@rackbops/plugin-tracker 0.11.0 → 0.13.0

package/README.md

@@ -12,7 +12,8 @@ your own tasks from the web, under the commands' own rules -- the admin view and
 slice 3) -- the JSON task API with personal API tokens (#80, slice 4), for a program acting as
 you, such as a later intake agent (plan E10) -- and the one-off research request (#82, plan E8,
 category 5): a question looked into on the web by a model run, checked by a second run against its
-sources, and DMed once, with its claims kept as findings. The model runs never happen here: they go
+sources, and DMed once, with its claims kept as findings -- and an admin raising one person's
+daily model ceiling from the web (#82, plan 5.7). The model runs never happen here: they go
 through city-hall to Rackbops/docket-runner on roshne's own host (plan 5.12), and the whole execute
 lane stays off until the city-hall Executor is configured (Configuration below).
 
@@ -69,7 +70,7 @@ At start the plugin runs docket's `recover()`: a run left running is requeued, a
 by a stop mid-send is settled unconfirmed and logged.
 
 **Research and the execute lane** (docket 0.5.0, #82). A research request is two model Jobs, run
-one after the other through city-hall's execute lane (Lepid-Labs/city-hall#18) by the runner that
+one after the other through city-hall's execute lane ([Lepid-Labs/city-hall#18](https://github.com/Lepid-Labs/city-hall/pull/18)) by the runner that
 carries `TRACKER_CITY_HALL_CAPABILITY` -- only docket-runner, on roshne's subscription (plan items
 70, 71). The tracker submits each Job with `POST /api/execute/jobs` under a prefixed key,
 `rackbops-tracker:<database id>:<docket's Job key>` -- the database id is random, made once and kept
@@ -103,15 +104,18 @@ the first sight (a judgement, not a measured figure): past it the Job answers "p
 docket gives the run up, and the admins are told once. It logs "the model runner is paused" naming
 the outcome once an hour per Job, and tells the admins once per Job and outcome. docket's own
 usage-limit pause (which waits for the reset the CLI named) applies only to a `usage_limit` result
-that reaches the tracker: city-hall#18 as proposed sends one back only when it stores that result,
-as when a job that was requeued later fails at its maximum of expired leases.
+that reaches the tracker: under city-hall#18 as merged, that happens only when the job ends failed
+with that result still stored, as when a job that was requeued later fails at its maximum of
+expired leases.
 The plugin never calls a model, holds no Claude credential and no `ANTHROPIC_*` variable; model
 output is data, cleaned by docket before it reaches a DM or a finding, and every research DM goes
 out with no allowed mentions: the host sends every `dm` with `allowedMentions: { parse: [] }`
-(CONTEXT.md). **The wire is city-hall#18's
-proposal, not yet agreed by Nazu**: the source pair is a stand-in for the source and responder
-contracts (its decision 0002), so it may change, and this adapter with it -- the requeue reading
-above and `lastOutcome` (city-hall#18 at 2ba40d3) included.
+(CONTEXT.md). **The wire is city-hall#18's**
+([Lepid-Labs/city-hall#18](https://github.com/Lepid-Labs/city-hall/pull/18), merged as 90a06ec),
+but its decision record 0002 is still "proposed" pending Nazu's review
+([Lepid-Labs/city-hall#17](https://github.com/Lepid-Labs/city-hall/issues/17)): the source pair is
+a stand-in for the source and responder contracts, so it may change, and this adapter with it --
+the requeue reading above and `lastOutcome` (present in the merged 90a06ec) included.
 
 **Research while the lane is off.** If an instance that had city-hall configured loses that
 configuration, its research requests stay queued: nothing runs them until research is available
@@ -121,8 +125,9 @@ says research is not available; it does not list the waiting ones (`/tasks` does
 
 **Budgets** (plan 5.7, docket's defaults): 2 USD and 20 model calls a person a day, 10 USD and 100
 calls in all. At a ceiling the person's research waits until midnight Eastern; the person gets one
-DM and the admins one each. Reminders, renewals and prices never count. There is no web control to
-raise a person's ceiling yet.
+DM and the admins one each. Reminders, renewals and prices never count. An admin can raise one
+person's ceiling from their admin page (0.13.0, below); the global ceiling still applies to everyone
+together.
 
 **Findings.** A passed research answer's claims are stored with their first source (docket's
 `findings`), shown on the task's page to its owner, accepted recipients and admins (docket's
@@ -148,8 +153,8 @@ served at a hashed path, cached for a year).
 | Path | What |
 |---|---|
 | `/` | My tasks: the same list as `/tasks` (active tasks owned and received, next run in your zone; paused ones and why), each linking to its history, and links to make a new one. |
-| `/tasks/<id>` | A task's history: the same as `/task history`, for the owner, an accepted recipient or an admin. Anyone else gets the same 404 as an unknown id. The owner also sees Edit, Pause or Resume, and Delete. |
-| `/new/reminder`, `/new/renewal`, `/new/price` | The editor's new-task forms (GET), and making one (POST). |
+| `/tasks/<id>` | A task's history: the same as `/task history`, for the owner, an accepted recipient or an admin. Anyone else gets the same 404 as an unknown id. The owner also sees Edit (not for a research request), Pause or Resume, and Delete. |
+| `/new/reminder`, `/new/renewal`, `/new/price`, `/new/research` | The editor's new-task forms (GET), and making one (POST). `/new/research` is linked from My tasks only while research is available; without it the page says research is not available instead of showing a form. |
 | `/tasks/<id>/edit` | The owner's edit form (GET) and saving it (POST). |
 | `/tasks/<id>/pause`, `/resume`, `/delete` | POST only. Delete answers a confirmation first; only a second post carrying `confirm=yes` deletes. |
 | `/settings` | Preferred hour and time zone, checked as `/register` checks them. Links to API tokens and Forget me. |
@@ -184,8 +189,8 @@ than `TRACKER_WEB_URL`'s is refused. The sign-in post has no session yet, so it
 double-submit token from a `SameSite=Strict` cookie the link's page sets: another site cannot sign
 you in as someone else. Sign out is a POST too.
 
-**The task editor** (slice 2). The forms take the options of `/remind`, `/renewal` and `/price`,
-and the same functions check and make them: the same defaults, limits and messages, the page read
+**The task editor** (slice 2). The forms take the options of `/remind`, `/renewal`, `/price` and
+`/research` (#82), and the same functions check and make them: the same defaults, limits and messages, the page read
 once before a price tracker is made, at most 20 price trackers per person wherever they were made,
 and `near` turned into the same bounded pattern; a person has one new price tracker's page read in
 flight at a time. Every person may have at most 200 active or paused tasks of all types together,
@@ -208,7 +213,11 @@ are dropped and nothing more is sent, but its history is kept (an admin can see
 its page stays for the owner. Every editor post passes the session, CSRF and `Origin` checks; the
 task is loaded by the id in the path and must be the viewer's own, checked again in the write
 queue, and anyone else's -- even one an admin can see -- answers the same 404 as an unknown id. A
-refused form comes back with what was typed and why. Form bodies are capped at 32 KiB, read no
+refused form comes back with what was typed and why. A research request made on the web is
+`/research`'s exactly -- the question, the optional context, deadline and start in `/research`'s
+words, the cap of 5 waiting, the daily budget -- and, as in Discord, it is never edited: its page
+has Pause, Resume and Delete but no Edit. Making one only queues its run; nothing reaches city-hall
+until the execute tick. Form bodies are capped at 32 KiB, read no
 further than that.
 
