 0);
+  }
+  return value;
+}
+function bigEndian(value, size) {
+  return Array.from({ length: size }, (_, index) => value >>> (size - 1 - index) * 8 & 255);
+}
+function littleEndian(value, size) {
+  return Array.from({ length: size }, (_, index) => value >>> index * 8 & 255);
+}
+var Kept = class {
+  buffer;
+  length = 0;
+  constructor(capacity) {
+    this.buffer = new Uint8Array(Math.max(capacity, 64));
+  }
+  add(piece) {
+    if (this.length + piece.length > this.buffer.length) {
+      const grown = new Uint8Array(Math.max(this.buffer.length * 2, this.length + piece.length));
+      grown.set(this.buffer.subarray(0, this.length));
+      this.buffer = grown;
+    }
+    this.buffer.set(piece, this.length);
+    this.length += piece.length;
+  }
+  /** Writes `piece` over what was kept from `at` on, as a size once what it measures is kept. */
+  set(at, piece) {
+    this.buffer.set(piece, at);
+  }
+  get bytes() {
+    return this.buffer.subarray(0, this.length);
+  }
+};
+function jpegWithoutMetadata(bytes) {
+  if (bytes[0] !== 255 || bytes[1] !== 216) {
+    return null;
+  }
+  const kept = new Kept(bytes.length);
+  kept.add([255, 216]);
+  let at = 2;
+  let orientationKept = false;
+  for (; ; ) {
+    if (at + 1 >= bytes.length || bytes[at] !== 255) {
+      return null;
+    }
+    const marker = bytes[at + 1] ?? 0;
+    if (marker === 255) {
+      at += 1;
+      continue;
+    }
+    if (marker === 0 || marker >= 2 && marker <= 191 || marker === 216 || marker === 217) {
+      return null;
+    }
+    if (marker === 1 || marker >= 208 && marker <= 215) {
+      kept.add([255, marker]);
+      at += 2;
+      continue;
+    }
+    if (at + 4 > bytes.length) {
+      return null;
+    }
+    const length = numberAt(bytes, at + 2, 2);
+    const end = at + 2 + length;
+    if (length < 2 || end > bytes.length) {
+      return null;
+    }
+    const payload = bytes.subarray(at + 4, end);
+    if (marker === 224) {
+      if (startsWith2(payload, JFIF) && payload.length >= 14) {
+        kept.add([255, 224, 0, 16]);
+        kept.add(payload.subarray(0, 12));
+        kept.add([0, 0]);
+      }
+    } else if (marker === 225) {
+      if (startsWith2(payload, EXIF_HEADER) && !orientationKept) {
+        orientationKept = true;
+        const orientation = exifOrientation(payload.subarray(EXIF_HEADER.length));
+        if (orientation !== 1) {
+          const exif = orientationOnly(orientation);
+          kept.add([255, 225, ...bigEndian(EXIF_HEADER.length + exif.length + 2, 2)]);
+          kept.add(EXIF_HEADER);
+          kept.add(exif);
+        }
+      }
+    } else if (marker === 226 && startsWith2(payload, ICC_PROFILE) || marker === 238 && startsWith2(payload, ADOBE) || // A frame, its tables, a scan, and their kin, JPEG-LS's frame and parameters among them.
+    marker >= 192 && marker <= 207 && marker !== 200 || marker >= 218 && marker <= 223 || marker === 247 || marker === 248) {
+      kept.add(bytes.subarray(at, end));
+    }
+    at = end;
+    if (marker !== 218) {
+      continue;
+    }
+    const scan = at;
+    for (; ; ) {
+      const next = bytes.indexOf(255, at);
+      if (next === -1 || next + 1 >= bytes.length) {
+        return null;
+      }
+      at = next;
+      const after = bytes[at + 1] ?? 0;
+      if (after !== 0 && after !== 255 && !(after >= 208 && after <= 215)) {
+        break;
+      }
+      at += 1;
+    }
+    kept.add(bytes.subarray(scan, at));
+    if (bytes[at + 1] === 217) {
+      kept.add([255, 217]);
+      return kept.bytes;
+    }
+  }
+}
+var JFIF = Uint8Array.of(74, 70, 73, 70, 0);
+var ICC_PROFILE = ascii2("ICC_PROFILE\0");
+var ADOBE = ascii2("Adobe");
+var PNG_DRAWING_CHUNKS = /* @__PURE__ */ new Set([
+  "IHDR",
+  "PLTE",
+  "IDAT",
+  "IEND",
+  "tRNS",
+  "cHRM",
+  "gAMA",
+  "iCCP",
+  "sBIT",
+  "sRGB",
+  "cICP",
+  "mDCV",
+  "cLLI",
+  "bKGD",
+  "hIST",
+  "pHYs",
+  "sPLT",
+  "acTL",
+  "fcTL",
+  "fdAT"
+]);
+function pngWithoutMetadata(bytes) {
+  const kept = new Kept(bytes.length);
+  kept.add(bytes.subarray(0, 8));
+  let at = 8;
+  let orientationKept = false;
+  while (at + 12 <= bytes.length) {
+    const length = numberAt(bytes, at, 4);
+    const type = typeAt(bytes, at + 4);
+    if (length > bytes.length - at - 12) {
+      return null;
+    }
+    const end = at + 12 + length;
+    if (PNG_DRAWING_CHUNKS.has(type)) {
+      kept.add(bytes.subarray(at, end));
+    } else if (type === "eXIf" && !orientationKept) {
+      orientationKept = true;
+      const orientation = exifOrientation(bytes.subarray(at + 8, at + 8 + length));
+      if (orientation !== 1) {
+        const data = new Uint8Array([...ascii2("eXIf"), ...orientationOnly(orientation)]);
+        kept.add(bigEndian(data.length - 4, 4));
+        kept.add(data);
+        kept.add(bigEndian(crc32(data), 4));
+      }
+    }
+    if (type === "IEND") {
+      return kept.bytes;
+    }
+    at = end;
+  }
+  return null;
+}
+var GIF_PLAYING_APPLICATIONS = [
+  "NETSCAPE2.0",
+  "ANIMEXTS1.0",
+  "ICCRGBG1012"
+].map(ascii2);
+function gifColourTable(packed) {
+  return packed & 128 ? 3 << (packed & 7) + 1 : 0;
+}
+function gifWithoutMetadata(bytes) {
+  const subBlocksEnd = (start) => {
+    let at2 = start;
+    while (at2 < bytes.length) {
+      const size = bytes[at2] ?? 0;
+      if (size === 0) {
+        return at2 + 1;
+      }
+      at2 += 1 + size;
+    }
+    return null;
+  };
+  if (bytes.length < 13) {
+    return null;
+  }
+  let at = 13 + gifColourTable(bytes[10] ?? 0);
+  if (at > bytes.length) {
+    return null;
+  }
+  const kept = new Kept(bytes.length);
+  kept.add(bytes.subarray(0, at));
+  while (at < bytes.length) {
+    switch (bytes[at]) {
+      case 44: {
+        if (at + 10 > bytes.length) {
+          return null;
+        }
+        const data = at + 10 + gifColourTable(bytes[at + 9] ?? 0);
+        const end = data < bytes.length ? subBlocksEnd(data + 1) : null;
+        if (end === null) {
+          return null;
+        }
+        kept.add(bytes.subarray(at, end));
+        at = end;
+        break;
+      }
+      case 33: {
+        const end = at + 2 < bytes.length ? subBlocksEnd(at + 2) : null;
+        if (end === null) {
+          return null;
+        }
+        const label = bytes[at + 1];
+        const plays = label === 255 && bytes[at + 2] === 11 && end >= at + 14 && GIF_PLAYING_APPLICATIONS.some((name) => startsWith2(bytes, name, at + 3));
+        if (label === 249 || label === 1 || plays) {
+          kept.add(bytes.subarray(at, end));
+        }
+        at = end;
+        break;
+      }
+      case 59:
+        kept.add([59]);
+        return kept.bytes;
+      default:
+        return null;
+    }
+  }
+  return null;
+}
