Merge app/v3 into workstreams/main

README.md

@@ -188,8 +188,9 @@ ChatGPT plan, Ollama and any OpenAI-compatible endpoint.
 
 ## Model Pool
 
-Installs can pool what they have measured about models. It is on by
-default: what an install sends is computed, text-free numbers about the models
+Installs can pool what they have measured about models. It is off by
+default. Turn it on with `model_pool = on` in settings or
+`CODEAF_MODEL_POOL=on`. When enabled, what an install sends is computed, text-free numbers about the models
 it ran (role, model, a number, which model judged, door, size bucket, day) under
 a per-install nonce, never code,
 prompts, paths or an identity, and `codeaf pool status` shows exactly what is

cmd/codeaf-replay/replay_test.go

@@ -243,6 +243,11 @@ func TestEveryTagTheBuildWritesResolvesToARoleSomebodyDeclared(t *testing.T) {
 // that passes forever the moment somebody builds a tag out of a variable, which
 // is exactly how the log came to carry 2,309 untagged rows in the first place.
 var derivedTags = map[string]func(yield func(tag, where string)){
+	// internal/knowledge/compiler_provider.go tags each compile call with the
+	// lane role memory runs under; that is the whole of what it can be.
+	"string(lanes.RoleMemory)": func(yield func(tag, where string)) {
+		yield("memory", "internal/knowledge/compiler_provider.go, a memory compile call")
+	},
 	// internal/session/toolask.go: a tool's own call carries the tool's name
 	// after the role word, and no walk can enumerate the belt.
 	"toolCallTag(question.tool)": func(yield func(tag, where string)) {

cmd/codeaf/app.go

@@ -123,6 +123,9 @@ func runApp(args []string) error {
 			return err
 		}
 	}
+	if err := holdAppHome(); err != nil {
+		return err
+	}
 	// STDOUT IS THE PROTOCOL'S AND NOBODY ELSE'S. The wire keeps the real
 	// descriptor, and anything else in this process that prints to stdout
 	// lands on stderr, where the app collects logs.
@@ -175,12 +178,16 @@ func runApp(args []string) error {
 	if *turnLong > 0 {
 		backend.turnLong = *turnLong
 	}
+	defer backend.watchSpendRows()()
 	// The crews are watched from the start: a manager's start or a member
 	// woken by its manager must not wait for the window to ask for crews.
 	backend.memoryStore = func() (*store.Store, error) {
 		proc, err := openAppEngineProcess()
-		if err != nil || proc.Memory == nil {
-			return nil, errors.New("memory is off")
+		if err != nil {
+			return nil, err
+		}
+		if proc.Memory == nil {
+			return nil, errors.New("this engine has no saved memory store")
 		}
 		return proc.Memory, nil
 	}
@@ -368,6 +375,9 @@ func appOpenInProcess(ask appOpenAsk) (*appConn, error) {
 			}
 			eng, err := assembleEngine(h, workspace, transcript, workspace, ask.IntentSiblingNames)
 			if err == nil {
+				// In-process chats are the desktop's hot path. Remote surfaces keep
+				// one frame per event until someone measures them.
+				eng.DeltaWindow = remote.DefaultDeltaWindow
 				err = enableAppConversationModels(eng.Agent, ask.Models)
 			}
 			if err == nil && ask.AutomaticModels != nil {
@@ -707,6 +717,9 @@ type appBackend struct {
 	dayAuth appDayAuthority
 	// today replaces the usage ledger's figure for today in a test.
 	today func(time.Time) float64
+	// spendRowsPending holds one read of today's figure for rows written
+	// together (watchSpendRows).
+	spendRowsPending atomic.Bool
 	// turnLong is how long a reply runs before turn.long ([appTurnLong]).
 	turnLong time.Duration
 	// inbox is every open ask as one list (appinbox.go); emit is its tap.
@@ -4242,7 +4255,15 @@ func (b *appBackend) SpendToday() (appwire.Spend, error) {
 	if err != nil {
 		return appwire.Spend{}, appEngineError(err)
 	}
-	return appwire.Spend{TodayUSD: spent, DayCapUSD: appFigure(limit)}, nil
+	spend := appwire.Spend{TodayUSD: spent, DayCapUSD: appFigure(limit)}
+	if b.today == nil {
+		reading, err := session.ReadDailySpend(session.UsageLedgerPath(), now)
+		if err != nil {
+			return appwire.Spend{}, appEngineError(err)
+		}
+		spend.FactoryAIUSD = appFigure(reading.FactoryAIUSD)
+	}
+	return spend, nil
 }
 
