@rackbops/plugin-tracker 0.12.0 → 0.14.0

package/README.md

@@ -12,7 +12,9 @@ your own tasks from the web, under the commands' own rules -- the admin view and
 slice 3) -- the JSON task API with personal API tokens (#80, slice 4), for a program acting as
 you, such as a later intake agent (plan E10) -- and the one-off research request (#82, plan E8,
 category 5): a question looked into on the web by a model run, checked by a second run against its
-sources, and DMed once, with its claims kept as findings. The model runs never happen here: they go
+sources, and DMed once, with its claims kept as findings -- and an admin raising one person's
+daily model ceiling from the web (#82, plan 5.7), with an operator switch that turns the daily
+ceilings off for the alpha and an admin page of daily model usage to evaluate it by. The model runs never happen here: they go
 through city-hall to Rackbops/docket-runner on roshne's own host (plan 5.12), and the whole execute
 lane stays off until the city-hall Executor is configured (Configuration below).
 
@@ -124,8 +126,13 @@ says research is not available; it does not list the waiting ones (`/tasks` does
 
 **Budgets** (plan 5.7, docket's defaults): 2 USD and 20 model calls a person a day, 10 USD and 100
 calls in all. At a ceiling the person's research waits until midnight Eastern; the person gets one
-DM and the admins one each. Reminders, renewals and prices never count. There is no web control to
-raise a person's ceiling yet.
+DM and the admins one each. Reminders, renewals and prices never count. An admin can raise one
+person's ceiling from their admin page (0.13.0, below); the global ceiling still applies to everyone
+together. **For the alpha the ceilings can be switched off** (0.14.0; roshne, 2026-10-02, choosing option
+A: "A.  but lets build in an unlimited budget "flag" during alpha, evaluate usage during alpha, then
+test budgets during beta"): with `TRACKER_BUDGET_UNLIMITED` on (Configuration, below) no daily ceiling holds a run,
+while each Job's own caps (15 turns and 1 USD for a research run) still bound it and every run is
+still charged, so `/admin/usage` (below) shows what the defaults would have held.
 
 **Findings.** A passed research answer's claims are stored with their first source (docket's
 `findings`), shown on the task's page to its owner, accepted recipients and admins (docket's
@@ -262,8 +269,36 @@ the function the command path runs:
 - **Lift** a decline block in force: docket's `liftBlock`, recorded as that admin's lift.
 - **Revoke an API token** of anyone's, from their page, which lists their tokens (never the
   secret). It stops working at once; the owner is not told. Logged by token id.
+- **Raise a person's daily ceiling** (0.13.0, plan 5.7: "The admin raises a person's ceiling from
+  the web area"). Their page shows what they spent today (the budget day ends at midnight Eastern),
+  their ceiling now, a form with both numbers -- dollars to the cent and whole model calls -- and
+  the latest 20 changes an admin made, newest first (older ones stay in the table). Each number
+  must be at least the default (2 USD, 20 calls) and at most the global ceiling (10 USD, 100
+  calls), which docket checks first anyway; those bounds are proposed on #82, roshne's to confirm.
+  Setting exactly the default is a reset to it, not a raise.
+  **A raise stands until an admin changes it** -- raises it again or presses **Back to the
+  default**. That default is proposed on #82 and is roshne's to confirm; a today-only raise
+  would be a small change (`limitsOf` and `isRaised` plus a clock in `Ceilings`, and the page's
+  badge). Enforcement stays docket's: the
+  execute lane hands docket's `budgetHold` a policy whose `personFor` reads the person's newest
+  change, before every run, so a raise lets a held request run on the next tick. docket
+  sends its ceiling notices once a day per person (`noticeOnce`, key `budget:person:<id>:<day>`),
+  so every change -- raise or reset -- deletes that person's key for the current budget day in the
+  same transaction: meeting the new ceiling the same day DMs the person and the admins again (plan
+  5.7: "nothing fails silently"). Every change is an append-only `ceiling_changes` row (who, for whom, the values,
+  when) and a log line (`u1 set u2's daily ceiling to 4 USD / 40 calls (c1)`).
 - **Remove from the tracker**: forget-me for that person (below), with the same confirmation.
 
+**Usage** (0.14.0). `/admin/usage`, linked from every admin page, shows the model spend per budget
+day (midnight Eastern) for the last 14 days, newest first: dollars and calls for everyone together,
+then per person. Each row is measured against the default ceilings, not a person's raise -- a
+"would have hit the 20 call limit" (or "2.00 USD") marker on a day that reached one, and how many
+calls were charged after it had, roughly what that ceiling would have held (docket checks before a
+run and charges at its end). It reads docket's `usage` table, which every run is charged to whether
+budgets are on or off -- the way to evaluate the alpha with `TRACKER_BUDGET_UNLIMITED` on
+(Configuration, below). Read-only, and like every admin page answers anyone who is not an admin
+with the unknown page's 404.
+
 **Deliveries** (0.10.0). `/admin/deliveries`, linked from every admin page, lists the DMs that
 settled `failed`, `unconfirmed` or `deferred` in the last 30 days, newest first, at most 200 rows
 (the page says how many matched when the bound cuts it). Each row: the task (its title, linking to
@@ -273,8 +308,11 @@ have gone out and is never resent; `deferred` is still owed (a recipient whose d
 say). Before 0.10.0 these showed only in the bot log, where the warnings still go. The page is
 read-only, and like every admin page answers anyone who is not an admin with the unknown page's 404.
 
-Not here yet, though plan 5.10 lists them: grants, budgets and retry (they belong to the execute
-lane, which is not built) and an admin pause of someone else's task.
+Not here yet, though plan 5.10 lists them: grants and retry, and an admin pause of someone else's
+task. Of budgets, raising one person's ceiling and the usage page are here; the global ceiling and
+the defaults are docket's constants, and turning budgets off is the operator's
+`TRACKER_BUDGET_UNLIMITED`, not a web control. While it is on, the ceiling section says the ceiling
+is not enforced; a change is still recorded and applies once it is off.
 
 **Forget me** (plan 5.8). A signed-in person erases themselves from `/forget` (web only: the plan
 asks for no Discord command, so without `TRACKER_WEB_URL` the only path is an admin with the web
@@ -286,14 +324,15 @@ in one SQLite transaction in the write queue, **deleted, not archived**:
 - on everyone else's tasks: their recipient rows, their replies and answers, the history rows they
   made or that name them (an invitation of them, a pause for them), the run events and deliveries
   of DMs to them (docket's `deleteDeliveries`), charges made for them, and their pause rows;
-- the budget notices kept for them (`budget:person:<id>:...`);
+- the budget notices kept for them (`budget:person:<id>:...`) and the changes to their ceiling;
 - every decline block they are either side of;
 - their admission, delivery health, web sessions, unused sign-in links and API tokens, and their
   person row.
 