+var WEBP_DRAWING_CHUNKS = /* @__PURE__ */ new Set([
+  "VP8X",
+  "ICCP",
+  "ANIM",
+  "ANMF",
+  "ALPH",
+  "VP8 ",
+  "VP8L"
+]);
+function webpWithoutMetadata(bytes) {
+  if (bytes.length < 12) {
+    return null;
+  }
+  const end = 8 + numberAt(bytes, 4, 4, true);
+  const chunks = end >= 12 && end <= bytes.length ? webpChunks(bytes.subarray(12, end)) : null;
+  if (chunks === null || chunks.length === 0) {
+    return null;
+  }
+  const kept = new Kept(chunks.length + 12);
+  kept.add(ascii2("RIFF"));
+  kept.add(littleEndian(chunks.length + 4, 4));
+  kept.add(ascii2("WEBP"));
+  kept.add(chunks);
+  const image = kept.bytes;
+  if (image.length > 20 && typeAt(image, 12) === "VP8X" && numberAt(image, 16, 4, true) > 0) {
+    const exif = webpChunkTypes(image.subarray(12)).includes("EXIF");
+    image[20] = (image[20] ?? 0) & ~12 | (exif ? 8 : 0);
+  }
+  return image;
+}
+function webpChunks(chunks) {
+  const kept = new Kept(chunks.length);
+  const frames = [];
+  let end = chunks.length;
+  let at = 0;
+  let orientationKept = false;
+  for (; ; ) {
+    if (at >= end) {
+      const frame = frames.pop();
+      if (frame === void 0) {
+        return kept.bytes;
+      }
+      kept.set(frame.size, littleEndian(kept.length - frame.size - 4, 4));
+      at = frame.resume;
+      end = frames.at(-1)?.end ?? chunks.length;
+      continue;
+    }
+    if (end - at < 8) {
+      return null;
+    }
+    const type = typeAt(chunks, at);
+    const size = numberAt(chunks, at + 4, 4, true);
+    if (size > end - at - 8) {
+      return null;
+    }
+    const data = at + 8;
+    at = Math.min(data + size + size % 2, end);
+    if (type === "ANMF") {
+      if (size < 16) {
+        return null;
+      }
+      frames.push({ end: data + size, resume: at, size: kept.length + 4 });
+      kept.add(chunks.subarray(data - 8, data + 16));
+      at = data + 16;
+      end = data + size;
+    } else if (WEBP_DRAWING_CHUNKS.has(type)) {
+      kept.add(chunks.subarray(data - 8, data + size));
+      if (size % 2 === 1) {
+        kept.add([0]);
+      }
+    } else if (type === "EXIF" && frames.length === 0 && !orientationKept) {
+      orientationKept = true;
+      const turned = exifOrientation(chunks.subarray(data, data + size));
+      if (turned !== 1) {
+        const exif = orientationOnly(turned);
+        kept.add(ascii2(type));
+        kept.add(littleEndian(exif.length, 4));
+        kept.add(exif);
+      }
+    }
+  }
+}
+function webpChunkTypes(chunks) {
+  const types = [];
+  let at = 0;
+  while (chunks.length - at >= 8) {
+    types.push(typeAt(chunks, at));
+    const size = numberAt(chunks, at + 4, 4, true);
+    at += 8 + size + size % 2;
+  }
+  return types;
+}
+
 // packages/board-core/dist/moves.js
 import { mkdir as mkdir4, rm as rm2 } from "node:fs/promises";
 import path5 from "node:path";
@@ -3604,6 +4093,72 @@ function tokenUse(events, window, now) {
   };
 }
 
+// packages/board-core/dist/turn-counters.js
+var TOKEN_KINDS = ["input", "output", "cache_read", "cache_write"];
+var USAGE_FIELD = {
+  input: "inputTokens",
+  output: "outputTokens",
+  cache_read: "cacheReadTokens",
+  cache_write: "cacheWriteTokens"
+};
+var UNKNOWN_LABEL = "unknown";
+function byKey(entries) {
+  return [...entries].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, series]) => series);
+}
+var TurnCounters = class {
+  cliOf;
+  tokens = /* @__PURE__ */ new Map();
+  turns = /* @__PURE__ */ new Map();
+  /**
+   * `cliOf` names a citizen's CLI for an end logged before ends named theirs: a turn runs on the
+   * CLI its citizen's record names, which nothing changes after the citizen is added.
+   */
+  constructor(cliOf) {
+    this.cliOf = cliOf;
+  }
+  /** Counts a turn's end, `turn.completed` or `turn.failed`, and passes over any other event. */
+  add(event) {
+    if (event.type !== "turn.completed" && event.type !== "turn.failed") {
+      return;
+    }
+    const turn = TurnHistoryPayloadSchema.safeParse(event.payload);
+    if (!turn.success) {
+      return;
+    }
+    const agent = event.actor;
+    const outcome = event.type === "turn.failed" ? "failed" : "completed";
+    const trigger = turn.data.trigger;
+    const counted = JSON.stringify([agent, outcome, trigger]);
+    this.turns.set(counted, {
+      agent,
+      outcome,
+      trigger,
+      turns: (this.turns.get(counted)?.turns ?? 0) + 1
+    });
+    const usage = turn.data.usage;
+    if (usage === void 0) {
+      return;
+    }
+    const named = CliKindSchema.safeParse(event.payload["cli"]);
+    const cli = (named.success ? named.data : this.cliOf(agent)) ?? UNKNOWN_LABEL;
+    const model = turn.data.model ?? UNKNOWN_LABEL;
+    for (const kind of TOKEN_KINDS) {
+      const key = JSON.stringify([agent, cli, model, kind]);
+      this.tokens.set(key, {
+        agent,
+        cli,
+        model,
+        kind,
+        tokens: (this.tokens.get(key)?.tokens ?? 0) + usage[USAGE_FIELD[kind]]
+      });
+    }
+  }
+  /** The counts so far, in an order that holds from one read to the next. */
+  read() {
+    return { tokens: byKey(this.tokens), turns: byKey(this.turns) };
+  }
+};
+
 // packages/board-core/dist/mutex.js
 var Mutex = class {
   tail = Promise.resolve();
@@ -3963,6 +4518,7 @@ function hashToken(token) {
 // packages/board-core/dist/board.js
 var SYSTEM_ACTOR = { name: "board", role: USER_ROLE };
 var CLOSING_ATTEMPTS = 3;
+var CHANNEL_POST_WAIT_MS = 24 * 36e5;
 function ownTurn(actor, turn) {
   return turn.agent === actor.name && turn.scope === actor.scope && turn.thread === actor.thread && turn.channel === actor.channel && turn.place === actor.place;
 }
@@ -4086,8 +4642,10 @@ function plain(value) {
     return "";
   return JSON.stringify(value);
 }
-function sentence(summary) {
-  return summary.trim().replace(/\.+$/, "");
+var SENTENCE_END = /[.…?!]["'”’»)\]}*_]*$/u;
+function asSentence(text) {
+  const trimmed = text.trim();
+  return SENTENCE_END.test(trimmed) ? trimmed : `${trimmed}.`;
 }
 function skillSummary(data, body) {
   const description = data["description"];
@@ -5275,10 +5833,13 @@ ${DASHBOARD_LINE}
    * when it mentions the user, so the creator can put a wait on the user in; a post that asks the
    * reader counts wherever it is. A closed thread counts for nothing: its conversation has ended,
    * and a turn there could only read its posts and be refused a reply, while a wake queued before
-   * it closed, as for a mention, still runs there.
+   * it closed, as for a mention, still runs there. A top-level post in a project's channel, general
+   * or a workstream's, counts only for a reader it asks until it is `channelPostWaitMs` old, and
+   * then for every reader who has not read it, so a turn there for anything else reads it sooner.