 **Headers.** `Content-Security-Policy: default-src 'none'; style-src 'self'; img-src 'none';
@@ -255,6 +264,24 @@ the function the command path runs:
 - **Lift** a decline block in force: docket's `liftBlock`, recorded as that admin's lift.
 - **Revoke an API token** of anyone's, from their page, which lists their tokens (never the
   secret). It stops working at once; the owner is not told. Logged by token id.
+- **Raise a person's daily ceiling** (0.13.0, plan 5.7: "The admin raises a person's ceiling from
+  the web area"). Their page shows what they spent today (the budget day ends at midnight Eastern),
+  their ceiling now, a form with both numbers -- dollars to the cent and whole model calls -- and
+  the latest 20 changes an admin made, newest first (older ones stay in the table). Each number
+  must be at least the default (2 USD, 20 calls) and at most the global ceiling (10 USD, 100
+  calls), which docket checks first anyway; those bounds are proposed on #82, roshne's to confirm.
+  Setting exactly the default is a reset to it, not a raise.
+  **A raise stands until an admin changes it** -- raises it again or presses **Back to the
+  default**. That default is proposed on #82 and is roshne's to confirm; a today-only raise
+  would be a small change (`limitsOf` and `isRaised` plus a clock in `Ceilings`, and the page's
+  badge). Enforcement stays docket's: the
+  execute lane hands docket's `budgetHold` a policy whose `personFor` reads the person's newest
+  change, before every run, so a raise lets a held request run on the next tick. docket
+  sends its ceiling notices once a day per person (`noticeOnce`, key `budget:person:<id>:<day>`),
+  so every change -- raise or reset -- deletes that person's key for the current budget day in the
+  same transaction: meeting the new ceiling the same day DMs the person and the admins again (plan
+  5.7: "nothing fails silently"). Every change is an append-only `ceiling_changes` row (who, for whom, the values,
+  when) and a log line (`u1 set u2's daily ceiling to 4 USD / 40 calls (c1)`).
 - **Remove from the tracker**: forget-me for that person (below), with the same confirmation.
 
 **Deliveries** (0.10.0). `/admin/deliveries`, linked from every admin page, lists the DMs that
@@ -266,8 +293,9 @@ have gone out and is never resent; `deferred` is still owed (a recipient whose d
 say). Before 0.10.0 these showed only in the bot log, where the warnings still go. The page is
 read-only, and like every admin page answers anyone who is not an admin with the unknown page's 404.
 
-Not here yet, though plan 5.10 lists them: grants, budgets and retry (they belong to the execute
-lane, which is not built) and an admin pause of someone else's task.
+Not here yet, though plan 5.10 lists them: grants and retry, and an admin pause of someone else's
+task. Of budgets, raising one person's ceiling is here; the global ceiling and the defaults are
+docket's constants.
 
 **Forget me** (plan 5.8). A signed-in person erases themselves from `/forget` (web only: the plan
 asks for no Discord command, so without `TRACKER_WEB_URL` the only path is an admin with the web
@@ -279,14 +307,15 @@ in one SQLite transaction in the write queue, **deleted, not archived**:
 - on everyone else's tasks: their recipient rows, their replies and answers, the history rows they
   made or that name them (an invitation of them, a pause for them), the run events and deliveries
   of DMs to them (docket's `deleteDeliveries`), charges made for them, and their pause rows;
-- the budget notices kept for them (`budget:person:<id>:...`);
+- the budget notices kept for them (`budget:person:<id>:...`) and the changes to their ceiling;
 - every decline block they are either side of;
 - their admission, delivery health, web sessions, unused sign-in links and API tokens, and their
   person row.
 
 What stays, and why: another person's task that they received stays that owner's; one paused only
 because DMs to them failed goes back on. Another person's row keeps its own audit fact but not their
-id -- `admitted_by` of someone they admitted, and `lifted_by` of a block they lifted, become
+id -- `admitted_by` of someone they admitted, `lifted_by` of a block they lifted, and `set_by` of a
+change they made to someone's ceiling become
 `forgotten` ("an admin since forgotten"; null already means "the configuration"). Text is matched
 only in the forms the code writes a person's id into -- docket's consent rows (`u5`, `u5 24h`), the
 tracker's `u5: ...` removals and `delivery to {u5} paused` pauses, docket's `u5 <message>` delivery
@@ -393,15 +422,18 @@ a price back the page's address -- exactly as the web editor's empty fields do.
 value: it is refused as the wrong JSON type (send `""` to clear a note).
 
 Which types: `GET /tasks`, `GET /tasks/<id>`, pause, resume and `DELETE` work on any task you own,
-whatever its type; `POST /tasks` and `PATCH` take the three editor types (reminder, renewal,
-price), and a `PATCH` of a task of another type answers `404`, as the web editor does.
+whatever its type. `POST /tasks` takes the three editor types (reminder, renewal, price) and,
+while research is available on this bot, `research` (#82), by `/research`'s rules; while it is not,
+a `research` create answers `503 unavailable`. `PATCH` takes the three editor types only: a
+research request cannot be edited, here or in Discord, and a `PATCH` of one answers
+`409 conflict`.
 
 | Method and path | What |
 |---|---|
 | `GET /api/v1/me` | The token's owner (id, name, zone, preferred hour) and the token (id, name, made, expires). |
-| `GET /api/v1/types` | Each type's create and edit fields: name, JSON type, required (never, for an edit), description, and limits (`maxLength`, `minimum`, `maximum`, `enum`). This describes the tracker's own editor fields -- what these endpoints take -- and is **not** docket-core's `TaskType.intake` (`IntakeSpec`), which describes a type's config. |
+| `GET /api/v1/types` | Each type this bot makes now (research only while it is available), whether a `PATCH` takes it (`editable`; false for research, whose `edit` is empty), and its create and edit fields: name, JSON type, required (never, for an edit), description, and limits (`maxLength`, `minimum`, `maximum`, `enum`). This describes the tracker's own editor fields -- what these endpoints take -- and is **not** docket-core's `TaskType.intake` (`IntakeSpec`), which describes a type's config. |
 | `GET /api/v1/tasks` | Your tasks that are not deleted -- active, paused and done -- oldest first. Not the ones shared with you. |
-| `POST /api/v1/tasks` | Makes one: `type` is `reminder`, `renewal` or `price`, and the rest are that type's create fields. `201`, with `Location`. A price's page is read first, and nothing is made unless a price is found in it. |
+| `POST /api/v1/tasks` | Makes one: `type` is `reminder`, `renewal`, `price` or `research`, and the rest are that type's create fields. `201`, with `Location`. A price's page is read first, and nothing is made unless a price is found in it. A research request's fields are `question` (required), `context`, `deadline` and `at`, all text. |
 | `GET /api/v1/tasks/<id>` | One of your tasks (a deleted one too), with its history: the newest runs and changes, as `/task history` shows them. |
 | `PATCH /api/v1/tasks/<id>` | Edits it: the fields to change. A price's page is not editable. |
 | `POST /api/v1/tasks/<id>/pause`, `/resume` | Body `{}`. As the web's Pause and Resume, and `/task resume`. |
@@ -411,7 +443,8 @@ A task is `{"id", "type", "title", "status", "cadence", "nextAt", "createdAt", "
 "settings"}`, and a price also has a top-level `url`: `status` is `active`, `paused`, `done` or
 `deleted`; `cadence` is the schedule in words, in your zone; `nextAt` the next run's instant (UTC),
 null when paused or nothing is due; `settings` exactly the fields a `PATCH` takes, as the task has
-them. A price's `url` is read-only -- another page is another tracker -- so it is not in `settings`
+them. A research request's `settings` are what was asked -- `question`, and `context` and
+`deadline` (an instant) when given -- shown to you alone and changed by no `PATCH`. A price's `url` is read-only -- another page is another tracker -- so it is not in `settings`
 and a `PATCH` naming it is refused (`unknown_field`). A write answers
 `{"task", "message"}`, `message` being the words the web and the command say.
 