 What stays, and why: another person's task that they received stays that owner's; one paused only
 because DMs to them failed goes back on. Another person's row keeps its own audit fact but not their
-id -- `admitted_by` of someone they admitted, and `lifted_by` of a block they lifted, become
+id -- `admitted_by` of someone they admitted, `lifted_by` of a block they lifted, and `set_by` of a
+change they made to someone's ceiling become
 `forgotten` ("an admin since forgotten"; null already means "the configuration"). Text is matched
 only in the forms the code writes a person's id into -- docket's consent rows (`u5`, `u5 24h`), the
 tracker's `u5: ...` removals and `delivery to {u5} paused` pauses, docket's `u5 <message>` delivery
@@ -477,6 +516,7 @@ $ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: B
 | Store | `src/store.ts`, `src/schema.ts` | docket's `Store` port on `bun:sqlite`, in `<dataDir>/tracker/tracker.sqlite` (WAL). A Discord id belongs to at most one user. Schema versioned by `PRAGMA user_version`; a shipped migration is never edited. Schema 5 (0.9.0) is docket 0.4.0's: a run's `record`, a series point's `key`, `deliveries` (from `delivery_claims`), `usage` and `notices`. Schema 6 (0.11.0) is docket 0.5.0's, all additive: `findings`, a charge's `usage.key`, and the Executor's `executor_jobs`. Forget-me erases a person's findings and their runs' Job records too. `store.test.ts` runs docket's `STORE_CONTRACT` against it. |
 | Notify lane | `src/notify-lane.ts` | docket's `Lanes.tickNotify` on two host ticks, every 60 s, one pass per task with work (a due run, a run in flight, a DM owed or claimed), each under that task's lock through a view of the store limited to that task: `notify` runs every type but the page readers, `poll` runs only them (`price`) with the Fetch port, so a slow page never holds up a reminder. A task the execute tick holds is left for the next notify tick, never waited on. Registers `reminder`, `renewal`, `price` and `research`. |
 | Execute lane | `src/execute-lane.ts`, `src/executor.ts`, `src/research.ts` | Only when the city-hall Executor is configured: a third host tick, `execute`, that starts docket's `Lanes.tickExecute` in the background (one at a time, at most once a minute) over every task with a due execute-lane run, reserving those tasks and then holding their locks in id order, through one docket `Lanes` kept while the plugin is active (docket keeps its usage-limit pause on it). The Executor is city-hall#18's source pair (above), its I/O injected; `executor_jobs` keeps each Job key's city-hall id. `/research`'s rules. |
+| Budgets, usage | `src/ceilings.ts`, `src/usage.ts`; `src/web/ceiling-pages.ts`, `src/web/usage-pages.ts` | The execute lane's `BudgetPolicy` (docket's defaults plus each person's raise, or no ceiling at all while `TRACKER_BUDGET_UNLIMITED` is on), the ceiling changes, and the pure usage report `/admin/usage` renders from docket's `usage` table. |
 | Page reads | `src/fetch.ts` | docket's `Fetch` port for `price`: http or https on the default port, no credentials, every resolved address public (no loopback, private, link-local, CGNAT, multicast or reserved range, IPv4 or IPv6), redirects followed by hand and re-checked (at most 5), 15 s including the name lookup, at most 3 MB kept. The body is then rebuilt in linear time (`src/page.ts`) to just what extraction reads -- JSON-LD, meta tags, and the page with every `<` blanked, so `near` still reads text, attributes and script data -- because docket's extraction patterns take quadratic time on a page of unclosed tags. A read the tick's abort cuts short requeues its run instead of counting a miss. A DNS answer that changes between the check and the read is not caught here. |
 | Renewals, prices | `src/tracked.ts`, `src/price.ts`, `src/series.ts`, `src/page.ts` | `/renewal`, `/price` and `/task decide`; the series lines of `/task history`. The series (docket's `series` table, schema 1) holds a renewal's paid amounts and a price's readings. |
 | Delivery | `src/notifier.ts`, `src/buttons.ts` | docket's `Notifier` over `host.dm`, with the buttons. docket claims each (run, person) in the store's `deliveries` before the DM and settles it after. The notifier maps the host's answers to docket's errors: cannot be messaged (50007) or an unknown user is `DeliveryFailedError(msg, true)` (failed for good; 50007 and 10013 count toward the pause); a message refused for its content is a plain `DeliveryFailedError` (retried); a paused person is `ExecutorUnavailableError` (deferred); anything else is rethrown, so docket settles it unconfirmed and never resends it. |
@@ -497,6 +537,7 @@ $ curl -s https://clerk.example.com/tracker/api/v1/tasks/t9 -H "Authorization: B
 | `TRACKER_ADMIN_DISCORD_IDS` | no | Comma-separated Discord user ids (spaces around commas allowed; an empty entry, as from a trailing comma, is refused and the plugin does not load) made admin at start. Unset = none. Removing an id does not revoke it. |
 | `TRACKER_GUILD_ID` | no | The Discord server whose members may use the tracker, or a comma-separated list of them (spaces around commas allowed; a repeated id counts once): a member of any listed server passes. Checked through the interaction's client with a single-member lookup per server (no privileged intent), all asked at once; a yes from any server is a member, a no from every server is not, and otherwise the answer is unknown (refused, never revoked). Inside a listed server, the person running a command needs no lookup. Unset = no membership gate, and a warning is logged each time the plugin activates; a malformed or empty entry anywhere in the list refuses to load, naming it. One store and one admission list serve every listed server; there are no per-server admins. |
 | `TRACKER_WEB_URL` | no | The https origin the bot's HTTP is reached at through its tunnel, e.g. `https://clerk.example.com` (no path). `/web` links and the allowed `Origin` come from it, never from a request's `Host`. Unset = no web area (`/web` says so, the pages answer 404); anything but a bare https origin refuses to load. |
+| `TRACKER_BUDGET_UNLIMITED` | no | Budgets off for the alpha (0.14.0): `true` or `1` means no daily ceiling -- a person's or the global one -- holds a model run, bot-wide. Each Job's own caps still apply, usage is still recorded (see `/admin/usage`), the bot logs one line at start saying so (or, with the execute lane off, that no model work runs), the People and Usage admin pages show a "Budgets off (alpha): unlimited" banner, and the person page's ceiling section shows a "not enforced" note. Unset, empty, `false` or `0` = the ceilings apply (the default); anything else refuses to load. |
 | `TRACKER_CITY_HALL_URL` | no | The https origin of the city-hall that queues the tracker's model Jobs (no path). |
 | `TRACKER_CITY_HALL_KEY` | yes | The source bearer key city-hall checks on `/api/execute/jobs` (its `CITY_HALL_API_KEY`, city-hall#18). Never logged. Kept in the instance's own env, never in a repo. |
 | `TRACKER_CITY_HALL_CAPABILITY` | no | The capability tag every Job names, one only docket-runner carries (plan item 71), e.g. `claude-cli:subscription`. No default: a guessed tag could send the tracker's Jobs to another agent. |
@@ -517,8 +558,8 @@ key>`, so two databases never collide.
 