    */
-  async unreadByConversation(actor) {
+  async unreadByConversation(actor, options = {}) {
     const { cursors, upto } = await this.digestSnapshot(actor.name);
+    const waited = this.now().getTime() - (options.channelPostWaitMs ?? CHANNEL_POST_WAIT_MS);
     const counts = /* @__PURE__ */ new Map();
     const threadCounts = /* @__PURE__ */ new Map();
     const unscoped = { name: actor.name, role: actor.role };
@@ -5286,11 +5847,15 @@ ${DASHBOARD_LINE}
       if (news === true || message.step !== void 0 || message.author === SYSTEM_ACTOR.name || message.notice?.kind === "knowledge") {
         continue;
       }
-      const posted = parseChannelRef(message.channel).project ?? SOCIETY_SCOPE;
+      const project = parseChannelRef(message.channel).project;
+      const posted = project ?? SOCIETY_SCOPE;
       if (posted !== scope && scope !== SOCIETY_SCOPE) {
         continue;
       }
       const thread = threadOfPart(part);
+      if (thread === void 0 && project !== null && asked !== true && Date.parse(message.ts) > waited) {
+        continue;
+      }
       if (thread !== void 0) {
         let counted = threadCounts.get(thread);
         if (counted === void 0) {
@@ -5671,7 +6236,7 @@ ${current.body}`);
         name: args.name,
         reason: args.reason
       });
-      await this.appendMessage(SYSTEM_ACTOR.name, "general", `Skill ${args.name} removed from the society by ${actor.name}: ${sentence(withoutMentions(args.reason))}. Every citizen's skills index stops listing it from its next turn.`);
+      await this.appendMessage(SYSTEM_ACTOR.name, "general", `Skill ${args.name} removed from the society by ${actor.name}: ${asSentence(withoutMentions(args.reason))} Every citizen's skills index stops listing it from its next turn.`);
       return removed;
     });
   }
@@ -5714,9 +6279,9 @@ ${current.body}`);
   /**
    * Keeps an image a citizen's turn names by its path, read on the runner the turn runs on, which
    * refuses a file outside the turn's worktree, the citizen's home, and the system temp folder.
-   * Only the bytes of a PNG, JPEG, GIF, or WebP of at most `IMAGE_LIMIT_BYTES` are kept, checked
-   * here again whatever the runner said, under a new id outside the projection, so no runner
-   * mirrors them and no prompt carries them: a post shows the image by its `image:` address.
+   * Only a PNG, JPEG, GIF, or WebP of at most `IMAGE_LIMIT_BYTES` is kept, checked here again
+   * whatever the runner said, without its metadata, under a new id outside the projection, so no
+   * runner mirrors it and no prompt carries it: a post shows the image by its `image:` address.
    */
   async uploadImage(actor, input) {
     const args = VerbInputs.upload_image.parse(input);
@@ -5742,8 +6307,13 @@ ${current.body}`);
   }
   /**
    * Keeps `bytes` under a new id when they are a PNG, JPEG, GIF, or WebP of at most
-   * `IMAGE_LIMIT_BYTES`, and answers the markdown that shows them, described by `name`. `what`
-   * names the image in a refusal.
+   * `IMAGE_LIMIT_BYTES` that reads to its end, without its metadata (`withoutMetadata`), and
+   * answers the markdown that shows it, described by `name`. `what` names the image in a refusal.
+   * The limit is for the bytes as they came, as the route's body cap measures them, and bounds
+   * what is read; what is kept is checked against it too, since an orientation written smaller
+   * than the board writes it grows by a few bytes. The runner, the web's composer, and the app
+   * strip an image before they send it, and stripping it again changes nothing, but an older
+   * runner, page, or app sends one as it was.
    */
   async keepImage(actor, bytes, what, name) {
     const type = imageTypeOf(bytes);
@@ -5753,19 +6323,26 @@ ${current.body}`);
     if (bytes.byteLength > IMAGE_LIMIT_BYTES) {
       throw new BoardError("VALIDATION", `${what} is ${bytes.byteLength} bytes, over the ${IMAGE_LIMIT_BYTES} an image may be`);
     }
+    const kept = withoutMetadata(bytes);
+    if (kept === null) {
+      throw new BoardError("VALIDATION", `${what} does not read to its end as a ${IMAGE_KIND_NAMES[type]}, so its metadata cannot be told from its picture; save it again and send that copy`);
+    }
+    if (kept.byteLength > IMAGE_LIMIT_BYTES) {
+      throw new BoardError("VALIDATION", `${what} is ${kept.byteLength} bytes without its metadata, over the ${IMAGE_LIMIT_BYTES} an image may be`);
+    }
     return this.mutex.run(async () => {
       const id = this.newId();
-      await writeFileAtomic(this.paths.image(id), bytes);
+      await writeFileAtomic(this.paths.image(id), kept);
       await this.events.append("image.uploaded", actor.name, {
         id,
         type,
-        size: bytes.byteLength
+        size: kept.byteLength
       });
       const description = imageDescription(name);
       return {
         id,
         type,
-        size: bytes.byteLength,
+        size: kept.byteLength,
         markdown: `![${description}](${IMAGE_SCHEME}${id})`
       };
     });
@@ -6741,7 +7318,7 @@ ${args.summary}`);
       });
       const thread = await this.openThreadUnlocked(actor.name, this.proposalThreadOpening(proposal));
       const rationale = args.rationale.trim();
-      await this.appendThreadMessage(actor.name, thread.id, `Proposal ${proposal.id}: ${describeCharter(proposal.kind, proposal.charter)}.${rationale.length === 0 ? "" : `
+      await this.appendThreadMessage(actor.name, thread.id, `Proposal ${proposal.id}: ${asSentence(describeCharter(proposal.kind, proposal.charter))}${rationale.length === 0 ? "" : `
 
 ${rationale}`}`);
       return proposal;
@@ -7066,6 +7643,39 @@ ${rationale}`}`);
     const events = await this.events.readSince(null, Number.MAX_SAFE_INTEGER);
     return tokenUse(events, window, this.now());
   }
+  /**
+   * Every finished turn counted for Prometheus: seeded once from the whole event log, then moved
+   * by each turn's end this process appends, so reading the counts never reads the log. The server
+   * logs every turn's end itself; one another process appended would count from the next seed.
+   */
+  async countTurns() {
+    const clis = /* @__PURE__ */ new Map();
+    const counters = new TurnCounters((agent) => clis.get(agent) ?? null);
+    let waiting = [];
+    this.events.onAppend((event) => {
+      if (waiting === null) {
+        counters.add(event);
+      } else {
+        waiting.push(event);
+      }
+    });
+    const events = await this.events.readSince(null, Number.MAX_SAFE_INTEGER);
+    for (const agent of await this.listAgents()) {
+      clis.set(agent.name, agent.cli);
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const event of events) {
+      seen.add(event.id);
+      counters.add(event);
+    }
+    for (const event of waiting) {
+      if (!seen.has(event.id)) {
+        counters.add(event);
+      }
+    }
+    waiting = null;
+    return counters;
+  }
   /** The board actions a finished turn took, from its transcript; null when it kept none. */
   async turnActions(agent, turnId) {
     const known = this.actionCounts.get(turnId);
@@ -7263,6 +7873,7 @@ ${rationale}`}`);
         trigger: parsed.trigger.kind,
         ...parsed.trigger.heartbeat === void 0 ? {} : { heartbeat: parsed.trigger.heartbeat },
         session: parsed.session,
+        cli: parsed.cli,
         exitReason: parsed.exitReason,
         costUsd: parsed.costUsd,
         ...parsed.usage === null ? {} : { usage: parsed.usage },
@@ -7445,7 +8056,7 @@ ${rationale}`}`);
       const ts = this.now().toISOString();
       const landed = current.onDone !== "none";
       if (landed) {
-        await this.postTaskNote(actor.name, current, input.ok ? `${sentence(input.detail)}.` : `Landing failed: ${sentence(input.detail)}. The task waits at its last stage for its participants to reshape the plan.`, input.ok ? { action: "landed", stage: current.stage, to: null } : { action: "reopened", stage: current.stage, to: current.stage });
+        await this.postTaskNote(actor.name, current, input.ok ? asSentence(input.detail) : `Landing failed: ${asSentence(input.detail)} The task waits at its last stage for its participants to reshape the plan.`, input.ok ? { action: "landed", stage: current.stage, to: null } : { action: "reopened", stage: current.stage, to: current.stage });
       }
       if (input.ok) {
         const task2 = await this.writeEndedTask(actor.name, location.project, {
@@ -7465,7 +8076,7 @@ ${rationale}`}`);
           await this.refreshMember(name);
         }
         if (landed) {
-          await this.appendMessage(actor.name, channelRef(location.project, task2.channel), `Task ${task2.id} "${task2.title}" is done: ${sentence(input.detail)}.`);
+          await this.appendMessage(actor.name, channelRef(location.project, task2.channel), `Task ${task2.id} "${task2.title}" is done: ${asSentence(input.detail)}`);
         }
         return task2;
       }
@@ -8176,7 +8787,7 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
       files: taken.files.length,
       ...meta
     });
-    await this.appendMessage(SYSTEM_ACTOR.name, "general", `Skill ${skill.name} ${replaced ? "updated in" : "promoted to"} the society: ${sentence(skill.summary)}. Every citizen's skills index now lists it.`);
+    await this.appendMessage(SYSTEM_ACTOR.name, "general", `Skill ${skill.name} ${replaced ? "updated in" : "promoted to"} the society: ${asSentence(skill.summary)} Every citizen's skills index now lists it.`);
     return replaced;
   }
   /**
@@ -8423,7 +9034,7 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
     });
     const purpose = withoutMentions(input.purpose);
     await this.appendMessage(SYSTEM_ACTOR.name, ref, `Channel ${ref} opened: ${purpose}`);
-    await this.appendMessage(SYSTEM_ACTOR.name, channelRef(input.project, "general"), `Channel ${ref} opened by ${by}: ${purpose}. Subscribe to it to follow its posts; its tasks and mentions reach whoever they concern either way.`);
+    await this.appendMessage(SYSTEM_ACTOR.name, channelRef(input.project, "general"), `Channel ${ref} opened by ${by}: ${asSentence(purpose)} Subscribe to it to follow its posts; its tasks and mentions reach whoever they concern either way.`);
     return ref;
   }
   /**
@@ -8846,17 +9457,18 @@ ${charter.purpose}
     return kept > lease ? new Date(kept).toISOString() : null;
   }
   /**
-   * The lease a holder keeps while the user's pause holds its turns in the task's project
-   * (`heldOn`), when later than the one it has, else null. It is renewed for a full lease once less
-   * than half is left, as for a pending cron, so it never lapses while the holder cannot take a
-   * turn there, and after the resume the holder has at least half a lease to come back to it.