@@ -428,9 +461,9 @@ and a `PATCH` naming it is refused (`unknown_field`). A write answers
 | 403 | `not_member` | The owner has left every `TRACKER_GUILD_ID` server; their tokens are revoked. |
 | 404 | `not_found` | No such endpoint, or no such task of yours. Anyone else's task -- one shared with you, or any task to an admin's token -- answers exactly as an unknown id. |
 | 405 | `method_not_allowed` | With `Allow`. |
-| 409 | `conflict` | A finished task edited, or a pause of a task not active (a resume of one not paused). |
-| 409 | `limit_reached` | 200 active or paused tasks, or 20 price trackers, as the commands count them. |
-| 409 | `busy` | Your last new price tracker's page is still being read. |
+| 409 | `conflict` | A finished task edited, a research request edited, or a pause of a task not active (a resume of one not paused). |
+| 409 | `limit_reached` | 200 active or paused tasks, 20 price trackers, or 5 research requests waiting, as the commands count them. |
+| 409 | `busy` | Your last new price tracker's page is still being read, or the task is with the model runner right now (try again in a minute). |
 | 413 | `too_large` | Body over 16 KiB. |
 | 415 | `unsupported_media_type` | Not `application/json`. |
 | 429 | `rate_limited` | With `Retry-After`: this token's bucket, or the shared one for bad tokens. |
@@ -506,15 +539,17 @@ key>`, so two databases never collide.
 
 ## Not yet
 
-- The rest of the web area (E5): sharing a task from the web, and the admin view's grants, budgets
-  (raising a person's ceiling) and retry. Research is made in Discord only (the web editor and
-  the task API cover reminders, renewals and prices). The task API covers reminders, renewals and prices only --
-  not `/task done`, `snooze`, `decide`, `share` or the settings -- and no intake agent uses it yet
+- The rest of the web area (E5): sharing a task from the web, and the admin view's grants and
+  retry. The task API makes reminders, renewals, prices and
+  research requests -- not `/task done`, `snooze`, `decide`, `share` or the settings -- and no intake agent uses it yet
   (E10, deferred). Discord OAuth2 as a second sign-in
   method, if chosen (plan item 41).
 - The rest of #82: per-type grants beyond tier 0 (research needs only `notify`), the transcripts
-  policy, and live verification against a real city-hall and docket-runner (city-hall#18 is not
-  merged). The scout and the want-list (E9).
+  policy, and live verification against a real city-hall and docket-runner
+  ([Lepid-Labs/city-hall#18](https://github.com/Lepid-Labs/city-hall/pull/18) is merged as
+  90a06ec, its decision record still "proposed" pending
+  [Lepid-Labs/city-hall#17](https://github.com/Lepid-Labs/city-hall/issues/17); the research lane
+  still needs a deployed city-hall with a runner). The scout and the want-list (E9).
 - Editing in Discord (the editor is on the web only), and changing a price tracker's page or `near` after it is made (make a new one); a free-form pattern for `price` (`near` is the safe subset: a user's regular expression run on a large page could hang the bot).
 - An optional Discord-role gate (plan 5.5), and showing unconfirmed deliveries to admins anywhere but the log, or a run's deliveries in its history.
 