 ## Not yet
 
-- The rest of the web area (E5): sharing a task from the web, and the admin view's grants, budgets
-  (raising a person's ceiling) and retry. The task API makes reminders, renewals, prices and
+- The rest of the web area (E5): sharing a task from the web, and the admin view's grants and
+  retry. The task API makes reminders, renewals, prices and
   research requests -- not `/task done`, `snooze`, `decide`, `share` or the settings -- and no intake agent uses it yet
   (E10, deferred). Discord OAuth2 as a second sign-in
   method, if chosen (plan item 41).

package/dist/plugin.js

@@ -3189,6 +3189,208 @@ class Admissions {
   }
 }
 
+// plugins/tracker/src/admin.ts
+var NO_SUCH_PERSON = "There is no such person on this tracker's list.";
+var NO_SUCH_BLOCK = "There is no such block in force.";
+var LAST_ADMIN = "That is the tracker's only admin: make someone else an admin first.";
+var BUSY = "The tracker is busy sending reminders; nothing was deleted. Try again in a minute.";
+var TICK_WAIT_MS = 20000;
+var CONFIGURED_ADMIN = "That admin is named in TRACKER_ADMIN_DISCORD_IDS, which makes them an admin again at every start: remove them from the configuration first.";
+var CONFIGURED_SELF = "You are named in TRACKER_ADMIN_DISCORD_IDS: this erases you now, but the next start makes you an admin again, as a new person, unless you are removed from the configuration first.";
+function isConfiguredAdmin(d, u) {
+  return u.discordId !== null && d.configuredAdmins.has(u.discordId);
+}
+function ticksSettled(d) {
+  return d.lanes.idle(TICK_WAIT_MS);
+}
+function isPersonId(id) {
+  return /^u[1-9][0-9]{0,15}$/.test(id);
+}
+async function person(d, id) {
+  return isPersonId(id) ? d.store.getUser(id) : null;
+}
+function who(u) {
+  return u.displayName ?? u.discordId ?? u.id;
+}
+async function setAdminFlag(d, admin, targetId, flag) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  if (target.admin === flag)
+    return { ok: true, text: `${who(target)} ${flag ? "is already" : "is not"} an admin.` };
+  if (!flag && d.roster.admins() <= 1)
+    return { ok: false, error: LAST_ADMIN };
+  if (!flag && isConfiguredAdmin(d, target))
+    return { ok: false, error: CONFIGURED_ADMIN };
+  await d.store.updateUser(target.id, { admin: flag });
+  d.log.info(`${admin.id} ${flag ? "made" : "revoked"} ${target.id} ${flag ? "an admin" : "as admin"}`);
+  return { ok: true, text: flag ? `${who(target)} is now an admin.` : `${who(target)} is no longer an admin.` };
+}
+async function resumeDelivery(d, admin, targetId) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  const resumed = await d.health.resume(target.id, d.clock.now());
+  if (!resumed)
+    return { ok: false, error: `Delivery to ${who(target)} is not paused.` };
+  return { ok: true, text: `Delivery to ${who(target)} resumed; ${resumed.tasks.length} task(s) back on.` };
+}
+async function liftDeclineBlock(d, admin, blockId) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const block = /^b[1-9][0-9]{0,15}$/.test(blockId) ? await d.store.getBlock(blockId) : null;
+  const now = d.clock.now();
+  if (!block || (await activeBlock(d.store, block.ownerId, block.recipientId, now))?.id !== block.id)
+    return { ok: false, error: NO_SUCH_BLOCK };
+  await liftBlock(d.store, { userId: admin.id, admin: true }, block.id, now);
+  const owner = await d.store.getUser(block.ownerId);
+  const recipient = await d.store.getUser(block.recipientId);
+  return {
+    ok: true,
+    text: `Lifted: ${owner ? who(owner) : block.ownerId} may invite ${recipient ? who(recipient) : block.recipientId} again.`
+  };
+}
+async function forgetPerson(d, actor, targetId) {
+  if (actor.id !== targetId && !actor.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = await person(d, targetId);
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  if (target.admin && d.roster.admins() <= 1)
+    return { ok: false, error: LAST_ADMIN };
+  if (actor.id !== target.id && isConfiguredAdmin(d, target))
+    return { ok: false, error: CONFIGURED_ADMIN };
+  const now = d.clock.now();
+  const erased = await d.health.exclusive(async () => {
+    if (d.lanes.busy())
+      return null;
+    const e = d.roster.erase(target.id);
+    for (const taskId of e.freed)
+      await d.health.release(taskId, null, "resumed: a recipient left the tracker", now);
+    return e;
+  });
+  if (erased === null)
+    return { ok: false, error: BUSY };
+  if (!d.roster.checkpoint())
+    d.log.warn(`after forgetting ${target.id}: the write-ahead log is busy, so SQLite's next checkpoint copies it back`);
+  const total = Object.values(erased.rows).reduce((a, b) => a + b, 0);
+  d.log.info(`forgot ${target.id} (${actor.id === target.id ? "at their own request" : `removed by ${actor.id}`}): ${total} row(s) deleted`);
+  return { ok: true, text: actor.id === target.id ? "Everything the tracker held about you is deleted." : `${who(target)} is removed from the tracker.` };
+}
+
+// plugins/tracker/src/ceilings.ts
+function boundsOf(policy = DEFAULT_BUDGET) {
+  return { min: policy.person, max: policy.global };
+}
+function limitsOf(latest, defaults = DEFAULT_BUDGET.person) {
+  if (!latest || latest.usd === null || latest.calls === null)
+    return defaults;
+  return { usd: latest.usd, calls: latest.calls };
+}
+var USD = /^[0-9]{1,4}(\.[0-9]{1,2})?$/;
+var CALLS = /^[0-9]{1,5}$/;
+function money2(n) {
+  return `${n.toFixed(2)} USD`;
+}
+function decideCeiling(input, bounds = boundsOf()) {
+  if (input.reset)
+    return { ok: true, limits: null };
+  const usdText = input.usd.trim();
+  const callsText = input.calls.trim();
+  if (!USD.test(usdText))