+   * The lease a holder keeps while the user's pause, or its CLI's limit, holds its turns in the
+   * task's project (`heldOn`), when later than the one it has, else null. It is renewed for a full
+   * lease once less than half is left, as for a pending cron, so it never lapses while the holder
+   * cannot take a turn there, and after the resume or the reset the holder has at least half a
+   * lease to come back to it.
    */
   async pausedLease(task, runners2, runner, now) {
     if (task.claimedBy === void 0 || task.leaseExpiresAt === void 0) {
       return null;
     }
     const holder = await this.readAgent(task.claimedBy).catch(() => null);
-    if (holder === null || !heldOn(runners2, runner, holder.cli)) {
+    if (holder === null || !heldOn(runners2, runner, holder.cli, now)) {
       return null;
     }
     const lease = Date.parse(task.leaseExpiresAt);
@@ -8947,9 +9559,9 @@ ${charter.purpose}
       });
     }
     const verdict = outcome === "approved" ? "Approved" : "Rejected";
-    const why = reason === void 0 ? "" : ` Reason: ${reason}.`;
+    const why = reason === void 0 ? "" : ` Reason: ${asSentence(reason)}`;
     const result = provision === void 0 ? "" : ` Provisioned: ${Object.entries(provision).map(([key, value]) => `${key} ${plain(value)}`).join(", ")}.`;
-    const post = `${verdict}: ${describeCharter(proposal.kind, proposal.charter)}.${why}${result}`;
+    const post = `${verdict}: ${asSentence(describeCharter(proposal.kind, proposal.charter))}${why}${result}`;
     await this.appendThreadMessage(actor.name, thread.id, actor.name === SYSTEM_ACTOR.name ? withoutMentions(post) : post, { step: { action: outcome } });
     await this.endThreadOf(proposalId, actor.name, outcome);
     return decision;
@@ -9197,6 +9809,7 @@ var DEFAULT_TIMINGS = Object.freeze({
   debounceMs: 3e4,
   userDebounceMs: 5e3,
   heartbeatMs: 15 * 6e4,
+  channelPostWaitMs: CHANNEL_POST_WAIT_MS,
   waitingStageMs: 10 * 6e4,
   leaseSweepMs: 6e4,
   opsIntervalMs: 5 * 6e4,
@@ -9216,6 +9829,7 @@ var SchedulerTimingsSchema = z17.object({
   debounceMs: z17.number().nonnegative(),
   userDebounceMs: z17.number().nonnegative(),
   heartbeatMs: z17.number().positive(),
+  channelPostWaitMs: z17.number().nonnegative(),
   waitingStageMs: z17.number().positive(),
   leaseSweepMs: z17.number().positive(),
   opsIntervalMs: z17.number().positive(),
@@ -9284,10 +9898,14 @@ var StateSchema = z17.object({
   /** When each member last reflected, or was first seen; the cadence counts from here. */
   lastReflection: z17.record(z17.string(), z17.string()).default({}),
   /**
-   * The home session each society member last asked for an early reflection for, once per
-   * session, and whether that reflection still waits to be queued.
+   * The session each home last asked for an early reflection for, once per session, by the home's
+   * `sessionKey`, and whether that reflection still waits to be queued. A key of a member's name
+   * alone, kept before a project's homes asked, is its society home.
    */
-  earlyReflection: z17.record(z17.string(), z17.object({ session: z17.string(), due: z17.boolean() })).default({})
+  earlyReflection: z17.record(z17.string(), z17.object({ session: z17.string(), due: z17.boolean() })).default({}).transform((early) => Object.fromEntries(Object.entries(early).map(([key, asked]) => [
+    key.includes("/") ? key : sessionKey(key, SOCIETY_SCOPE),
+    asked
+  ])))
 });
 function messageOf(trigger) {
   return trigger.kind === "mention" || trigger.kind === "user_post" ? trigger.messageId : void 0;
@@ -9376,7 +9994,7 @@ var Scheduler = class {
   sweeping = /* @__PURE__ */ new Set();
   /** Crons whose fire's turn is running; a cron's next time passes while one is. */
   cronsInFlight = /* @__PURE__ */ new Set();
-  /** Turns in a row the model service turned away, by session key, which `retryRefused` counts. */
+  /** Turns in a row that failed for now, by session key, which `retryRefused` counts. */
   refused = /* @__PURE__ */ new Map();
   state = StateSchema.parse({
     cursor: null,
@@ -10236,7 +10854,9 @@ var Scheduler = class {
           continue;
         }
         this.state.lastHeartbeat[cadence] = iso(now);
-        unread ??= await this.board.unreadByConversation(actor);
+        unread ??= await this.board.unreadByConversation(actor, {
+          channelPostWaitMs: this.timings.channelPostWaitMs
+        });
         held ??= await this.board.heldClaims(agent.name);
         pendingCrons ??= (await this.board.listCrons()).filter((cron) => cronStoppedAt(cron) === null);
         const crons = pendingCrons;
@@ -10377,18 +10997,20 @@ var Scheduler = class {
     }
   }
   /**
-   * A society role's home session that a turn left at `sessionCapTokens` or more, by its latest
-   * model call, asks for a reflection ahead of the cadence, which `checkReflections` queues once
-   * none of the member's turns is queued or running; the reflection's end starts the home afresh
+   * A home session that a turn left at `sessionCapTokens` or more, by its latest model call, asks
+   * for a reflection ahead of the cadence, which `checkReflections` queues in that home once none
+   * of the member's turns is queued or running: a society role's home in the society scope, and
+   * the home of a project's member whose role reflects. The reflection's end starts the home afresh
    * (`TurnHost`), so its history goes only once a reflection saved what to keep. A session asks
    * once, so a reflection that fails leaves the next to the cadence, and none asks while a
-   * reflection is queued or running.
+   * reflection is queued or running in its home.