package/dist/plugin.js

@@ -3189,6 +3189,206 @@ class Admissions {
   }
 }
 
+// plugins/tracker/src/admin.ts
+var NO_SUCH_PERSON = "There is no such person on this tracker's list.";
+var NO_SUCH_BLOCK = "There is no such block in force.";
+var LAST_ADMIN = "That is the tracker's only admin: make someone else an admin first.";
+var BUSY = "The tracker is busy sending reminders; nothing was deleted. Try again in a minute.";
+var TICK_WAIT_MS = 20000;
+var CONFIGURED_ADMIN = "That admin is named in TRACKER_ADMIN_DISCORD_IDS, which makes them an admin again at every start: remove them from the configuration first.";
+var CONFIGURED_SELF = "You are named in TRACKER_ADMIN_DISCORD_IDS: this erases you now, but the next start makes you an admin again, as a new person, unless you are removed from the configuration first.";
+function isConfiguredAdmin(d, u) {
+  return u.discordId !== null && d.configuredAdmins.has(u.discordId);
+}
+function ticksSettled(d) {
+  return d.lanes.idle(TICK_WAIT_MS);
+}
+function isPersonId(id) {
+  return /^u[1-9][0-9]{0,15}$/.test(id);
+}
+async function person(d, id) {
+  return isPersonId(id) ? d.store.getUser(id) : null;
+}
+function who(u) {
+  return u.displayName ?? u.discordId ?? u.id;
+}
+async function setAdminFlag(d, admin, targetId, flag) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  if (target.admin === flag)
+    return { ok: true, text: `${who(target)} ${flag ? "is already" : "is not"} an admin.` };
+  if (!flag && d.roster.admins() <= 1)
+    return { ok: false, error: LAST_ADMIN };
+  if (!flag && isConfiguredAdmin(d, target))
+    return { ok: false, error: CONFIGURED_ADMIN };
+  await d.store.updateUser(target.id, { admin: flag });
+  d.log.info(`${admin.id} ${flag ? "made" : "revoked"} ${target.id} ${flag ? "an admin" : "as admin"}`);
+  return { ok: true, text: flag ? `${who(target)} is now an admin.` : `${who(target)} is no longer an admin.` };
+}
+async function resumeDelivery(d, admin, targetId) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  const resumed = await d.health.resume(target.id, d.clock.now());
+  if (!resumed)
+    return { ok: false, error: `Delivery to ${who(target)} is not paused.` };
+  return { ok: true, text: `Delivery to ${who(target)} resumed; ${resumed.tasks.length} task(s) back on.` };
+}
+async function liftDeclineBlock(d, admin, blockId) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const block = /^b[1-9][0-9]{0,15}$/.test(blockId) ? await d.store.getBlock(blockId) : null;
+  const now = d.clock.now();
+  if (!block || (await activeBlock(d.store, block.ownerId, block.recipientId, now))?.id !== block.id)
+    return { ok: false, error: NO_SUCH_BLOCK };
+  await liftBlock(d.store, { userId: admin.id, admin: true }, block.id, now);
+  const owner = await d.store.getUser(block.ownerId);
+  const recipient = await d.store.getUser(block.recipientId);
+  return {
+    ok: true,
+    text: `Lifted: ${owner ? who(owner) : block.ownerId} may invite ${recipient ? who(recipient) : block.recipientId} again.`
+  };
+}
+async function forgetPerson(d, actor, targetId) {
+  if (actor.id !== targetId && !actor.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  if (target.admin && d.roster.admins() <= 1)
+    return { ok: false, error: LAST_ADMIN };
+  if (actor.id !== target.id && isConfiguredAdmin(d, target))
+    return { ok: false, error: CONFIGURED_ADMIN };
+  const now = d.clock.now();
+  const erased = await d.health.exclusive(async () => {
+    if (d.lanes.busy())
+      return null;
+    const e = d.roster.erase(target.id);
+    for (const taskId of e.freed)
+      await d.health.release(taskId, null, "resumed: a recipient left the tracker", now);
+    return e;
+  });
+  if (erased === null)
+    return { ok: false, error: BUSY };
+  if (!d.roster.checkpoint())
+    d.log.warn(`after forgetting ${target.id}: the write-ahead log is busy, so SQLite's next checkpoint copies it back`);
+  const total = Object.values(erased.rows).reduce((a, b) => a + b, 0);
+  d.log.info(`forgot ${target.id} (${actor.id === target.id ? "at their own request" : `removed by ${actor.id}`}): ${total} row(s) deleted`);
+  return { ok: true, text: actor.id === target.id ? "Everything the tracker held about you is deleted." : `${who(target)} is removed from the tracker.` };
+}
+
+// plugins/tracker/src/ceilings.ts
+function boundsOf(policy = DEFAULT_BUDGET) {
+  return { min: policy.person, max: policy.global };
+}
+function limitsOf(latest, defaults = DEFAULT_BUDGET.person) {
+  if (!latest || latest.usd === null || latest.calls === null)
+    return defaults;
+  return { usd: latest.usd, calls: latest.calls };
+}
+var USD = /^[0-9]{1,4}(\.[0-9]{1,2})?$/;
+var CALLS = /^[0-9]{1,5}$/;
+function money2(n) {
+  return `${n.toFixed(2)} USD`;
+}
+function decideCeiling(input, bounds = boundsOf()) {
+  if (input.reset)
+    return { ok: true, limits: null };
+  const usdText = input.usd.trim();
+  const callsText = input.calls.trim();
+  if (!USD.test(usdText))
+    return { ok: false, error: "Give the dollars as a number, like 4 or 4.50." };
+  if (!CALLS.test(callsText))
+    return { ok: false, error: "Give the model calls as a whole number, like 40." };
+  const usd = Number(usdText);
+  const calls = Number(callsText);
+  const { min, max } = bounds;
+  if (min.usd !== null && usd < min.usd)
+    return { ok: false, error: `The dollars cannot go below the default, ${money2(min.usd)}.` };
+  if (min.calls !== null && calls < min.calls)
+    return { ok: false, error: `The model calls cannot go below the default, ${min.calls}.` };
+  if (max.usd !== null && usd > max.usd)
+    return { ok: false, error: `The dollars cannot go above the global ceiling, ${money2(max.usd)} a day.` };
+  if (max.calls !== null && calls > max.calls)
+    return { ok: false, error: `The model calls cannot go above the global ceiling, ${max.calls} a day.` };
+  if (usd === min.usd && calls === min.calls)
+    return { ok: true, limits: null };
+  return { ok: true, limits: { usd, calls } };
+}
+function describeLimits(l) {
+  const usd = l.usd === null ? "no dollar ceiling" : money2(l.usd);
+  const calls = l.calls === null ? "no call ceiling" : `${l.calls} model calls`;
+  return `${usd} and ${calls} a day`;
+}
+function isRaised(latest) {
+  return latest !== null && latest.usd !== null && latest.calls !== null;
+}
+function budgetNoticeKey(userId, at) {
+  return `budget:person:${userId}:${budgetDay(at).day}`;
+}
+var HISTORY_SHOWN = 20;
+function toChange(r) {
+  return { id: `c${r.seq}`, userId: r.user_id, usd: r.usd, calls: r.calls, setBy: r.set_by, at: r.at };
+}
+
+class Ceilings {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  latest(userId) {
+    const r = this.db.query("SELECT * FROM ceiling_changes WHERE user_id = ? ORDER BY seq DESC LIMIT 1").get(userId);
+    return r ? toChange(r) : null;
+  }
+  history(userId, limit = HISTORY_SHOWN) {
+    return this.db.query("SELECT * FROM ceiling_changes WHERE user_id = ? ORDER BY seq DESC LIMIT ?").all(userId, limit).map(toChange);
+  }
+  record(userId, limits, setBy, at) {
+    return this.db.transaction(() => {
+      const r = this.db.query("INSERT INTO ceiling_changes (user_id, usd, calls, set_by, at) VALUES (?, ?, ?, ?, ?) RETURNING *").get(userId, limits?.usd ?? null, limits?.calls ?? null, setBy, at);
+      this.db.query("DELETE FROM notices WHERE key = ?").run(budgetNoticeKey(userId, new Date(at)));
+      return toChange(r);
+    })();
+  }
+  personFor(user) {
+    const latest = this.latest(user.id);
+    return isRaised(latest) ? limitsOf(latest) : null;
+  }
+}
+function budgetPolicy(ceilings, base = DEFAULT_BUDGET) {
+  return { person: base.person, global: base.global, personFor: (u) => ceilings.personFor(u) };
+}
+async function spentToday(store, userId, now) {
+  const day = budgetDay(now);
+  const rows = await store.listUsage({ userId, since: day.start, before: day.end });
+  return spent(rows);
+}
+function who2(u) {
+  return u.displayName ?? u.discordId ?? u.id;
+}
+async function setCeiling(d, admin, targetId, input) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = isPersonId(targetId) ? await d.store.getUser(targetId) : null;
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  const decided = decideCeiling(input);
+  if (!decided.ok)
+    return { ok: false, error: decided.error };
+  const before = d.ceilings.latest(target.id);
+  if (decided.limits === null && !isRaised(before))
+    return { ok: true, text: `${who2(target)} is already on the default ceiling.` };
+  const change = d.ceilings.record(target.id, decided.limits, admin.id, d.clock.now().toISOString());
+  const now = limitsOf(change);
+  d.log.info(`${admin.id} set ${target.id}'s daily ceiling to ${decided.limits === null ? "the default" : `${now.usd} USD / ${now.calls} calls`} (${change.id})`);
+  return decided.limits === null ? { ok: true, text: `${who2(target)} is back on the default ceiling: ${describeLimits(now)}.` } : { ok: true, text: `${who2(target)}'s ceiling is now ${describeLimits(now)}, until an admin changes it.` };
+}
+
 // plugins/tracker/src/delivery-health.ts
 var PAUSE_AFTER = 3;
 var PAUSE_DETAIL = `delivery paused: ${PAUSE_AFTER} DMs in a row could not be delivered (DMs closed, or the bot is blocked)`;
@@ -4201,6 +4401,18 @@ var MIGRATIONS = [
     paused_at TEXT
   );
   CREATE INDEX executor_jobs_occurrence ON executor_jobs (occurrence_id);
+  `,
+  `
+  CREATE TABLE ceiling_changes (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    usd REAL,
+    calls INTEGER,
+    set_by TEXT NOT NULL,
+    at TEXT NOT NULL,
+    CHECK ((usd IS NULL) = (calls IS NULL))
+  );
+  CREATE INDEX ceiling_changes_user ON ceiling_changes (user_id, seq);
   `
 ];
 var BUSY_TIMEOUT_MS = 5000;
@@ -6849,6 +7061,8 @@ class Roster {
       del("web_login_tokens", "user_id = ?", userId);
       del("api_tokens", "user_id = ?", userId);
       del("notices", "key LIKE 'budget:person:' || ? || ':%'", userId);
+      del("ceiling_changes", "user_id = ?", userId);
+      this.db.query("UPDATE ceiling_changes SET set_by = ? WHERE set_by = ?").run(FORGOTTEN, userId);
       del("users", "seq = ?", Number(seq));
       const held = this.db.query("SELECT 1 FROM delivery_pauses WHERE task_id = ? LIMIT 1");
       const freed = [...new Set(pausedFor)].filter((t) => held.get(t) === null);
@@ -6857,99 +7071,6 @@ class Roster {
   }
 }
 