+    return { ok: false, error: "Give the dollars as a number, like 4 or 4.50." };
+  if (!CALLS.test(callsText))
+    return { ok: false, error: "Give the model calls as a whole number, like 40." };
+  const usd = Number(usdText);
+  const calls = Number(callsText);
+  const { min, max } = bounds;
+  if (min.usd !== null && usd < min.usd)
+    return { ok: false, error: `The dollars cannot go below the default, ${money2(min.usd)}.` };
+  if (min.calls !== null && calls < min.calls)
+    return { ok: false, error: `The model calls cannot go below the default, ${min.calls}.` };
+  if (max.usd !== null && usd > max.usd)
+    return { ok: false, error: `The dollars cannot go above the global ceiling, ${money2(max.usd)} a day.` };
+  if (max.calls !== null && calls > max.calls)
+    return { ok: false, error: `The model calls cannot go above the global ceiling, ${max.calls} a day.` };
+  if (usd === min.usd && calls === min.calls)
+    return { ok: true, limits: null };
+  return { ok: true, limits: { usd, calls } };
+}
+function describeLimits(l) {
+  const usd = l.usd === null ? "no dollar ceiling" : money2(l.usd);
+  const calls = l.calls === null ? "no call ceiling" : `${l.calls} model calls`;
+  return `${usd} and ${calls} a day`;
+}
+function isRaised(latest) {
+  return latest !== null && latest.usd !== null && latest.calls !== null;
+}
+function budgetNoticeKey(userId, at) {
+  return `budget:person:${userId}:${budgetDay(at).day}`;
+}
+var NOT_ENFORCED = "Budgets are off (alpha): TRACKER_BUDGET_UNLIMITED is on, so no ceiling is enforced; this one applies once it is turned off.";
+var HISTORY_SHOWN = 20;
+function toChange(r) {
+  return { id: `c${r.seq}`, userId: r.user_id, usd: r.usd, calls: r.calls, setBy: r.set_by, at: r.at };
+}
+
+class Ceilings {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  latest(userId) {
+    const r = this.db.query("SELECT * FROM ceiling_changes WHERE user_id = ? ORDER BY seq DESC LIMIT 1").get(userId);
+    return r ? toChange(r) : null;
+  }
+  history(userId, limit = HISTORY_SHOWN) {
+    return this.db.query("SELECT * FROM ceiling_changes WHERE user_id = ? ORDER BY seq DESC LIMIT ?").all(userId, limit).map(toChange);
+  }
+  record(userId, limits, setBy, at) {
+    return this.db.transaction(() => {
+      const r = this.db.query("INSERT INTO ceiling_changes (user_id, usd, calls, set_by, at) VALUES (?, ?, ?, ?, ?) RETURNING *").get(userId, limits?.usd ?? null, limits?.calls ?? null, setBy, at);
+      this.db.query("DELETE FROM notices WHERE key = ?").run(budgetNoticeKey(userId, new Date(at)));
+      return toChange(r);
+    })();
+  }
+  personFor(user) {
+    const latest = this.latest(user.id);
+    return isRaised(latest) ? limitsOf(latest) : null;
+  }
+}
+function budgetPolicy(ceilings, base = DEFAULT_BUDGET) {
+  return { person: base.person, global: base.global, personFor: (u) => ceilings.personFor(u) };
+}
+async function spentToday(store, userId, now) {
+  const day = budgetDay(now);
+  const rows = await store.listUsage({ userId, since: day.start, before: day.end });
+  return spent(rows);
+}
+function who2(u) {
+  return u.displayName ?? u.discordId ?? u.id;
+}
+async function setCeiling(d, admin, targetId, input) {
+  if (!admin.admin)
+    return { ok: false, error: NOT_ADMIN };
+  const target = isPersonId(targetId) ? await d.store.getUser(targetId) : null;
+  if (!target)
+    return { ok: false, error: NO_SUCH_PERSON };
+  const decided = decideCeiling(input);
+  if (!decided.ok)
+    return { ok: false, error: decided.error };
+  const before = d.ceilings.latest(target.id);
+  if (decided.limits === null && !isRaised(before))
+    return { ok: true, text: `${who2(target)} is already on the default ceiling.` };
+  const change = d.ceilings.record(target.id, decided.limits, admin.id, d.clock.now().toISOString());
+  const now = limitsOf(change);
+  const note = d.budgetUnlimited ? ` ${NOT_ENFORCED}` : "";
+  d.log.info(`${admin.id} set ${target.id}'s daily ceiling to ${decided.limits === null ? "the default" : `${now.usd} USD / ${now.calls} calls`} (${change.id})`);
+  return decided.limits === null ? { ok: true, text: `${who2(target)} is back on the default ceiling: ${describeLimits(now)}.${note}` } : { ok: true, text: `${who2(target)}'s ceiling is now ${describeLimits(now)}, until an admin changes it.${note}` };
+}
+
 // plugins/tracker/src/delivery-health.ts
 var PAUSE_AFTER = 3;
 var PAUSE_DETAIL = `delivery paused: ${PAUSE_AFTER} DMs in a row could not be delivered (DMs closed, or the bot is blocked)`;
@@ -4201,6 +4403,18 @@ var MIGRATIONS = [
     paused_at TEXT
   );
   CREATE INDEX executor_jobs_occurrence ON executor_jobs (occurrence_id);
+  `,
+  `
+  CREATE TABLE ceiling_changes (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id TEXT NOT NULL,
+    usd REAL,
+    calls INTEGER,
+    set_by TEXT NOT NULL,
+    at TEXT NOT NULL,
+    CHECK ((usd IS NULL) = (calls IS NULL))
+  );
+  CREATE INDEX ceiling_changes_user ON ceiling_changes (user_id, seq);
   `
 ];
 var BUSY_TIMEOUT_MS = 5000;
@@ -6849,6 +7063,8 @@ class Roster {
       del("web_login_tokens", "user_id = ?", userId);
       del("api_tokens", "user_id = ?", userId);
       del("notices", "key LIKE 'budget:person:' || ? || ':%'", userId);
+      del("ceiling_changes", "user_id = ?", userId);
+      this.db.query("UPDATE ceiling_changes SET set_by = ? WHERE set_by = ?").run(FORGOTTEN, userId);
       del("users", "seq = ?", Number(seq));
       const held = this.db.query("SELECT 1 FROM delivery_pauses WHERE task_id = ? LIMIT 1");
       const freed = [...new Set(pausedFor)].filter((t) => held.get(t) === null);
@@ -6857,99 +7073,6 @@ class Roster {
   }
 }
 