 // appSpendSettle is how long after a turn ends its spending is read again: the
@@ -4275,6 +4296,19 @@ func (b *appBackend) spendMoved(after func(appwire.Spend)) {
 	})
 }
 
+// watchSpendRows says spend.changed for ledger rows no turn ended with. Rows
+// that arrive together cost one read. The answer stops the watching.
+func (b *appBackend) watchSpendRows() (stop func()) {
+	return session.OnUsageWritten(func() {
+		if b.spendRowsPending.CompareAndSwap(false, true) {
+			time.AfterFunc(appSpendSettle, func() {
+				b.spendRowsPending.Store(false)
+				b.spendMoved(nil)
+			})
+		}
+	})
+}
+
 // ListTasks reads the agent's tasks off the disk whether or not its
 // conversation is held — its own checkpoint first, which holds every task it
 // ever had, finished ones included, then its project's task index for any the

cmd/codeaf/app_factory.go

@@ -562,7 +562,13 @@ func (h *appFactoryHost) runWorker(ctx context.Context, target factoryTarget) {
 	turns := factoryShapeTurnsFrom(h.floor, h.workspace, h.profile, current)
 	turns.refusal = source.Refusal
 	turns.liveOK = factoryLiveOK(raw, h.profile)
-	runner := buildFactoryRunner(mirror, h.floor, h.workspace, h.profile, h.stepMaker(mirror, source), turns)
+	maker := h.stepMaker(mirror, source)
+	if target.url == h.address {
+		// Memory admission reads Pause and Stop before their worker signal arrives.
+		// Receipts still book on the mirror and follow its ordinary settlement path.
+		maker.memoryOwner = h.floor
+	}
+	runner := buildFactoryRunner(mirror, h.floor, h.workspace, h.profile, maker, turns)
 	dial := h.runnerDial(target)
 	machine, _ := os.Hostname()
 	kind := api.RunnerCI

cmd/codeaf/app_home.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/filelock"
+	"github.com/Agent-Field/codeaf/internal/home"
+)
+
+// appHomeLock stays reachable until process death. Closing it when runApp
+// returns would admit a new engine while main still finishes saving. The OS
+// releases it on any exit, so a crash leaves nothing to clean up.
+var appHomeLock *os.File
+
+// appHomeWait is how long an engine waits for one that is closing the same home.
+// It outlasts the longest careful wrap-up, so an update's replacement engine
+// starts as soon as the old one ends.
+var appHomeWait = appLeaveWait + 10*time.Second
+
+const appHomePoll = 50 * time.Millisecond
+
+// holdAppHome makes this the one engine on this home. Two engines would both
+// spend on the same work. It runs before anything that could make a paid call.
+func holdAppHome() error {
+	if err := os.MkdirAll(home.Dir(), 0700); err != nil {
+		return err
+	}
+	file, err := os.OpenFile(home.Join("app.lock"), os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		return err
+	}
+	deadline := time.Now().Add(appHomeWait)
+	for {
+		err := filelock.Lock(file, true, true)
+		if err == nil {
+			appHomeLock = file
+			return nil
+		}
+		if !filelock.IsBusy(err) {
+			_ = file.Close()
+			return fmt.Errorf("hold codeaf app home: %w", err)
+		}
+		if time.Now().After(deadline) {
+			_ = file.Close()
+			return fmt.Errorf("another codeaf app is still closing this home after %s; nothing was started. Quit it, then open the app again", appHomeWait)
+		}
+		time.Sleep(appHomePoll)
+	}
+}

cmd/codeaf/app_lend.go

@@ -200,6 +200,9 @@ func appLendLive(agent *session.Agent, ask appOpenAsk, hello remote.Hello) (*app
 		SessionFile: ask.Transcript,
 		Resumed:     true,
 	}
+	// In-process chats are the desktop's hot path. Remote surfaces keep
+	// one frame per event until someone measures them.
+	engine.DeltaWindow = remote.DefaultDeltaWindow
 	sess := remote.NewSession(engine, true)
 	loop, err := remote.LoopbackAttach(hello, remote.AttachOptions{
 		Open: func(remote.Hello) (*remote.Session, error) { return sess, nil },