-// plugins/tracker/src/admin.ts
-var NO_SUCH_PERSON = "There is no such person on this tracker's list.";
-var NO_SUCH_BLOCK = "There is no such block in force.";
-var LAST_ADMIN = "That is the tracker's only admin: make someone else an admin first.";
-var BUSY = "The tracker is busy sending reminders; nothing was deleted. Try again in a minute.";
-var TICK_WAIT_MS = 20000;
-var CONFIGURED_ADMIN = "That admin is named in TRACKER_ADMIN_DISCORD_IDS, which makes them an admin again at every start: remove them from the configuration first.";
-var CONFIGURED_SELF = "You are named in TRACKER_ADMIN_DISCORD_IDS: this erases you now, but the next start makes you an admin again, as a new person, unless you are removed from the configuration first.";
-function isConfiguredAdmin(d, u) {
-  return u.discordId !== null && d.configuredAdmins.has(u.discordId);
-}
-function ticksSettled(d) {
-  return d.lanes.idle(TICK_WAIT_MS);
-}
-function isPersonId(id) {
-  return /^u[1-9][0-9]{0,15}$/.test(id);
-}
-async function person(d, id) {
-  return isPersonId(id) ? d.store.getUser(id) : null;
-}
-function who(u) {
-  return u.displayName ?? u.discordId ?? u.id;
-}
-async function setAdminFlag(d, admin, targetId, flag) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  if (target.admin === flag)
-    return { ok: true, text: `${who(target)} ${flag ? "is already" : "is not"} an admin.` };
-  if (!flag && d.roster.admins() <= 1)
-    return { ok: false, error: LAST_ADMIN };
-  if (!flag && isConfiguredAdmin(d, target))
-    return { ok: false, error: CONFIGURED_ADMIN };
-  await d.store.updateUser(target.id, { admin: flag });
-  d.log.info(`${admin.id} ${flag ? "made" : "revoked"} ${target.id} ${flag ? "an admin" : "as admin"}`);
-  return { ok: true, text: flag ? `${who(target)} is now an admin.` : `${who(target)} is no longer an admin.` };
-}
-async function resumeDelivery(d, admin, targetId) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  const resumed = await d.health.resume(target.id, d.clock.now());
-  if (!resumed)
-    return { ok: false, error: `Delivery to ${who(target)} is not paused.` };
-  return { ok: true, text: `Delivery to ${who(target)} resumed; ${resumed.tasks.length} task(s) back on.` };
-}
-async function liftDeclineBlock(d, admin, blockId) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const block = /^b[1-9][0-9]{0,15}$/.test(blockId) ? await d.store.getBlock(blockId) : null;
-  const now = d.clock.now();
-  if (!block || (await activeBlock(d.store, block.ownerId, block.recipientId, now))?.id !== block.id)
-    return { ok: false, error: NO_SUCH_BLOCK };
-  await liftBlock(d.store, { userId: admin.id, admin: true }, block.id, now);
-  const owner = await d.store.getUser(block.ownerId);
-  const recipient = await d.store.getUser(block.recipientId);
-  return {
-    ok: true,
-    text: `Lifted: ${owner ? who(owner) : block.ownerId} may invite ${recipient ? who(recipient) : block.recipientId} again.`
-  };
-}
-async function forgetPerson(d, actor, targetId) {
-  if (actor.id !== targetId && !actor.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  if (target.admin && d.roster.admins() <= 1)
-    return { ok: false, error: LAST_ADMIN };
-  if (actor.id !== target.id && isConfiguredAdmin(d, target))
-    return { ok: false, error: CONFIGURED_ADMIN };
-  const now = d.clock.now();
-  const erased = await d.health.exclusive(async () => {
-    if (d.lanes.busy())
-      return null;
-    const e = d.roster.erase(target.id);
-    for (const taskId of e.freed)
-      await d.health.release(taskId, null, "resumed: a recipient left the tracker", now);
-    return e;
-  });
-  if (erased === null)
-    return { ok: false, error: BUSY };
-  if (!d.roster.checkpoint())
-    d.log.warn(`after forgetting ${target.id}: the write-ahead log is busy, so SQLite's next checkpoint copies it back`);
-  const total = Object.values(erased.rows).reduce((a, b) => a + b, 0);
-  d.log.info(`forgot ${target.id} (${actor.id === target.id ? "at their own request" : `removed by ${actor.id}`}): ${total} row(s) deleted`);
-  return { ok: true, text: actor.id === target.id ? "Everything the tracker held about you is deleted." : `${who(target)} is removed from the tracker.` };
-}
-
 // node_modules/@rackbops/styles/rackbops-noir/bundle.css
 var bundle_default = `:where([data-rb-style], [data-rb-style] *), :where([data-rb-style], [data-rb-style] *):before, :where([data-rb-style], [data-rb-style] *):after {
   box-sizing: border-box;
@@ -8289,14 +8410,15 @@ function cadence(entry, viewer, now) {
     return "once";
   return describeSchedule(s, entry.from ?? viewer, viewer.timeZone, now);
 }
-function newLinks(v) {
+function newLinks(v, research) {
   return html`<p class="tr-row">
 <a class="rb-btn rb-btn--primary rb-btn--sm" href="${v.base}/new/reminder">New reminder</a>
 <a class="rb-btn rb-btn--ghost rb-btn--sm" href="${v.base}/new/renewal">New renewal</a>
 <a class="rb-btn rb-btn--ghost rb-btn--sm" href="${v.base}/new/price">New price tracker</a>
+${research ? html`<a class="rb-btn rb-btn--ghost rb-btn--sm" href="${v.base}/new/research">New research request</a>` : null}
 </p>`;
 }
-function tasksPage(v, data, now, flash = null) {
+function tasksPage(v, data, now, flash = null, research = false) {
   const rows = data.entries.map((e) => html`<tr>
 <td><a class="rb-link" href="${v.base}/tasks/${e.task.id}">${e.task.title}</a></td>
 <td>${e.from ? name3(e.from) : "you"}</td>
@@ -8315,7 +8437,7 @@ function tasksPage(v, data, now, flash = null) {
 <h1>My tasks</h1>
 ${flash}
 <p class="rb-muted">Times are in ${v.user.timeZone}.</p>
-${newLinks(v)}
+${newLinks(v, research)}
 ${active}
 </section>
 ${paused}
@@ -8405,6 +8527,7 @@ function errorPage(base, title, message) {
 