    */
   async checkSessionSize(event) {
     const { payload } = event;
     const tokens = payload["contextTokens"];
     const session = stringOf(payload["session"]);
-    if (typeof tokens !== "number" || tokens < this.timings.sessionCapTokens || session === null || payload["project"] !== SOCIETY_SCOPE || payload["thread"] !== void 0 || payload["channel"] !== void 0 || payload["place"] !== void 0 || payload["trigger"] === "reflection" || payload["sessionDropped"] === true) {
+    const project = stringOf(payload["project"]);
+    if (typeof tokens !== "number" || tokens < this.timings.sessionCapTokens || session === null || project === null || payload["thread"] !== void 0 || payload["channel"] !== void 0 || payload["place"] !== void 0 || payload["trigger"] === "reflection" || payload["sessionDropped"] === true) {
       return;
     }
     const agent = await this.tryReadAgent(event.actor);
@@ -10396,24 +11018,33 @@ var Scheduler = class {
       return;
     }
     const charter = await this.board.readRole(agent.role).catch(() => null);
-    if (charter === null || !charter.societyScope || !charter.reflects) {
+    if (charter === null || !charter.reflects || !this.isHome(agent, charter, project)) {
       return;
     }
-    if (this.state.earlyReflection[agent.name]?.session === session) {
+    const home = sessionKey(agent.name, project);
+    if (this.state.earlyReflection[home]?.session === session) {
       return;
     }
-    const ofAgent = (key) => parseSessionKey(key)?.agent === agent.name;
-    const reflecting = [...this.pending].some(([key, item]) => ofAgent(key) && item.dispatch.trigger.kind === "reflection") || [...this.exclusive].some(([key, kind]) => ofAgent(key) && kind === "reflection");
+    const reflecting = this.pending.get(home)?.dispatch.trigger.kind === "reflection" || this.exclusive.get(home) === "reflection";
     if (reflecting) {
       return;
     }
-    this.state.earlyReflection[agent.name] = { session, due: true };
-    this.log.info({ agent: agent.name, contextTokens: tokens, cap: this.timings.sessionCapTokens }, "home session past the cap; a reflection is due");
+    delete this.state.earlyReflection[home];
+    this.state.earlyReflection[home] = { session, due: true };
+    this.log.info({ agent: agent.name, project, contextTokens: tokens, cap: this.timings.sessionCapTokens }, "home session past the cap; a reflection is due");
+  }
+  /**
+   * Whether a member's home in a scope starts afresh after a reflection, as `TurnHost` decides: a
+   * society role's in the society scope, and its own in each project it belongs to.
+   */
+  isHome(agent, charter, scope) {
+    return scope === SOCIETY_SCOPE ? charter.societyScope : agent.memberships.includes(scope);
   }
   /**
    * Every `reflectionMs`, a member whose charter reflects takes a reflection turn in the scope of
-   * its latest working turn, unless it has not worked since its last reflection; a society member
-   * whose home session passed the cap takes one in its home ahead of the cadence, which restarts it.
+   * its latest working turn, unless it has not worked since its last reflection; a member one of
+   * whose homes passed the cap takes one in that home ahead of the cadence, which restarts it, one
+   * home at a time, in the order they asked.
    */
   async checkReflections(now) {
     for (const agent of await this.board.listAgents()) {
@@ -10424,12 +11055,18 @@ var Scheduler = class {
       if (!charter.reflects) {
         continue;
       }
-      const early = this.state.earlyReflection[agent.name];
-      if (early?.due === true) {
+      const due = Object.entries(this.state.earlyReflection).filter(([key, early]) => early.due && parseSessionKey(key)?.agent === agent.name);
+      if (due.length > 0) {
         if (!this.busy(agent.name)) {
-          this.state.lastReflection[agent.name] = iso(now);
-          this.state.earlyReflection[agent.name] = { ...early, due: false };
-          this.enqueue(agent.name, SOCIETY_SCOPE, { kind: "reflection", reason: "home session past the cap" }, now);
+          for (const [key, early] of due) {
+            this.state.earlyReflection[key] = { ...early, due: false };
+            const scope = parseSessionKey(key)?.scope;
+            if (scope !== void 0 && this.isHome(agent, charter, scope)) {
+              this.state.lastReflection[agent.name] = iso(now);
+              this.enqueue(agent.name, scope, { kind: "reflection", reason: "home session past the cap" }, now);
+              break;
+            }
+          }
         }
         continue;
       }
@@ -10501,7 +11138,7 @@ var Scheduler = class {
         }
         members ??= await this.board.projectMembers(project.slug);
         const takers = members.filter((member) => member.cli !== null && mayHoldStage(member, task));
-        if (takers.length > 0 && takers.every((taker) => heldOn(runners2, project.runner, taker.cli))) {
+        if (takers.length > 0 && takers.every((taker) => heldOn(runners2, project.runner, taker.cli, new Date(now)))) {
           this.state.waitingHeld[key] = iso(now);
           continue;
         }
@@ -10708,7 +11345,8 @@ var Scheduler = class {
           last = Math.max(last, Date.parse(ended));
         }
       }
-      const held = heldOn(runners2, agent.homeRunner, agent.cli) || projects.some((project) => agent.memberships.includes(project.slug) && heldOn(runners2, project.runner, agent.cli));
+      const at = new Date(now);
+      const held = heldOn(runners2, agent.homeRunner, agent.cli, at) || projects.some((project) => agent.memberships.includes(project.slug) && heldOn(runners2, project.runner, agent.cli, at));
       if (held) {
         this.state.idleHeld[agent.name] = iso(now);
       }
@@ -10935,19 +11573,21 @@ var Scheduler = class {
         this.exclusive.set(key, "onboarding");
       } else if (dispatch.trigger.kind === "reflection") {
         this.exclusive.set(key, "reflection");
-        const early = this.state.earlyReflection[dispatch.agent];
+        const early = this.state.earlyReflection[key];
         if (early?.due === true) {
-          this.state.earlyReflection[dispatch.agent] = { ...early, due: false };
+          this.state.earlyReflection[key] = { ...early, due: false };
         }
       }
     }
   }
   /**
-   * A turn the model service turned away for now, overloaded or failing on its side, is sent again:
-   * the same wake in the same conversation, after the next delay of `transientRetryMs`, with every
-   * check a queued wake gets at dispatch. A wake already queued there, as a heartbeat's or a new
-   * post's, runs the conversation instead. Once the delays are spent the heartbeat takes over, and
-   * a `turn_refused` signal, which wakes nobody, says so. A turn that ends any other way ends the run.
+   * A turn that failed for now is sent again: the model service turned it away or cut it off, the
+   * runner could not reach the board before its CLI started, or its job never reached the runner.
+   * The same wake goes in the same conversation, after the next delay of `transientRetryMs`, with
+   * every check a queued wake gets at dispatch. A wake already queued there, as a heartbeat's or a
+   * new post's, runs the conversation instead. Once the delays are spent the heartbeat takes over,
+   * and a `turn_refused` signal, which wakes nobody, says so. A turn that ends any other way ends
+   * the run.