-// plugins/tracker/src/admin.ts
-var NO_SUCH_PERSON = "There is no such person on this tracker's list.";
-var NO_SUCH_BLOCK = "There is no such block in force.";
-var LAST_ADMIN = "That is the tracker's only admin: make someone else an admin first.";
-var BUSY = "The tracker is busy sending reminders; nothing was deleted. Try again in a minute.";
-var TICK_WAIT_MS = 20000;
-var CONFIGURED_ADMIN = "That admin is named in TRACKER_ADMIN_DISCORD_IDS, which makes them an admin again at every start: remove them from the configuration first.";
-var CONFIGURED_SELF = "You are named in TRACKER_ADMIN_DISCORD_IDS: this erases you now, but the next start makes you an admin again, as a new person, unless you are removed from the configuration first.";
-function isConfiguredAdmin(d, u) {
-  return u.discordId !== null && d.configuredAdmins.has(u.discordId);
-}
-function ticksSettled(d) {
-  return d.lanes.idle(TICK_WAIT_MS);
-}
-function isPersonId(id) {
-  return /^u[1-9][0-9]{0,15}$/.test(id);
-}
-async function person(d, id) {
-  return isPersonId(id) ? d.store.getUser(id) : null;
-}
-function who(u) {
-  return u.displayName ?? u.discordId ?? u.id;
-}
-async function setAdminFlag(d, admin, targetId, flag) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  if (target.admin === flag)
-    return { ok: true, text: `${who(target)} ${flag ? "is already" : "is not"} an admin.` };
-  if (!flag && d.roster.admins() <= 1)
-    return { ok: false, error: LAST_ADMIN };
-  if (!flag && isConfiguredAdmin(d, target))
-    return { ok: false, error: CONFIGURED_ADMIN };
-  await d.store.updateUser(target.id, { admin: flag });
-  d.log.info(`${admin.id} ${flag ? "made" : "revoked"} ${target.id} ${flag ? "an admin" : "as admin"}`);
-  return { ok: true, text: flag ? `${who(target)} is now an admin.` : `${who(target)} is no longer an admin.` };
-}
-async function resumeDelivery(d, admin, targetId) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  const resumed = await d.health.resume(target.id, d.clock.now());
-  if (!resumed)
-    return { ok: false, error: `Delivery to ${who(target)} is not paused.` };
-  return { ok: true, text: `Delivery to ${who(target)} resumed; ${resumed.tasks.length} task(s) back on.` };
-}
-async function liftDeclineBlock(d, admin, blockId) {
-  if (!admin.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const block = /^b[1-9][0-9]{0,15}$/.test(blockId) ? await d.store.getBlock(blockId) : null;
-  const now = d.clock.now();
-  if (!block || (await activeBlock(d.store, block.ownerId, block.recipientId, now))?.id !== block.id)
-    return { ok: false, error: NO_SUCH_BLOCK };
-  await liftBlock(d.store, { userId: admin.id, admin: true }, block.id, now);
-  const owner = await d.store.getUser(block.ownerId);
-  const recipient = await d.store.getUser(block.recipientId);
-  return {
-    ok: true,
-    text: `Lifted: ${owner ? who(owner) : block.ownerId} may invite ${recipient ? who(recipient) : block.recipientId} again.`
-  };
-}
-async function forgetPerson(d, actor, targetId) {
-  if (actor.id !== targetId && !actor.admin)
-    return { ok: false, error: NOT_ADMIN };
-  const target = await person(d, targetId);
-  if (!target)
-    return { ok: false, error: NO_SUCH_PERSON };
-  if (target.admin && d.roster.admins() <= 1)
-    return { ok: false, error: LAST_ADMIN };
-  if (actor.id !== target.id && isConfiguredAdmin(d, target))
-    return { ok: false, error: CONFIGURED_ADMIN };
-  const now = d.clock.now();
-  const erased = await d.health.exclusive(async () => {
-    if (d.lanes.busy())
-      return null;
-    const e = d.roster.erase(target.id);
-    for (const taskId of e.freed)
-      await d.health.release(taskId, null, "resumed: a recipient left the tracker", now);
-    return e;
-  });
-  if (erased === null)
-    return { ok: false, error: BUSY };
-  if (!d.roster.checkpoint())
-    d.log.warn(`after forgetting ${target.id}: the write-ahead log is busy, so SQLite's next checkpoint copies it back`);
-  const total = Object.values(erased.rows).reduce((a, b) => a + b, 0);
-  d.log.info(`forgot ${target.id} (${actor.id === target.id ? "at their own request" : `removed by ${actor.id}`}): ${total} row(s) deleted`);
-  return { ok: true, text: actor.id === target.id ? "Everything the tracker held about you is deleted." : `${who(target)} is removed from the tracker.` };
-}
-
 // node_modules/@rackbops/styles/rackbops-noir/bundle.css
 var bundle_default = `:where([data-rb-style], [data-rb-style] *), :where([data-rb-style], [data-rb-style] *):before, :where([data-rb-style], [data-rb-style] *):after {
   box-sizing: border-box;
@@ -8727,6 +8850,114 @@ ${tokenTable(v, tokens, now, (id) => tokenHref(v, id))}
 </section>`);
 }
 