 // plugins/tracker/src/web/editor-pages.ts
 var EDITOR_TYPES = ["reminder", "renewal", "price"];
+var NEW_TYPES = [...EDITOR_TYPES, "research"];
 var REPEAT_OPTIONS = [["none", "once"], ["day", "daily"], ["week", "weekly"], ["month", "monthly"]];
 var UNIT_OPTIONS = [["year", "yearly"], ["month", "monthly"], ["week", "weekly"], ["day", "daily"]];
 var BASELINE_OPTIONS = [["last", "the last price seen"], ["first", "the first price seen"], ["peak", "the highest price seen"]];
@@ -8414,8 +8537,16 @@ var PRICE_SETTINGS = [
   { name: "drop", label: "Alert on a drop of at least (percent)", kind: "text", decimal: true, help: "1 to 90; 10 when empty." },
   { name: "baseline", label: "Measure the drop from", kind: "select", options: BASELINE_OPTIONS }
 ];
+var RESEARCH_FIELDS = [
+  { name: "question", label: "What to look into", kind: "textarea", required: true, maxlength: MAX_QUESTION_CHARS },
+  { name: "context", label: "Context", kind: "textarea", maxlength: MAX_CONTEXT_CHARS, help: "Anything that narrows it down. Only you see it here; it goes to the model with the question." },
+  { name: "deadline", label: "Deadline", kind: "text", maxlength: MAX_WHEN, help: 'For example "fri 17:00". Past it nothing more is run.' },
+  { name: "at", label: "Start", kind: "text", maxlength: MAX_WHEN, help: "Leave it empty to start now." }
+];
 function fieldsFor(type, mode) {
   switch (type) {
+    case "research":
+      return mode === "new" ? RESEARCH_FIELDS : [];
     case "reminder":
       return [
         { name: "text", label: "Remind me to", kind: "text", required: true, maxlength: MAX_REMINDER_TEXT },
@@ -8458,6 +8589,13 @@ function field(f, values) {
 <label class="rb-label" for="${f.name}">${f.label}</label>
 <select class="rb-select" id="${f.name}" name="${f.name}">${(f.options ?? []).map(([v, label]) => html`<option value="${v}"${v === value ? html` selected` : null}>${label}</option>`)}</select>
 ${help}
+</div>`;
+  }
+  if (f.kind === "textarea") {
+    return html`<div class="rb-field">
+<label class="rb-label" for="${f.name}">${f.label}</label>
+<textarea class="rb-textarea" id="${f.name}" name="${f.name}" rows="4"${f.maxlength ? html` maxlength="${f.maxlength}"` : null}${f.required ? html` required` : null}>${value}</textarea>
+${help}
 </div>`;
   }
   const type = f.kind === "number" ? "number" : f.kind === "date" ? "date" : f.kind === "url" ? "url" : "text";
@@ -8473,19 +8611,25 @@ function alert(error) {
 function taskHref(v, id, action = "") {
   return `${v.base}/tasks/${encodeURIComponent(id)}${action ? `/${action}` : ""}`;
 }
-var NOUN = { reminder: "reminder", renewal: "renewal", price: "price tracker" };
-function newTaskPage(v, type, values, error) {
-  const intro = type === "price" ? html`<p class="rb-muted">I read the page once now; nothing is made unless I find a price in it.</p>` : null;
-  return framed(v, `New ${NOUN[type]}`, html`<section>
-<p><a class="rb-link" href="${v.base}/">My tasks</a></p>
-<h1>New ${NOUN[type]}</h1>
-${intro}
-${alert(error)}
+var NOUN = { reminder: "reminder", renewal: "renewal", price: "price tracker", research: "research request" };
+var INTRO = {
+  price: "I read the page once now; nothing is made unless I find a price in it.",
+  research: "A research run looks it up on the web, then a second run checks the answer against its sources; only an answer that passes is DMed to you. It can take a while, and requests share a daily budget."
+};
+function newTaskPage(v, type, values, error, off) {
+  const text = INTRO[type];
+  const intro = text ? html`<p class="rb-muted">${text}</p>` : null;
+  const form = off ? html`<div class="rb-alert rb-alert--warning" role="status"><p>${prose(off)}</p></div>` : html`${alert(error)}
 <form method="post" action="${v.base}/new/${type}" class="tr-stack">
 <input type="hidden" name="csrf" value="${v.csrf}">
 ${fieldsFor(type, "new").map((f) => field(f, values))}
 <div><button class="rb-btn rb-btn--primary" type="submit">Create</button></div>
-</form>
+</form>`;
+  return framed(v, `New ${NOUN[type]}`, html`<section>
+<p><a class="rb-link" href="${v.base}/">My tasks</a></p>
+<h1>New ${NOUN[type]}</h1>
+${intro}
+${form}
 </section>`);
 }
 function editTaskPage(v, task, values, o) {
@@ -8704,6 +8848,45 @@ ${tokenTable(v, tokens, now, (id) => tokenHref(v, id))}
 </section>`);
 }
 