    */
   async retryRefused(key, item, record) {
     if (record.transient !== true || record.exitReason !== "error") {
@@ -10964,7 +11604,7 @@ var Scheduler = class {
       }
       const { steeredThrough: _steered, ...retry } = item;
       this.pending.set(key, { ...retry, readyAt: this.now().getTime() + delay });
-      this.log.info({ agent: dispatch.agent, project: dispatch.project, refused, delayMs: delay }, "the model service turned the turn away, sending its wake again");
+      this.log.info({ agent: dispatch.agent, project: dispatch.project, refused, delayMs: delay }, "the turn failed for now, sending its wake again");
       return;
     }
     if (refused !== this.timings.transientRetryMs.length + 1) {
@@ -10975,7 +11615,7 @@ var Scheduler = class {
     await this.board.publishSignal({
       kind: "turn_refused",
       key: `turn_refused:${key}`,
-      summary: `${dispatch.agent}'s turns in ${where} were turned away by the model service ${refused} times in a row${record.model === null ? "" : ` on ${record.model}`}, the last with "${record.error ?? "no error"}"; its heartbeat takes over`,
+      summary: `${dispatch.agent}'s turns in ${where} failed for now ${refused} times in a row${record.model === null ? "" : ` on ${record.model}`}, the last with "${record.error ?? "no error"}"; its heartbeat takes over`,
       value: refused,
       threshold: refused,
       agent: dispatch.agent,
@@ -11076,6 +11716,7 @@ var TURN_CONTRACT = [
   "- To come back to something later, set a cron with create_cron: a note on what to do then, and a five-field cron expression or one time with at. It wakes you in this conversation unless you name another, at most every fifteen minutes, and every fire is a paid turn, so end a cron with remove_cron once it has done its job. Never wait by sleeping or leaving a process running: a turn's board token ends with the turn, so nothing it leaves behind can act on the board. While you check your own stage's work on a schedule, such as a running job, CI, or a deploy, keep holding the stage: the cron sets when you check, and while it is pending in the task's thread, neither ended nor paused, with its latest fire's turn not failed or a turn of yours there completed since, the board keeps your lease and the heartbeat leaves the stage to it, waking you there only for a post you have not read. Release a stage only to hand it on, or once its task's blocked_by names the tasks it waits on: the stage then wakes nobody until the last of them ends. Any other wait on someone else, such as the user or an outside party, is a stage of its own, not a held stage. The society's crons are under society/crons/ in the board projection.",
   "- An @mention wakes the citizen named, and every wake costs a turn. Address someone with @ only when you need them to act; when you merely refer to citizens, write their names plainly. A name in a code span or a code block is no mention, so code keeps its @ as written. @user wakes nobody, since the user takes no turns; it is what puts a question before the user, so use it only when you need the user to answer or decide.",
   "- A thread is a conversation off a channel that reaches only its participants and whoever is mentioned in it. Every task has one, opened with it under the task's id on the channel of its project it was filed in, general unless it was filed in another: talk about a task there, with post_message and its thread_id, and the notes you give advance_task and update_task are posted there as you. Its participants are the task's creator, its stage holders and assignees, whoever may take the stage that waits, and anyone who posted; it closes when the task ends. In a task's thread, only the current stage's holder, or while nobody holds it whoever may take it, wakes for your post, and a post that asks the user also wakes the task's creator; mention anyone else you need, including the concierge for a plan change. Every proposal has one too, in governance, opened with its pitch and closed by its decision. Open other threads with open_thread on a channel with a title, for any other topic; close_thread posts your summary to its channel.",
+  "- A post at the top of a project's channel, general or another, wakes only whoever it mentions; everyone else reads it at their next turn there, at the latest about a day later. So mention whoever must act on it or know it soon.",
   "- To show an image in a post, such as a screenshot or a chart, save it anywhere you can read it, such as a folder from `mktemp -d`, call upload_image with its path, and put the markdown it returns in the post, `![what it shows](image:<id>)`, with what the image shows as its alt text: the board keeps the image, so it shows in any conversation after the file is gone. It takes a PNG, JPEG, GIF, or WebP of at most 8 MB from your worktree, your home, or the system temp folder. An image committed on a task's branch, linked by its path in the task's worktree, still shows in place, and so does one at an https address. Never put an image or any other file into a message as base64 or a data: URL: the board does not show it, and every reader of the conversation gets it in full in their prompt. To see an image a post, a brief, or a topic shows as `image:<id>`, call read_image with the id: it returns the path of a file of this turn's own that holds the image, removed when the turn ends, which you open with the tool that shows you an image, Read in Claude Code or view_image in Codex.",
   "- Route every lesson: about you, your craft, or the user, write it to memory/core.md in your home directory, and keep that file short by moving detail to memory/<topic>.md, your archive; how a codebase behaves (architecture, conventions, gotchas, how to build, test, and verify it) goes in its AGENTS.md or README, committed on a task's branch like any change to the code, or proposed in the task's thread or the project channel when it is outside the task at hand; a durable fact about a project as a place (runners, access, flow, where results live) goes through `write_knowledge` on that project; something the whole project should know now, post it to the project channel, and anything about one task, in the task's thread.",
   '- A procedure you have followed twice is a candidate for a skill, which it is when it makes a citizen better at a kind of work on any project: write it to skills/<name>/SKILL.md in your home, frontmatter with `name` and a one-line `description` and then the steps, and your skills index lists it from the next turn. Files the steps use, such as scripts/ and references/, go in the same folder, named in SKILL.md by paths relative to it. Propose it with kind "skill" when more than one citizen would use it and nothing in it is tied to one place; a skill only you use stays yours, however many projects you use it on.',
@@ -11227,7 +11868,11 @@ function runnerLine(runner, projects, now) {
   ].join(", ");
   const pauses = runner.clis.flatMap((cli) => {
     const pause = runner.pausedClis?.[cli];
-    return pause === void 0 ? [] : [`${cli} paused by the user since ${pause.at}`];
+    const hold = runnerLimitHold(runner, cli, now);
+    return [
+      ...pause === void 0 ? [] : [`${cli} paused by the user since ${pause.at}`],
+      ...hold === null ? [] : [`${cli} held by its limit until ${hold.until}`]
+    ];
   });
   const quotas = runner.clis.flatMap((cli) => {
     const quota = runner.quotas?.[cli];
@@ -11400,7 +12045,7 @@ function buildTurnPrompt(input) {
   }
   const machines = input.runners;
   if (machines !== void 0 && machines !== null) {
-    lines.push("", "## Runners", "", "The machines turns run on. A project lives on the runner that takes its first turn, one that offers every capability the project and that turn's task require, and moves only when the user moves it. A task's required_capabilities must name capabilities exactly as a runner below offers them; a task needing one its project's runner lacks waits. A runner's quota is what each CLI's login there last reported of its plan, in percent of each window; a CLI limited until a time fails its turns there until then. A runner, or a CLI on it, paused by the user starts none of the turns it would run until the user resumes it: they wait, and the stages their citizens hold keep their leases.", "");
+    lines.push("", "## Runners", "", "The machines turns run on. A project lives on the runner that takes its first turn, one that offers every capability the project and that turn's task require, and moves only when the user moves it. A task's required_capabilities must name capabilities exactly as a runner below offers them; a task needing one its project's runner lacks waits. A runner's quota is what each CLI's login there last reported of its plan, in percent of each window. A runner, or a CLI on it, paused by the user starts none of the turns it would run until the user resumes it, and a CLI held by its limit starts none of its turns there until the limit lifts, at the reset the CLI gave or, with none given, half an hour after the report: they wait, and the stages their citizens hold keep their leases.", "");
     if (machines.runners.length === 0) {
       lines.push("None registered yet.");
     }
@@ -11625,7 +12270,7 @@ var TurnHost = class {
     const costSoFarUsd = !newSession && lastTurn?.session === recorded ? lastTurn.sessionCostUsd ?? lastTurn.costUsd : 0;
     const usageSoFar = !newSession && lastTurn?.session === recorded ? lastTurn.sessionUsage : void 0;
     const resumeRetries = !newSession && lastTurn?.session === recorded && lastTurn.resumeFailed === "retry" ? lastTurn.resumeRetries ?? 1 : 0;
-    const afreshAfterReflection = charter.societyScope && agent.role !== USER_ROLE && societyScope && part === void 0;
+    const afreshAfterReflection = agent.role !== USER_ROLE && part === void 0 && (societyScope ? charter.societyScope : charter.reflects);
     const afterReflection = lastTurn?.trigger.kind === "reflection" && lastTurn.sessionDropped === true;
     const digest = await this.board.readDigest({
       ...actor,
@@ -12061,8 +12706,11 @@ var TurnHost = class {
     }
     return { dropWorkspace: ended && (closing ? decided : !outcome.leftovers) };
   }
-  /** Ends a turn whose outcome will never come, as when its runner went away, as failed. */
-  async abortTurn(turnId, reason) {
+  /**
+   * Ends a turn whose outcome will never come, as when its runner went away, as failed; `transient`
+   * when its job never reached the runner, so the same wake may pass in a minute.
+   */
+  async abortTurn(turnId, reason, options = {}) {
     const turn = this.open.get(turnId);
     if (turn === void 0) {
       return;
@@ -12077,7 +12725,8 @@ var TurnHost = class {
       endedAt: this.now().toISOString(),
       exitReason: "error",
       error: reason,
-      toolCalls: turn.transcript.filter((entry) => entry.event.type === "tool_call").length
+      toolCalls: turn.transcript.filter((entry) => entry.event.type === "tool_call").length,
+      ...options.transient === true ? { transient: true } : {}
     };
     if (await this.recorded(turn, () => this.board.finishTurn(finished, turn.transcript))) {
       this.log.warn({ agent: turn.job.agent, project: turn.job.scope, reason }, "turn aborted");
@@ -12297,6 +12946,9 @@ var TurnHost = class {
 
 // packages/turn-host/dist/hub.js
 import { randomUUID as randomUUID2 } from "node:crypto";
+function receiptOverdue(seat) {
+  return [...seat.unacked.values()].some((each) => each.overdue);
+}
 var RunnerProtocolError = class extends Error {
 };
 var RunnerAwayError = class extends Error {
@@ -12341,6 +12993,13 @@ var RunnerHub = class {
   starting = /* @__PURE__ */ new Map();
   /** Moves started since the hub did, so a placement that a move overtook gives its turn back. */
   moveStarts = 0;
+  /** When each runner was last asked to read a CLI's quota for a limit with no reset, by `runner/cli`. */
+  limitReads = /* @__PURE__ */ new Map();
+  /**
+   * The turn let through once a limit with no reset had held its half hour, by `runner/cli`: the
+   * report it tries, which `observedAt` names, and whether the turn has ended.
