lane

package
v0.4.2-rc.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 28, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Overview

Package lane is what this build believes about the machines behind a model.

── WHY THERE IS A PACKAGE AT ALL ───────────────────────────────────────────

A model id is an address; the LANE is the machine. One model id is served by a dozen endpoints that differ by 7× on the wait before the first token and by 12× on how fast they write, at roughly the same price — and they differ in CAPABILITY too, so the fastest of them may be the one that drops the tool call. Choosing among them is a bigger speed lever than choosing the model, and until this package nothing in the build held an opinion about it that survived either a restart or a request.

The package holds the opinion and nothing else. It has no transport: it never opens a connection, never reads a clock of its own, and never draws anything. A sighting is handed to it, a request is asked of it, and what comes back is a preference some other layer puts on a wire. That boundary is the whole design — see docs/ARCHITECTURE.md, "Lanes" — and four structural tests in this directory hold it.

── THE LAWS ────────────────────────────────────────────────────────────────

NO FETCH ON THE SEND PATH. The sheet is refreshed on a beat, never by a request that is about to be sent. A missing sheet means "no prior, use the belief alone" — it never means "wait while I go and look".

EVERY NUMBER A PERSON SEES IS THE POSTERIOR. The sheet is a thirty-minute aggregate over everybody's prompts; our own sightings are about our prompts from our region. Both are evidence and neither is truth, so what a picker shows is the belief that combined them, never the raw sheet row.

QUALITY IS A GATE AND NEVER A WEIGHT. A lane that drops tool calls, truncates or returns JSON the decoder refuses leaves the candidate set. Weighing quality against price is how a router learns to ship wrong answers cheaply.

A HEDGE IS A MEASUREMENT. The second request a slow stream earns is also the only cheap way to learn what the alternative lane would have done, so its result is fed back as a sighting like any other.

NO FIXED THRESHOLDS. The four constants the strike ledger ran on — two seconds, thirty tokens a second, fifteen seconds, two strikes — are what this package exists to retire. Slow means "surprising for this lane, ten minutes ago", which is a number the posterior already carries.

── ONE MODEL, ONE NAME IN THE LEDGER ───────────────────────────────────────

A belief is only worth keeping if the next session asks for it under the same name. The tier suffix was the first way that broke and BareModel is the answer to it; the FLOATING ALIAS is the second, and it is worse, because the shipped default is one.

`~deepseek/deepseek-v4-flash-latest` is what the config carries, what the operator sees and what goes on the wire; OpenRouter resolves it on its side, per request, and publishes the endpoints page under the concrete model it currently points at. So on 2026-09-01 the sighting side filed beliefs under `deepseek/deepseek-v4-flash-latest`, the beat asked for a sheet under `~deepseek/deepseek-v4-flash-latest`, and the machines that answered were `deepseek/deepseek-v4-flash-0731`'s. One model, three names, and the model every install routes by default therefore had a ledger with nothing in it and a chooser with no opinion — the exact condition this package exists to end.

THE FOLD IS INJECTED AND NOT IMPORTED, for the reason `internal/profile` states above its own: this package holds an opinion about lanes and must not acquire a network-backed discovery service to hold it. A surface that has a catalog installs its answer once at launch; a surface that has none keeps the bare-model normalisation alone, which is exactly what every caller had before this existed. Degrading to today is the requirement — never to nothing.

Index

Constants

View Source
const (

	// UptimeFloor is the share of the last five minutes a lane must have been
	// answering to be worth choosing, in per cent. A lane below it is not slow,
	// it is intermittently absent, and the router's own fallback handles that
	// better than a preference for it would.
	UptimeFloor = 95.0

	// PriceCeilingMultiple is how far above the cheapest acceptable lane's own
	// output tariff another lane may charge, with nobody waiting.
	//
	// IT IS THE SAME 1.25 THE TRANSPORT ALREADY SENDS as `max_price`
	// (internal/provider's latencyPriceCeiling) and it is the same reasoning: a
	// lane 25% dearer is buying a latency edge somebody can feel, and a lane 4×
	// dearer is buying nothing a person notices. The difference is that this
	// ceiling is relative to the CHEAPEST LANE SERVING THIS MODEL rather than
	// to the model's published list price, because the list price is a figure
	// no endpoint is obliged to match.
	PriceCeilingMultiple = 1.25
)
View Source
const (
	// FloorTTFT is the longest believed wait to a first token a lane may carry
	// and still be sent a request on its own merits. Six seconds is the
	// unattended role's patience ceiling (roles.go) with nothing left over.
	FloorTTFT = 6 * time.Second
	// FloorRate is the slowest believed generation a lane may carry. It sits
	// UNDER [ReadRate]: a lane writing faster than a person reads is fast enough
	// for prose whatever a tool loop thinks of it, and the prose objective
	// rightly prefers a 20 tok/s lane with quick first words over a 200 tok/s
	// lane that starts late (internal/provider's workload test). Fifteen is
	// Morph's six and DeepInfra's fourteen, and nothing anybody would keep.
	FloorRate = 15.0
	// FloorServing is the least a lane may be believed to answer. Half: a lane
	// refusing more than it serves costs more than two sends per answer.
	FloorServing = 0.5
)

── THE SERVICE FLOOR ───────────────────────────────────────────────────────

Every other bound in this file is RELATIVE — a multiple of the best lane in the set, a multiple of the cheapest — and a relative bound cannot say that a lane is too slow for a person full stop. On 2026-09-10 Morph answered every deepseek-v4.1-flash request it was given, twenty-seven seconds to the first token at six tokens a second, and stayed a candidate because it was the cheapest lane that answered and nothing here had an absolute opinion. These three do.