+// plugins/tracker/src/web/ceiling-pages.ts
+function setBy(id, names) {
+  if (id === FORGOTTEN)
+    return "an admin since forgotten";
+  return names.get(id) ?? id;
+}
+function change(c, v, now, names) {
+  const what = c.usd === null || c.calls === null ? "back to the default" : `raised to ${describeLimits({ usd: c.usd, calls: c.calls })}`;
+  return html`<li>${formatInstant(c.at, v.user.timeZone, now)}: ${what}, by ${setBy(c.setBy, names)}</li>`;
+}
+function limitText(n, unit) {
+  return n === null ? `no ${unit} ceiling` : String(n);
+}
+function ceilingSection(v, personId, view, now) {
+  const limits = limitsOf(view.latest, view.defaults);
+  const raised = isRaised(view.latest);
+  const action = `${v.base}/admin/people/${encodeURIComponent(personId)}/ceiling`;
+  const csrf = html`<input type="hidden" name="csrf" value="${v.csrf}">`;
+  const { min, max } = view.bounds;
+  return html`<section>
+<h2>Daily model budget</h2>
+<p>Today: ${view.today.usd.toFixed(2)} USD and ${view.today.calls} model call(s). Ceiling: ${describeLimits(limits)}${raised ? html` <span class="rb-badge">raised</span>` : " (the default)"}.</p>
+<p class="rb-muted">A raise stands until an admin changes it. Setting exactly the default puts them back on it. It may not go below the default (${describeLimits(view.defaults)}) or above the global ceiling (${describeLimits(max)}), which still applies to everyone together. A day ends at midnight Eastern.</p>
+<form method="post" action="${action}" class="tr-stack">
+${csrf}
+<div class="tr-row">
+<div class="rb-field"><label class="rb-label" for="ceiling-usd">Dollars a day</label>
+<input class="rb-input" id="ceiling-usd" name="usd" inputmode="decimal" maxlength="7" value="${limits.usd === null ? "" : limits.usd.toFixed(2)}" required></div>
+<div class="rb-field"><label class="rb-label" for="ceiling-calls">Model calls a day</label>
+<input class="rb-input" id="ceiling-calls" name="calls" inputmode="numeric" maxlength="5" value="${limits.calls === null ? "" : String(limits.calls)}" required></div>
+</div>
+<p class="rb-muted">From ${limitText(min.usd, "dollar")} to ${limitText(max.usd, "dollar")} dollars; from ${limitText(min.calls, "call")} to ${limitText(max.calls, "call")} calls.</p>
+<div class="tr-row"><button class="rb-btn rb-btn--accent" type="submit">Set ceiling</button></div>
+</form>
+${raised ? html`<form method="post" action="${action}">${csrf}<input type="hidden" name="reset" value="yes"><button class="rb-btn rb-btn--ghost" type="submit">Back to the default</button></form>` : null}
+${view.history.length === 0 ? html`<p class="rb-muted">No admin has changed their ceiling.</p>` : html`<h3>Changes</h3><p class="rb-muted">The latest ${HISTORY_SHOWN} at most, newest first.</p><ul>${view.history.map((c) => change(c, v, now, view.names))}</ul>`}
+</section>`;
+}
+
 // plugins/tracker/src/web/admin-pages.ts
 var CONFIGURED_NOTE = "Named in TRACKER_ADMIN_DISCORD_IDS: made an admin again at every start, so they cannot be revoked or removed here. Remove them from the configuration first.";
 var CONFIRM_WORD = "forget";
@@ -8834,7 +9017,7 @@ ${data.rows.length === 0 ? html`<p class="rb-muted">None in that time.</p>` : ht
 function post2(v, p, action, label, style) {
   return html`<form method="post" action="${personHref(v, p.id, action)}">${hidden(v)}<button class="rb-btn ${style} rb-btn--sm" type="submit">${label}</button></form>`;
 }
-function personPage(v, p, tasks, now, result = null, configured = false, tokens = []) {
+function personPage(v, p, tasks, now, result = null, configured = false, tokens = [], budget) {
   return framed(v, nameOf(p), html`<section>
 ${adminNav(v)}
 <h1>${nameOf(p)}${p.admin ? html` <span class="rb-badge">admin</span>` : null}</h1>
@@ -8853,6 +9036,7 @@ ${p.deliveryPausedAt ? post2(v, p, "resume-delivery", "Resume delivery", "rb-btn
 ${configured && p.id !== v.user.id ? null : post2(v, p, "forget", "Remove from the tracker", "rb-btn--danger")}
 </div>
 </section>
+${budget ? ceilingSection(v, p.id, budget, now) : null}
 <section>
 <h2>Their tasks</h2>
 ${tasks.length === 0 ? html`<p class="rb-muted">None.</p>` : html`<ul>${tasks.map((t) => html`<li><a class="rb-link" href="${taskHref(v, t.id)}">${t.title}</a> -- ${t.type}, ${t.status === "archived" ? "deleted" : t.status}</li>`)}</ul>`}
@@ -8920,12 +9104,22 @@ async function peoplePage(a, result, status, allow) {
   return htmlResponse(adminPage(a.v, data, { result, ...allow !== undefined ? { allow } : {} }), status);
 }
 async function onePerson(a, id, result = null) {
-  const p = a.d.roster.people().find((x) => x.id === id);
+  const everyone = a.d.roster.people();
+  const p = everyone.find((x) => x.id === id);
   if (!p)
     return htmlResponse(notFoundPage(a.v.base, a.v), 404);
   const tasks = await a.d.store.listTasks({ ownerId: p.id });
-  const tokens = a.d.apiTokens.listFor(p.id, a.d.clock.now());
-  return htmlResponse(personPage(a.v, p, tasks, a.d.clock.now(), result, isConfiguredAdmin(a.d, p), tokens), result && !result.ok ? 400 : 200);
+  const now = a.d.clock.now();
+  const tokens = a.d.apiTokens.listFor(p.id, now);
+  const budget = {
+    latest: a.d.ceilings.latest(p.id),
+    history: a.d.ceilings.history(p.id),
+    today: await spentToday(a.d.store, p.id, now),
+    defaults: DEFAULT_BUDGET.person,
+    bounds: boundsOf(),
+    names: new Map(everyone.map((x) => [x.id, nameOf(x)]))
+  };
+  return htmlResponse(personPage(a.v, p, tasks, now, result, isConfiguredAdmin(a.d, p), tokens, budget), result && !result.ok ? 400 : 200);
 }
 async function adminGet(a, r) {
   if (r.kind === "admin")
@@ -8976,6 +9170,15 @@ async function adminPost(a, r, form) {
       return htmlResponse(notFoundPage(base, a.v), 404);
     return onePerson(a, owner.whose, { ok: true, text: "Revoked: that token no longer works." });
   }
+  if (r.kind === "admin-ceiling") {
+    const input = form.get("reset") === "yes" ? { reset: true } : { reset: false, usd: form.get("usd") ?? "", calls: form.get("calls") ?? "" };
+    const done = await fresh(a, true, (me) => setCeiling(a.d, me, r.id, input));
+    if (done === null)
+      return unknownPage(base);
+    if (!done.ok && done.error === NO_SUCH_PERSON)
+      return htmlResponse(notFoundPage(base, a.v), 404);
+    return onePerson(a, r.id, said2(done));
+  }
   if (r.kind !== "admin-act")
     return unknownPage(base);
   if (r.action === "forget") {
@@ -9233,6 +9436,21 @@ function reminderInput(form) {
   const when = opt(form, "when");
   return { text: str2(form, "text"), ...when !== undefined ? { when } : {}, repeat: str2(form, "repeat") || "none" };
 }
+function lines(v) {
+  return v?.replace(/\r\n?/g, `
+`);
+}
+function researchInput(form) {
+  const context = lines(opt(form, "context"));
+  const deadline = opt(form, "deadline");
+  const at = opt(form, "at");
+  return {
+    question: lines(str2(form, "question")) ?? "",
+    ...context !== undefined ? { context } : {},
+    ...deadline !== undefined ? { deadline } : {},
+    ...at !== undefined ? { at } : {}
+  };
+}
 function renewalInput(form) {
   const every = int(form, "every");
   const lead = int(form, "lead");
@@ -9336,6 +9554,8 @@ async function makeTask(w, type, form) {
     return asUser(w, (u) => createReminder(w.d, u, reminderInput(form)));
   if (type === "renewal")
     return asUser(w, (u) => createRenewal(w.d, u, renewalInput(form)));
+  if (type === "research")
+    return asUser(w, (u) => createResearch(w.d, u, researchInput(form)));
   const input = priceInput(form);
   if (w.reading.has(w.userId))
     return { ok: false, error: READING };
@@ -9369,9 +9589,12 @@ function actOn(w, taskId, action) {
 var DEFAULTS = {
   reminder: { repeat: "none" },
   renewal: { unit: "year", every: "1", lead: "7" },
-  price: { hours: "12", drop: "10", baseline: "last" }
+  price: { hours: "12", drop: "10", baseline: "last" },
+  research: {}
 };
 function newGet(e, type) {
+  if (type === "research" && !e.d.research)
+    return htmlResponse(newTaskPage(e.v, type, {}, undefined, RESEARCH_OFF));