+   */
+  limitTries = /* @__PURE__ */ new Map();
   constructor(options) {
     this.board = options.board;
     this.host = options.host;
@@ -12377,9 +13036,9 @@ var RunnerHub = class {
     if (hello.protocol !== RUNNER_PROTOCOL) {
       throw new RunnerProtocolError(`runner protocol ${hello.protocol} is not ${RUNNER_PROTOCOL}; upgrade the runner or the server`);
     }
-    const seat = this.seats.get(name);
+    let seat = this.seats.get(name);
     if (seat === void 0) {
-      this.seats.set(name, {
+      seat = {
         name,
         hello,
         send: null,
@@ -12387,19 +13046,18 @@ var RunnerHub = class {
         warm: /* @__PURE__ */ new Set(),
         disconnectedAt: null,
         grace: null,
-        unacked: /* @__PURE__ */ new Map(),
-        unconfirmed: false
-      });
+        unacked: /* @__PURE__ */ new Map()
+      };
+      this.seats.set(name, seat);
     } else {
       seat.hello = hello;
       seat.warm = /* @__PURE__ */ new Set();
     }
     const still = new Set(hello.turns);
-    const unacked = this.seats.get(name)?.unacked ?? /* @__PURE__ */ new Map();
     for (const turnId of this.host.turnsOn(name)) {
       if (still.has(turnId)) {
-        this.settle(unacked, turnId);
-      } else if (!unacked.has(turnId)) {
+        this.settle(seat, turnId);
+      } else if (!seat.unacked.has(turnId)) {
         await this.host.abortTurn(turnId, `runner ${name} restarted during the turn`);
       }
     }
@@ -12414,7 +13072,12 @@ var RunnerHub = class {
     this.log.info({ runner: name, version: hello.version, clis: hello.clis, slots: hello.slots }, "runner registered");
     return { name, version: this.version };
   }
-  /** A registered runner's stream opened. Returns what to call when it closes. */
+  /**
+   * A registered runner's stream opened. Returns what to call when it closes. A turn its hello
+   * listed that the board has ended, as one whose runner came back after the grace period, is told
+   * to stop before anything else goes down the stream, since its CLI still works there; a runner
+   * that lists no CLI it can stop, as one from before stops, is sent none.
+   */
   async attach(name, send) {
     const seat = this.seats.get(name);
     if (seat === void 0) {
@@ -12422,11 +13085,17 @@ var RunnerHub = class {
     }
     seat.send = send;
     seat.disconnectedAt = null;
-    seat.unconfirmed = false;
     if (seat.grace !== null) {
       clearTimeout(seat.grace);
       seat.grace = null;
     }
+    if (seat.hello.stoppableClis.length > 0) {
+      for (const turnId of seat.hello.turns) {
+        if (this.host.runnerOf(turnId) !== name) {
+          void this.stopEnded(seat, turnId);
+        }
+      }
+    }
     for (const { job } of seat.unacked.values()) {
       if (send({ type: "turn", job })) {
         this.expectAck(seat, job);
@@ -12463,24 +13132,23 @@ var RunnerHub = class {
     }
     await Promise.allSettled(this.detaching);
   }
+  /** A turn's steps, which show its job arrived as its receipt would. */
   async turnEvents(runner, turnId, entries) {
     this.assertOwns(runner, turnId);
+    this.received(runner, turnId);
     await this.host.addEvents(turnId, entries);
   }
   /** A runner's word that a turn's job arrived, which also shows its stream delivers again. */
   received(runner, turnId) {
     const seat = this.seats.get(runner);
-    if (seat === void 0 || !seat.unacked.has(turnId)) {
-      return;
-    }
-    this.settle(seat.unacked, turnId);
-    if (seat.unconfirmed) {
-      seat.unconfirmed = false;
-      this.log.info({ runner }, "runner is taking jobs again");
+    if (seat !== void 0) {
+      this.settle(seat, turnId);
     }
   }
+  /** A turn's outcome, which shows its job arrived as its receipt would. */
   async turnOutcome(runner, turnId, outcome) {
     this.assertOwns(runner, turnId);
+    this.received(runner, turnId);
     const ack = await this.host.closeTurn(turnId, outcome);
     return ack ?? { dropWorkspace: false };
   }
@@ -12625,8 +13293,10 @@ var RunnerHub = class {
     }
     const cli = agent.cli;
     const runners2 = await this.board.listRunners();
-    const free = (seat) => seat.send !== null && !seat.unconfirmed && seat.hello.clis.includes(cli) && (seat.hello.slots === null || seat.inUse < seat.hello.slots) && !heldOn(runners2, seat.name, cli);
+    const now = this.now();
+    const free = (seat) => seat.send !== null && !receiptOverdue(seat) && seat.hello.clis.includes(cli) && (seat.hello.slots === null || seat.inUse < seat.hello.slots) && !heldOn(runners2, seat.name, cli, now) && !this.tryRunning(runners2, seat.name, cli, now);
     let chosen;
+    let waitsOn = agent.homeRunner;
     if (dispatch.project === SOCIETY_SCOPE) {
       chosen = await this.pinnedSeat(agent.name, agent.homeRunner, cli, free);
     } else {
@@ -12655,8 +13325,12 @@ var RunnerHub = class {
       }
       const seat = this.seats.get(home);
       chosen = seat !== void 0 && free(seat) ? seat : void 0;
+      waitsOn = home;
     }
     if (chosen === void 0) {
+      if (waitsOn !== void 0) {
+        this.readAfterLimit(runners2, waitsOn, cli, now);
+      }
       return null;
     }
     if (dispatch.project !== SOCIETY_SCOPE && (this.moving.has(dispatch.project) || this.moveStarts !== starts)) {
@@ -12666,7 +13340,17 @@ var RunnerHub = class {
     if (dispatch.project !== SOCIETY_SCOPE) {
       this.starting.set(dispatch.project, (this.starting.get(dispatch.project) ?? 0) + 1);
     }
-    return { runner: chosen.name };
+    const runner = chosen.name;
+    const lapsed = runners2.find((each) => each.name === runner)?.quotas?.[cli];
+    const tried = this.limitTries.get(`${runner}/${cli}`);
+    if (lapsed !== void 0 && limitLapsed(lapsed, now) && tried?.observedAt !== lapsed.observedAt) {
+      this.limitTries.set(`${runner}/${cli}`, {
+        observedAt: lapsed.observedAt,
+        dispatch,
+        ended: false
+      });
+    }
+    return { runner };
   }
   async runTurn(dispatch, assignment) {
     if ("refused" in assignment) {
@@ -12695,7 +13379,7 @@ var RunnerHub = class {
         return opened.failed;
       }
       if (seat.send === null || !seat.send({ type: "turn", job: opened.job })) {
-        await this.host.abortTurn(opened.job.turnId, `runner ${seat.name} went away before the turn`);
+        await this.host.abortTurn(opened.job.turnId, `runner ${seat.name} went away before the turn`, { transient: true });
       } else {
         this.expectAck(seat, opened.job);
       }
@@ -12703,10 +13387,15 @@ var RunnerHub = class {
       return await opened.ended;
     } finally {
       opening();
+      for (const tried of this.limitTries.values()) {
+        if (tried.dispatch === dispatch) {
+          tried.ended = true;
+        }
+      }
       if (seat !== void 0) {
         seat.inUse = Math.max(0, seat.inUse - 1);
         if (turnId !== null) {
-          this.settle(seat.unacked, turnId);
+          this.settle(seat, turnId);
         }
       }
     }
@@ -13096,6 +13785,40 @@ var RunnerHub = class {
     await this.board.recordQuota(runner, cli, quota);
     return quota;
   }
+  /**
+   * Whether a turn let through to try a limit with no reset, once its hold ran out, is still running
+   * on the runner, so the CLI's other turns there wait for what it reports: a refusal records a newer
+   * limit, which holds them another half hour, and a turn that ends without one lets them go.