+// plugins/tracker/src/web/ceiling-pages.ts
+function setBy(id, names) {
+  if (id === FORGOTTEN)
+    return "an admin since forgotten";
+  return names.get(id) ?? id;
+}
+function change(c, v, now, names) {
+  const what = c.usd === null || c.calls === null ? "back to the default" : `raised to ${describeLimits({ usd: c.usd, calls: c.calls })}`;
+  return html`<li>${formatInstant(c.at, v.user.timeZone, now)}: ${what}, by ${setBy(c.setBy, names)}</li>`;
+}
+function limitText(n, unit) {
+  return n === null ? `no ${unit} ceiling` : String(n);
+}
+function ceilingSection(v, personId, view, now) {
+  const limits = limitsOf(view.latest, view.defaults);
+  const raised = isRaised(view.latest);
+  const action = `${v.base}/admin/people/${encodeURIComponent(personId)}/ceiling`;
+  const csrf = html`<input type="hidden" name="csrf" value="${v.csrf}">`;
+  const { min, max } = view.bounds;
+  return html`<section>
+<h2>Daily model budget</h2>
+${view.unlimited ? html`<div class="rb-alert rb-alert--warning" role="status"><p>${NOT_ENFORCED}</p></div>` : null}
+<p>Today: ${view.today.usd.toFixed(2)} USD and ${view.today.calls} model call(s). Ceiling: ${describeLimits(limits)}${raised ? html` <span class="rb-badge">raised</span>` : " (the default)"}${view.unlimited ? " -- not enforced" : null}.</p>
+<p class="rb-muted">A raise stands until an admin changes it. Setting exactly the default puts them back on it. It may not go below the default (${describeLimits(view.defaults)}) or above the global ceiling (${describeLimits(max)}), which still applies to everyone together. A day ends at midnight Eastern.</p>
+<form method="post" action="${action}" class="tr-stack">
+${csrf}
+<div class="tr-row">
+<div class="rb-field"><label class="rb-label" for="ceiling-usd">Dollars a day</label>
+<input class="rb-input" id="ceiling-usd" name="usd" inputmode="decimal" maxlength="7" value="${limits.usd === null ? "" : limits.usd.toFixed(2)}" required></div>
+<div class="rb-field"><label class="rb-label" for="ceiling-calls">Model calls a day</label>
+<input class="rb-input" id="ceiling-calls" name="calls" inputmode="numeric" maxlength="5" value="${limits.calls === null ? "" : String(limits.calls)}" required></div>
+</div>
+<p class="rb-muted">From ${limitText(min.usd, "dollar")} to ${limitText(max.usd, "dollar")} dollars; from ${limitText(min.calls, "call")} to ${limitText(max.calls, "call")} calls.</p>
+<div class="tr-row"><button class="rb-btn rb-btn--accent" type="submit">Set ceiling</button></div>
+</form>
+${raised ? html`<form method="post" action="${action}">${csrf}<input type="hidden" name="reset" value="yes"><button class="rb-btn rb-btn--ghost" type="submit">Back to the default</button></form>` : null}
+${view.history.length === 0 ? html`<p class="rb-muted">No admin has changed their ceiling.</p>` : html`<h3>Changes</h3><p class="rb-muted">The latest ${HISTORY_SHOWN} at most, newest first.</p><ul>${view.history.map((c) => change(c, v, now, view.names))}</ul>`}
+</section>`;
+}
+
+// plugins/tracker/src/usage.ts
+var BUDGET_UNLIMITED_KEY = "TRACKER_BUDGET_UNLIMITED";
+function parseBudgetUnlimited(raw) {
+  const value = (raw ?? "").trim().toLowerCase();
+  if (value === "" || value === "false" || value === "0")
+    return false;
+  if (value === "true" || value === "1")
+    return true;
+  throw new Error(`${BUDGET_UNLIMITED_KEY} must be true, 1, false or 0 (or unset)`);
+}
+var NO_LIMITS = Object.freeze({ usd: null, calls: null });
+var UNLIMITED_BUDGET = Object.freeze({ person: NO_LIMITS, global: NO_LIMITS });
+function executeBudget(ceilings, unlimited) {
+  return unlimited ? UNLIMITED_BUDGET : budgetPolicy(ceilings);
+}
+var UNLIMITED_LOG = `budgets off (alpha): ${BUDGET_UNLIMITED_KEY} is on, so no daily ceiling holds a model run; each Job's own caps still apply and usage is still recorded`;
+var UNLIMITED_IDLE_LOG = `${BUDGET_UNLIMITED_KEY} is on, but the execute lane is off, so no model work runs for it to leave unbudgeted`;
+var UNLIMITED_BANNER = "Budgets off (alpha): unlimited. No daily ceiling holds a model run while TRACKER_BUDGET_UNLIMITED is on; usage is still recorded.";
+var USAGE_DAYS = 14;
+function usageWindow(now, days = USAGE_DAYS) {
+  const out = [budgetDay(now)];
+  while (out.length < days)
+    out.unshift(budgetDay(new Date(Date.parse(out[0].start) - 1)));
+  return out;
+}
+function measure(rows, limits) {
+  const total = { usd: 0, calls: 0 };
+  let past = 0;
+  for (const r of rows) {
+    if (reached(total, limits) !== null)
+      past += r.calls;
+    total.usd += r.costUsd;
+    total.calls += r.calls;
+  }
+  return { ...total, reached: reached(total, limits), past };
+}
+function byAt(a, b) {
+  return a.at < b.at ? -1 : a.at > b.at ? 1 : 0;
+}
+function usageReport(rows, now, days = USAGE_DAYS, policy = DEFAULT_BUDGET) {
+  const window = usageWindow(now, days);
+  const index = new Map(window.map((w, i) => [w.day, i]));
+  const buckets = window.map(() => []);
+  for (const r of [...rows].sort(byAt)) {
+    const i = index.get(budgetDay(new Date(r.at)).day);
+    if (i !== undefined)
+      buckets[i]?.push(r);
+  }
+  const out = window.map((w, i) => {
+    const dayRows = buckets[i] ?? [];
+    const users = [...new Set(dayRows.map((r) => r.userId))];
+    const people = users.map((userId) => ({ userId, ...measure(dayRows.filter((r) => r.userId === userId), policy.person) })).sort((a, b) => b.usd - a.usd || b.calls - a.calls || (a.userId < b.userId ? -1 : 1));
+    return { day: w.day, everyone: measure(dayRows, policy.global), people };
+  });
+  return {
+    days: out.reverse(),
+    person: policy.person,
+    global: policy.global,
+    since: window[0].start,
+    before: window.at(-1).end
+  };
+}
+async function loadUsage(store, now, days = USAGE_DAYS) {
+  const window = usageWindow(now, days);
+  const rows = await store.listUsage({ since: window[0].start, before: window.at(-1).end });
+  return usageReport(rows, now, days);
+}
+
 // plugins/tracker/src/web/admin-pages.ts
 var CONFIGURED_NOTE = "Named in TRACKER_ADMIN_DISCORD_IDS: made an admin again at every start, so they cannot be revoked or removed here. Remove them from the configuration first.";
 var CONFIRM_WORD = "forget";
@@ -8748,7 +8979,10 @@ function hidden(v) {
   return html`<input type="hidden" name="csrf" value="${v.csrf}">`;
 }
 function adminNav(v) {
-  return html`<p class="tr-row"><a class="rb-link" href="${v.base}/admin">People</a> <a class="rb-link" href="${v.base}/admin/tasks">All tasks</a> <a class="rb-link" href="${v.base}/admin/deliveries">Deliveries</a></p>`;
+  return html`<p class="tr-row"><a class="rb-link" href="${v.base}/admin">People</a> <a class="rb-link" href="${v.base}/admin/tasks">All tasks</a> <a class="rb-link" href="${v.base}/admin/deliveries">Deliveries</a> <a class="rb-link" href="${v.base}/admin/usage">Usage</a></p>`;
+}
+function budgetsOffBanner(unlimited) {
+  return unlimited ? html`<div class="rb-alert rb-alert--warning" role="status"><p><strong>${UNLIMITED_BANNER}</strong></p></div>` : null;
 }
 function personHref(v, id, action = "") {
   return `${v.base}/admin/people/${encodeURIComponent(id)}${action ? `/${action}` : ""}`;
@@ -8783,6 +9017,7 @@ function adminPage(v, data, o = {}) {
   return framed(v, "Admin", html`<section>
 <h1>People</h1>
 ${adminNav(v)}
+${budgetsOffBanner(o.unlimited === true)}
 ${flash(o.result ?? null)}
 <div class="rb-table-scroll"><table class="rb-table">
 <thead><tr><th scope="col">Person</th><th scope="col">Status</th><th scope="col">Zone, hour</th><th scope="col">Delivery</th><th scope="col">Tasks</th></tr></thead>
@@ -8857,7 +9092,7 @@ ${data.rows.length === 0 ? html`<p class="rb-muted">None in that time.</p>` : ht
 function post2(v, p, action, label, style) {
   return html`<form method="post" action="${personHref(v, p.id, action)}">${hidden(v)}<button class="rb-btn ${style} rb-btn--sm" type="submit">${label}</button></form>`;
 }
-function personPage(v, p, tasks, now, result = null, configured = false, tokens = []) {
+function personPage(v, p, tasks, now, result = null, configured = false, tokens = [], budget) {
   return framed(v, nameOf(p), html`<section>
 ${adminNav(v)}
 <h1>${nameOf(p)}${p.admin ? html` <span class="rb-badge">admin</span>` : null}</h1>
@@ -8876,6 +9111,7 @@ ${p.deliveryPausedAt ? post2(v, p, "resume-delivery", "Resume delivery", "rb-btn
 ${configured && p.id !== v.user.id ? null : post2(v, p, "forget", "Remove from the tracker", "rb-btn--danger")}
 </div>
 </section>
+${budget ? ceilingSection(v, p.id, budget, now) : null}
 <section>
 <h2>Their tasks</h2>
 ${tasks.length === 0 ? html`<p class="rb-muted">None.</p>` : html`<ul>${tasks.map((t) => html`<li><a class="rb-link" href="${taskHref(v, t.id)}">${t.title}</a> -- ${t.type}, ${t.status === "archived" ? "deleted" : t.status}</li>`)}</ul>`}
@@ -8917,6 +9153,48 @@ ${hidden(v)}
 </section>`);
 }
 