   return htmlResponse(newTaskPage(e.v, type, type === "renewal" ? { ...DEFAULTS.renewal, currency: "USD" } : DEFAULTS[type]));
 }
 async function newPost(e, type, form) {
@@ -9438,7 +9661,11 @@ function jsonKind(f) {
     return "integer";
   return f.decimal ? "number" : "string";
 }
-function typesAnswer() {
+function offeredTypes(d) {
+  return d.research ? NEW_TYPES : EDITOR_TYPES;
+}
+var NOT_EDITABLE = "A research request cannot be edited. Delete it and ask again.";
+function typesAnswer(d) {
   const describe = (fields, mode) => fields.map((f) => ({
     name: f.name,
     type: jsonKind(f),
@@ -9451,7 +9678,14 @@ function typesAnswer() {
   }));
   return {
     status: 200,
-    body: { types: EDITOR_TYPES.map((type) => ({ type, create: describe(fieldsFor(type, "new"), "new"), edit: describe(fieldsFor(type, "edit"), "edit") })) }
+    body: {
+      types: offeredTypes(d).map((type) => ({
+        type,
+        editable: type !== "research",
+        create: describe(fieldsFor(type, "new"), "new"),
+        edit: describe(fieldsFor(type, "edit"), "edit")
+      }))
+    }
   };
 }
 function asFields(body, type, mode) {
@@ -9481,8 +9715,12 @@ function refusal(error) {
     return notFound();
   if (error === NO_LONGER_LISTED)
     return problem(401, "invalid_token", "The token's owner is no longer on this tracker's list.");
-  if (error === READING)
+  if (error === READING || error === TASK_BUSY)
     return problem(409, "busy", error);
+  if (error === NOT_EDITABLE)
+    return problem(409, "conflict", error);
+  if (error === RESEARCH_OFF)
+    return problem(503, "unavailable", error);
   if (error === FINISHED || /^That task is [a-z]+, not [a-z]+\.$/.test(error))
     return problem(409, "conflict", error);
   if (/^You already (have|track) [0-9]+ /.test(error))
@@ -9501,6 +9739,14 @@ async function taskJson(d, user, task) {
   const type = EDITOR_TYPES.includes(task.type) ? task.type : null;
   const values = editValues(d, user, task);
   const settings = {};
+  if (task.type === "research") {
+    const c = task.config;
+    settings.question = c.question;
+    if (c.context !== undefined)
+      settings.context = c.context;
+    if (c.deadline !== undefined)
+      settings.deadline = c.deadline;
+  }
   if (type) {
     for (const f of fieldsFor(type, "edit")) {
       if (f.name === "when")
@@ -9559,9 +9805,11 @@ async function written(w, user, result, status, base) {
 }
 async function createAnswer(w, user, body, base) {
   const type = body.type;
-  if (typeof type !== "string" || !EDITOR_TYPES.includes(type)) {
-    return problem(400, "invalid", `\`type\` is one of ${EDITOR_TYPES.join(", ")}.`);
+  if (typeof type !== "string" || !NEW_TYPES.includes(type)) {
+    return problem(400, "invalid", `\`type\` is one of ${offeredTypes(w.d).join(", ")}.`);
   }
+  if (type === "research" && !w.d.research)
+    return refusal(RESEARCH_OFF);
   const form = asFields(body, type, "new");
   if (!(form instanceof URLSearchParams))
     return form;
@@ -9570,7 +9818,7 @@ async function createAnswer(w, user, body, base) {
 async function editAnswer(w, user, id, body, base) {
   const task = await editableTask(w.d, user, id);
   if (!task)
-    return notFound();
+    return (await ownLiveTask(w.d, user, id))?.type === "research" ? refusal(NOT_EDITABLE) : notFound();
   const form = asFields(body, task.type, "edit");
   if (!(form instanceof URLSearchParams))
     return form;
@@ -9756,7 +10004,7 @@ async function handleApi(w, request, path) {
   if (method === "DELETE" && r.kind === "task")
     return json2(await actAnswer(writer, user, r.id, "delete"));
   if (r.kind === "types")
-    return json2(typesAnswer());
+    return json2(typesAnswer(w.d));
   if (r.kind === "tasks")
     return json2(await listAnswer(w.d, user));
   if (r.kind === "task")
@@ -9846,6 +10094,7 @@ var TASK_ACTION = /^\/tasks\/([^/]+)\/(edit|pause|resume|delete)$/;
 var NEW_PATH = /^\/new\/([a-z]+)$/;
 var PERSON_PATH = /^\/admin\/people\/([^/]+)$/;
 var PERSON_ACTION = /^\/admin\/people\/([^/]+)\/(grant|revoke|resume-delivery|forget)$/;
+var PERSON_CEILING = /^\/admin\/people\/([^/]+)\/ceiling$/;
 var BLOCK_LIFT = /^\/admin\/blocks\/([^/]+)\/lift$/;
 var TOKEN_REVOKE = /^\/tokens\/([^/]+)\/revoke$/;
 var ADMIN_TOKEN_REVOKE = /^\/admin\/tokens\/([^/]+)\/revoke$/;
@@ -9884,6 +10133,9 @@ function route2(path) {
     return { kind: "admin-deliveries" };
   if (path === "/admin/allow")
     return { kind: "admin-allow" };
+  const ceiling = PERSON_CEILING.exec(path);
+  if (ceiling)
+    return { kind: "admin-ceiling", id: segment2(ceiling[1]) };
   const personAct = PERSON_ACTION.exec(path);
   if (personAct)
     return { kind: "admin-act", id: segment2(personAct[1]), action: personAct[2] };
@@ -9896,7 +10148,7 @@ function route2(path) {
   const created = NEW_PATH.exec(path);
   if (created) {
     const type = created[1];
-    return EDITOR_TYPES.includes(type) ? { kind: "new", type } : null;
+    return NEW_TYPES.includes(type) ? { kind: "new", type } : null;
   }
   const one = TASK_PATH.exec(path) ?? TASK_ACTION.exec(path);
   if (!one)
@@ -9910,7 +10162,7 @@ function route2(path) {
   return { kind: "act", id, action };
 }
 function methodsOf(r) {
-  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
+  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-ceiling" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
     return "POST";
   }
   if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget" || r.kind === "tokens")
@@ -10206,6 +10458,7 @@ function createWebHandler(w) {
           return tokenRevokePost(d, v, r.id);
         case "admin-allow":
         case "admin-act":
+        case "admin-ceiling":
         case "admin-lift":
         case "admin-token-revoke":
           return adminPost(a, r, form);
@@ -10217,7 +10470,7 @@ function createWebHandler(w) {
     const done = url.searchParams.get("done");
     switch (r.kind) {
       case "tasks":
-        return htmlResponse(tasksPage(v, await loadTaskList(d, auth.user), now, notice(done)));
+        return htmlResponse(tasksPage(v, await loadTaskList(d, auth.user), now, notice(done), d.research === true));
       case "task":
         return taskPage(e, r.id, done);
       case "edit":
@@ -10486,7 +10739,8 @@ function createPlugin(host, options = {}) {
           ...options.cityHallFetch ? { fetchImpl: options.cityHallFetch } : {}
         });
       }
-      executeLane = executor ? new ExecuteLane({ store: openedStore, clock, types, notifier, executor, locks }) : null;
+      const ceilings = new Ceilings(opened);
+      executeLane = executor ? new ExecuteLane({ store: openedStore, clock, types, notifier, executor, locks, budget: budgetPolicy(ceilings) }) : null;
       if (cityHallConfig)
         host.log.info(`execute lane on: city-hall ${cityHallConfig.url}, capability ${cityHallConfig.capability}`);
       else if ("missing" in cityHall && cityHall.missing.length > 0)
@@ -10506,6 +10760,7 @@ function createPlugin(host, options = {}) {
         sessions: new Sessions(opened),
         apiTokens: new ApiTokens(opened),
         roster: new Roster(opened),
+        ceilings,
         configuredAdmins: new Set(adminIds),
         lanes,
         webEditor: webOrigin !== null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.11.0",
-  "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops and one-off research (through city-hall, with its findings) by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks, an admin view (with the DMs that did not arrive), forget-me, and a JSON task API with personal API tokens",
+  "version": "0.13.0",
+  "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops and one-off research (through city-hall, with its findings) by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed), an admin view (with the DMs that did not arrive, and raising a person's daily model ceiling), forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",
   "files": ["dist"],