+   */
+  tryRunning(runners2, name, cli, now) {
+    const quota = runners2.find((each) => each.name === name)?.quotas?.[cli];
+    const tried = this.limitTries.get(`${name}/${cli}`);
+    return quota !== void 0 && tried !== void 0 && !tried.ended && tried.observedAt === quota.observedAt && limitLapsed(quota, now);
+  }
+  /**
+   * Asks a runner to read a CLI's quota again while a limit it gave no reset for holds a turn
+   * waiting for it there, at most once per `UNKNOWN_LIMIT_HOLD_MS` for each runner and CLI, so a
+   * reset the read names becomes the hold and a clear read lifts it. Not while the user's pause
+   * holds the CLI there too, nor on a runner from before quota reads; a read that fails changes
+   * nothing, and the hold runs out as it would have.
+   */
+  readAfterLimit(runners2, name, cli, now) {
+    const record = runners2.find((each) => each.name === name);
+    const seat = this.seats.get(name);
+    if (record === void 0 || seat === void 0 || seat.send === null || !seat.hello.quotaReads || !seat.hello.clis.includes(cli) || runnerPause(record, cli) !== void 0 || runnerLimitHold(record, cli, now)?.known !== false) {
+      return;
+    }
+    const key = `${name}/${cli}`;
+    const last = this.limitReads.get(key);
+    if (last !== void 0 && now.getTime() - last < UNKNOWN_LIMIT_HOLD_MS) {
+      return;
+    }
+    this.limitReads.set(key, now.getTime());
+    this.log.info({ runner: name, cli }, "reading a quota limited until an unknown time");
+    this.quota(name, cli).catch((error) => {
+      this.log.warn({ runner: name, cli, error: String(error) }, "could not read a limited quota");
+    });
+  }
   /** Calls `listener` whenever a runner registers, connects, or goes away. */
   onRunnerChange(listener) {
     this.runnerListeners.add(listener);
@@ -13109,29 +13832,54 @@ var RunnerHub = class {
   /**
    * Waits for a runner to acknowledge a job. One that does not in time may be behind a stream that
    * looks open but delivers nothing, as when its machine's network stops passing traffic, so no
-   * more turns go to it until it acknowledges or connects again; the turns it has carry on, since
-   * they report by posts.
+   * more turns go to it until the job is acknowledged, its turn ends, or the runner connects again;
+   * the turns it has carry on, since they report by posts.
    */
   expectAck(seat, job) {
     const previous = seat.unacked.get(job.turnId);
     if (previous !== void 0) {
       clearTimeout(previous.timer);
     }
-    const timer = setTimeout(() => {
-      if (!seat.unacked.has(job.turnId) || seat.unconfirmed || seat.send === null) {
-        return;
-      }
-      seat.unconfirmed = true;
-      this.log.warn({ runner: seat.name, turnId: job.turnId, waitedMs: this.ackTimeoutMs }, "runner has not acknowledged a job; no more turns go to it until it does or reconnects");
-    }, this.ackTimeoutMs);
-    timer.unref?.();
-    seat.unacked.set(job.turnId, { job, timer });
+    const entry = {
+      job,
+      timer: setTimeout(() => {
+        if (seat.unacked.get(job.turnId) !== entry || seat.send === null) {
+          return;
+        }
+        const wasHeld = receiptOverdue(seat);
+        entry.overdue = true;
+        if (!wasHeld) {
+          this.log.warn({ runner: seat.name, turnId: job.turnId, waitedMs: this.ackTimeoutMs }, "runner has not acknowledged a job; no more turns go to it until it does, the turn ends, or it reconnects");
+        }
+      }, this.ackTimeoutMs),
+      overdue: false
+    };
+    entry.timer.unref?.();
+    seat.unacked.set(job.turnId, entry);
+  }
+  /** A job acknowledged, or its turn over: the hold it put on its runner, if any, goes with it. */
+  settle(seat, turnId) {
+    const entry = seat.unacked.get(turnId);
+    if (entry === void 0) {
+      return;
+    }
+    clearTimeout(entry.timer);
+    seat.unacked.delete(turnId);
+    if (entry.overdue && !receiptOverdue(seat)) {
+      this.log.info({ runner: seat.name }, "runner is taking jobs again");
+    }
   }
-  settle(unacked, turnId) {
-    const entry = unacked.get(turnId);
-    if (entry !== void 0) {
-      clearTimeout(entry.timer);
-      unacked.delete(turnId);
+  /** Has a runner stop the CLI of a turn it still runs that the board has ended. */
+  async stopEnded(seat, turnId) {
+    try {
+      const stopped = await this.request(seat, (request) => ({ type: "stop", request, turnId }), CONTROL_TIMEOUT_MS);
+      if (stopped === true) {
+        this.log.warn({ runner: seat.name, turnId }, "stopped a turn the board had ended, which its runner still ran");
+      } else {
+        this.log.info({ runner: seat.name, turnId }, "a turn the board had ended was no longer running on its runner");
+      }
+    } catch (error) {
+      this.log.warn({ runner: seat.name, turnId, error: String(error) }, "could not stop a turn the board had ended");
     }
   }
   async detach(seat) {
@@ -13154,7 +13902,8 @@ var RunnerHub = class {
         return;
       }
       for (const turnId of this.host.turnsOn(seat.name)) {
-        void this.host.abortTurn(turnId, seat.unacked.has(turnId) ? `the turn never reached runner ${seat.name}, which went away` : `runner ${seat.name} went away during the turn`);
+        const unsent = seat.unacked.has(turnId);
+        void this.host.abortTurn(turnId, unsent ? `the turn never reached runner ${seat.name}, which went away` : `runner ${seat.name} went away during the turn`, { transient: unsent });
       }
     }, this.graceMs);
     seat.grace.unref?.();
@@ -14702,6 +15451,34 @@ var ModelCatalog = class {
   }
 };
 
+// apps/server/dist/prometheus.js
+import { Hono as Hono4 } from "hono";
+var PROMETHEUS_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+function quoted(value) {
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", "\\n")}"`;
+}
+function sample(name, labels, value) {
+  const pairs = Object.entries(labels).map(([label, text]) => `${label}=${quoted(text)}`);
+  return `${name}{${pairs.join(",")}} ${value}`;
+}
+function prometheusText(counts) {
+  return [
+    "# HELP stellaris_turn_tokens_total Tokens finished turns used, by citizen, CLI, model, and kind: input, output, cache_read, or cache_write.",
+    "# TYPE stellaris_turn_tokens_total counter",
+    ...counts.tokens.map(({ agent, cli, model, kind, tokens }) => sample("stellaris_turn_tokens_total", { agent, cli, model, kind }, tokens)),
+    "# HELP stellaris_turns_total Finished turns, by citizen, outcome (completed or failed), and the trigger that woke them.",
+    "# TYPE stellaris_turns_total counter",
+    ...counts.turns.map(({ agent, outcome, trigger, turns: turns2 }) => sample("stellaris_turns_total", { agent, outcome, trigger }, turns2)),
+    ""
+  ].join("\n");
+}
+function createMetricsApp(counters) {
+  const app2 = new Hono4();
+  app2.get("/metrics", (c) => c.body(prometheusText(counters.read()), 200, { "content-type": PROMETHEUS_CONTENT_TYPE }));
+  app2.notFound((c) => c.text("not found", 404));
+  return app2;
+}
+
 // apps/server/dist/quotas.js
 var MINUTE = 6e4;
 var QuotaReads = class {
@@ -14865,6 +15642,13 @@ var server = serveBoard({ fetch: app.fetch, port: config.port, hostname: config.
     trustedProxies: config.trustedProxies
   }, "board server listening");
 });
+var metrics = config.metricsPort === null ? null : serveBoard({
+  fetch: createMetricsApp(await board.countTurns()).fetch,
+  port: config.metricsPort,
+  hostname: config.host
+}, (info) => {
+  log.info({ host: info.address, port: info.port }, "metrics listening");
+});
 await scheduler.start();
 log.info({
   concurrency: config.concurrency ?? "unlimited",
@@ -14876,6 +15660,7 @@ var shutdown = async (signal) => {
   log.info({ signal }, "shutting down; waiting for running turns to report");
   await scheduler.stop();
   await runners.close();
+  metrics?.close();
   server.close();
   process.exit(0);
 };