+// plugins/tracker/src/web/usage-pages.ts
+function marker(m, limits) {
+  if (m.reached === null)
+    return html`<span class="rb-muted">under</span>`;
+  const which = m.reached === "calls" ? `${limits.calls} call` : `${(limits.usd ?? 0).toFixed(2)} USD`;
+  const past = m.past > 0 ? `; ${m.past} call(s) after it` : "";
+  return html`<span class="rb-badge">would have hit the ${which} limit</span>${past}`;
+}
+function row(day, who, m, limits) {
+  return html`<tr>
+<td>${day ?? ""}</td>
+<td>${who}</td>
+<td>${m.usd.toFixed(2)}</td>
+<td>${m.calls}</td>
+<td>${marker(m, limits)}</td>
+</tr>`;
+}
+function adminUsagePage(v, data) {
+  const { report, names } = data;
+  const rows = report.days.map((d) => {
+    if (d.everyone.calls === 0 && d.everyone.usd === 0) {
+      return html`<tr><td>${d.day}</td><td colspan="4" class="rb-muted">No model use.</td></tr>`;
+    }
+    return [
+      row(d.day, html`<strong>Everyone</strong>`, d.everyone, report.global),
+      ...d.people.map((p) => row(null, html`<a class="rb-link" href="${personHref(v, p.userId)}">${names.get(p.userId) ?? p.userId}</a>`, p, report.person))
+    ];
+  });
+  const total = report.days.reduce((s, d) => ({ usd: s.usd + d.everyone.usd, calls: s.calls + d.everyone.calls }), { usd: 0, calls: 0 });
+  return framed(v, "Usage", html`<section>
+<h1>Model usage</h1>
+${adminNav(v)}
+${budgetsOffBanner(data.unlimited)}
+<p>The last ${report.days.length} days, newest first: ${total.usd.toFixed(2)} USD and ${total.calls} model call(s) in all. A day ends at midnight Eastern. Dollars are the CLI's list-price estimate, not a bill.</p>
+<p class="rb-muted">Each row is measured against the default ceilings -- ${describeLimits(report.person)} a person, ${describeLimits(report.global)} for everyone together -- not a person's raised one. "Would have hit" means that day's spend reached the ceiling; "calls after it" are the calls charged once it had, roughly what it would have held (the ceiling is checked before a run and the run charged at its end).${data.unlimited ? " While budgets are off, nothing is held." : ""}</p>
+<div class="rb-table-scroll"><table class="rb-table">
+<thead><tr><th scope="col">Day</th><th scope="col">Who</th><th scope="col">USD</th><th scope="col">Calls</th><th scope="col">Default ceiling</th></tr></thead>
+<tbody>${rows}</tbody>
+</table></div>
+</section>`);
+}
+
 // plugins/tracker/src/web/admin.ts
 function unknownPage(base) {
   return htmlResponse(notFoundPage(base), 404);
@@ -8940,21 +9218,37 @@ function confirmed(form) {
 var WRONG_WORD = `Type ${CONFIRM_WORD} to confirm. Nothing was deleted.`;
 async function peoplePage(a, result, status, allow) {
   const data = { people: a.d.roster.people(), blocks: a.d.roster.activeBlocks(a.d.clock.now()), now: a.d.clock.now() };
-  return htmlResponse(adminPage(a.v, data, { result, ...allow !== undefined ? { allow } : {} }), status);
+  return htmlResponse(adminPage(a.v, data, { result, unlimited: a.d.budgetUnlimited === true, ...allow !== undefined ? { allow } : {} }), status);
 }
 async function onePerson(a, id, result = null) {
-  const p = a.d.roster.people().find((x) => x.id === id);
+  const everyone = a.d.roster.people();
+  const p = everyone.find((x) => x.id === id);
   if (!p)
     return htmlResponse(notFoundPage(a.v.base, a.v), 404);
   const tasks = await a.d.store.listTasks({ ownerId: p.id });
-  const tokens = a.d.apiTokens.listFor(p.id, a.d.clock.now());
-  return htmlResponse(personPage(a.v, p, tasks, a.d.clock.now(), result, isConfiguredAdmin(a.d, p), tokens), result && !result.ok ? 400 : 200);
+  const now = a.d.clock.now();
+  const tokens = a.d.apiTokens.listFor(p.id, now);
+  const budget = {
+    latest: a.d.ceilings.latest(p.id),
+    history: a.d.ceilings.history(p.id),
+    today: await spentToday(a.d.store, p.id, now),
+    defaults: DEFAULT_BUDGET.person,
+    bounds: boundsOf(),
+    names: new Map(everyone.map((x) => [x.id, nameOf(x)])),
+    unlimited: a.d.budgetUnlimited === true
+  };
+  return htmlResponse(personPage(a.v, p, tasks, now, result, isConfiguredAdmin(a.d, p), tokens, budget), result && !result.ok ? 400 : 200);
 }
 async function adminGet(a, r) {
   if (r.kind === "admin")
     return peoplePage(a, null, 200);
   if (r.kind === "admin-person")
     return onePerson(a, r.id);
+  if (r.kind === "admin-usage") {
+    const now = a.d.clock.now();
+    const people = new Map(a.d.roster.people().map((p) => [p.id, nameOf(p)]));
+    return htmlResponse(adminUsagePage(a.v, { report: await loadUsage(a.d.store, now), names: people, unlimited: a.d.budgetUnlimited === true }));
+  }
   const people = new Map(a.d.roster.people().map((p) => [p.id, nameOf(p)]));
   if (r.kind === "admin-deliveries") {
     const now = a.d.clock.now();
@@ -8999,6 +9293,15 @@ async function adminPost(a, r, form) {
       return htmlResponse(notFoundPage(base, a.v), 404);
     return onePerson(a, owner.whose, { ok: true, text: "Revoked: that token no longer works." });
   }
+  if (r.kind === "admin-ceiling") {
+    const input = form.get("reset") === "yes" ? { reset: true } : { reset: false, usd: form.get("usd") ?? "", calls: form.get("calls") ?? "" };
+    const done = await fresh(a, true, (me) => setCeiling(a.d, me, r.id, input));
+    if (done === null)
+      return unknownPage(base);
+    if (!done.ok && done.error === NO_SUCH_PERSON)
+      return htmlResponse(notFoundPage(base, a.v), 404);
+    return onePerson(a, r.id, said2(done));
+  }
   if (r.kind !== "admin-act")
     return unknownPage(base);
   if (r.action === "forget") {
@@ -9914,6 +10217,7 @@ var TASK_ACTION = /^\/tasks\/([^/]+)\/(edit|pause|resume|delete)$/;
 var NEW_PATH = /^\/new\/([a-z]+)$/;
 var PERSON_PATH = /^\/admin\/people\/([^/]+)$/;
 var PERSON_ACTION = /^\/admin\/people\/([^/]+)\/(grant|revoke|resume-delivery|forget)$/;
+var PERSON_CEILING = /^\/admin\/people\/([^/]+)\/ceiling$/;
 var BLOCK_LIFT = /^\/admin\/blocks\/([^/]+)\/lift$/;
 var TOKEN_REVOKE = /^\/tokens\/([^/]+)\/revoke$/;
 var ADMIN_TOKEN_REVOKE = /^\/admin\/tokens\/([^/]+)\/revoke$/;
@@ -9950,8 +10254,13 @@ function route2(path) {
     return { kind: "admin-tasks" };
   if (path === "/admin/deliveries")
     return { kind: "admin-deliveries" };
+  if (path === "/admin/usage")
+    return { kind: "admin-usage" };
   if (path === "/admin/allow")
     return { kind: "admin-allow" };
+  const ceiling = PERSON_CEILING.exec(path);
+  if (ceiling)
+    return { kind: "admin-ceiling", id: segment2(ceiling[1]) };
   const personAct = PERSON_ACTION.exec(path);
   if (personAct)
     return { kind: "admin-act", id: segment2(personAct[1]), action: personAct[2] };
@@ -9978,7 +10287,7 @@ function route2(path) {
   return { kind: "act", id, action };
 }
 function methodsOf(r) {
-  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
+  if (r.kind === "logout" || r.kind === "act" || r.kind === "admin-allow" || r.kind === "admin-act" || r.kind === "admin-ceiling" || r.kind === "admin-lift" || r.kind === "token-revoke" || r.kind === "admin-token-revoke") {
     return "POST";
   }
   if (r.kind === "settings" || r.kind === "edit" || r.kind === "new" || r.kind === "forget" || r.kind === "tokens")
@@ -10274,6 +10583,7 @@ function createWebHandler(w) {
           return tokenRevokePost(d, v, r.id);
         case "admin-allow":
         case "admin-act":
+        case "admin-ceiling":
         case "admin-lift":
         case "admin-token-revoke":
           return adminPost(a, r, form);
@@ -10299,6 +10609,7 @@ function createWebHandler(w) {
       case "admin":
       case "admin-tasks":
       case "admin-deliveries":
+      case "admin-usage":
       case "admin-person":
         return adminGet(a, r);
       default:
@@ -10349,6 +10660,7 @@ function createPlugin(host, options = {}) {
   const guildIds = parseGuildIds(host.env.TRACKER_GUILD_ID);
   const webOrigin = parseWebUrl(host.env.TRACKER_WEB_URL);
   const cityHall = parseCityHallConfig(host.env);
+  const budgetUnlimited = parseBudgetUnlimited(host.env[BUDGET_UNLIMITED_KEY]);
   const cityHallConfig = cityHall.config;
   const executeOn = cityHallConfig !== null || options.executor !== undefined;
   const clock = options.clock ?? { now: () => new Date };
@@ -10554,7 +10866,10 @@ function createPlugin(host, options = {}) {
           ...options.cityHallFetch ? { fetchImpl: options.cityHallFetch } : {}
         });
       }
-      executeLane = executor ? new ExecuteLane({ store: openedStore, clock, types, notifier, executor, locks }) : null;
+      const ceilings = new Ceilings(opened);
+      executeLane = executor ? new ExecuteLane({ store: openedStore, clock, types, notifier, executor, locks, budget: executeBudget(ceilings, budgetUnlimited) }) : null;
+      if (budgetUnlimited)
+        host.log.info(executeLane ? UNLIMITED_LOG : UNLIMITED_IDLE_LOG);
       if (cityHallConfig)
         host.log.info(`execute lane on: city-hall ${cityHallConfig.url}, capability ${cityHallConfig.capability}`);
       else if ("missing" in cityHall && cityHall.missing.length > 0)
@@ -10574,6 +10889,8 @@ function createPlugin(host, options = {}) {
         sessions: new Sessions(opened),
         apiTokens: new ApiTokens(opened),
         roster: new Roster(opened),
+        ceilings,
+        budgetUnlimited,
         configuredAdmins: new Set(adminIds),
         lanes,
         webEditor: webOrigin !== null,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rackbops/plugin-tracker",
-  "version": "0.12.0",
-  "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops and one-off research (through city-hall, with its findings) by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed), an admin view (with the DMs that did not arrive), forget-me, and a JSON task API with personal API tokens",
+  "version": "0.14.0",
+  "description": "The task tracker for Rackbops Clerk: reminders, renewals, price drops and one-off research (through city-hall, with its findings) by slash command, delivered by DM with buttons, on docket's SQLite store (/allow, /register, /remind, /renewal, /price, /research, /tasks, /task, /settings, /web), with a web area for your tasks, history and settings, a web editor to make, change, pause and delete your own tasks (research requests too, made but not changed), an admin view (with the DMs that did not arrive, raising a person's daily model ceiling, and daily model usage per person), an operator switch that turns the daily budgets off for the alpha, forget-me, and a JSON task API with personal API tokens",
   "type": "module",
   "main": "dist/plugin.js",
   "files": ["dist"],
@@ -44,6 +44,13 @@
         "secret": false,
         "description": "The https origin the bot's HTTP is reached at through its tunnel, e.g. https://clerk.example.com (no path). /web links to <this>/tracker/login, and a form post from any other origin is refused. Unset = no web area: /web says so and its pages answer 404."
       },
+      {
+        "key": "TRACKER_BUDGET_UNLIMITED",
+        "format": "^ *([Tt][Rr][Uu][Ee]|[Ff][Aa][Ll][Ss][Ee]|1|0)? *$",
+        "required": false,
+        "secret": false,
+        "description": "Budgets off for the alpha: true or 1 means no daily ceiling (per person or for everyone) holds a model run, bot-wide. Each Job's own caps still apply, usage is still recorded, the People and Usage admin pages show a budgets-off banner, and the person page shows a not-enforced note. Unset, empty, false or 0 = the daily ceilings apply (the default); anything else refuses to load."
+      },
       {
         "key": "TRACKER_CITY_HALL_URL",
         "format": "^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?/?$",