View Source
const (
	// AttentionValue is λ for a person sitting in front of an empty line, in
	// seconds per dollar.
	//
	// NINETY IS AN HOURLY RATE DIVIDED THROUGH. At a nominal $40 an hour a
	// second of somebody's attention is worth about a hundredth of a cent, so a
	// dollar buys ninety seconds of waiting back. It is stated once, here,
	// because every other value of time in this package is expressed as a
	// multiple of it.
	AttentionValue = 90.0

	// TaskWallValue is λ for a call on the critical path of a task.
	//
	// IT IS THE WALL VALUE OF THE WHOLE TASK, because the person waits for the
	// task's end and not for this node's. For v1 it is the attention value: the
	// build does not yet carry a per-task worth, and inventing one would be a
	// number nobody measured deciding what to pay. When the plan learns what a
	// task is worth to whoever asked for it, this is the constant that goes.
	TaskWallValue = AttentionValue

	// DeadlineUrgencyCap bounds what a deadline may do to λ. Four times the
	// task's wall value is a deadline already missed or about to be; above it
	// the arithmetic stops describing a trade and starts describing a panic,
	// and a router that pays any price is a router with no opinion at all.
	DeadlineUrgencyCap = 4.0

	// UnattendedValue is the floor under λ for a call nobody is sitting in front
	// of: a quarter of a person's attention. ZERO WAS THE OLD ANSWER AND IT WAS
	// MEASURED WRONG. At λ = 0 the score is dollars alone and the frontier keeps
	// only lanes within 1.25× the cheapest, so on 2026-09-10 every task node for
	// deepseek-v4.1-flash went to the two cheapest lanes — one answering 17% of
	// the time at 22 tok/s, the other 14% — while the lane at 234 tok/s cost six
	// hundredths of a cent more per thousand tokens and was never a candidate.
	// The replay of that day (docs/design/routing/ASSESSMENT-20260911.md) put
	// the router's mean regret at 31.9 s against 0.4 s with λ held above zero. A
	// task the person is not watching still ends when its slowest call ends,
	// and its calls still pay for every refusal, so its seconds are not free;
	// they are worth less than watched ones, and this is how much less. The
	// routing row's `price` word still means exactly zero, because that is a
	// person saying so (internal/provider's laneValueOfTime).
	UnattendedValue = AttentionValue / 4
)
View Source
const ActionFloor = 700 * time.Millisecond

ActionFloor is the shortest silence worth acting on, whatever a belief says.

Below it a second request is racing the network rather than the lane: it has its own handshake, its own router hop and its own prefill to pay before it can say anything, and the measured floor for that is a few hundred milliseconds.

View Source
const AssumedAnswerTokens = 400

AssumedAnswerTokens is how long an answer is taken to be while nothing has measured its length.

AN UNKNOWN ANSWER IS NOT A FREE ANSWER. A zero is a number the rest of the routing arithmetic compares, and pricing no output makes every lane with the same input tariff look equally cheap, handing the turn to whichever starts soonest at any output tariff. The design's ordinary talk figure is therefore used for COMPARING lanes (docs/design/routing/provider-routing.md, "The choice"); it is never taught, billed, or shown as a measurement.

THE ASSUMED ANSWER IS VISIBLE. It is the shape of the prose somebody watching an empty line is waiting for; reading it as hidden would inflate every candidate's perceived wait and buy generation speed nobody needed.

View Source
const AvailabilityHalfLife = 5 * time.Minute

AvailabilityHalfLife is how long a refusal is remembered. Five minutes is the strike ledger's own cooldown (internal/provider's ignoreCooldown) and the window a rate-limited pool typically takes to open again; forgetting faster would send the request straight back, forgetting slower would hold a lane out of the order over a queue that has long since drained.

View Source
const DeadPathFloor = 3 * time.Second

DeadPathFloor is the shortest silence that may be read as a DEAD PATH rather than as a slow lane.

It is the one claim the controller cannot make, because it is not about time at all: a stream that has carried neither a token nor a heartbeat says nothing about how fast the endpoint behind it writes — nothing ever reached it, or nothing ever came back — and charging the lane for it would demote a machine on the evidence of somebody's wifi. Three seconds is the floor under it because a TLS handshake and a cold connection can honestly take longer than a fast lane's whole believed wait.

View Source
const (
	// ExplorationHorizon is how many more calls a session must expect to make
	// before exploration is worth its full width.
	//
	// KNOWLEDGE-GRADIENT SCALING, and it is one multiply. Thompson sampling
	// explores in proportion to how uncertain it is and is blind to how many
	// decisions are left to profit from what it learns: a three-call session
	// should never explore, a five-hundred-call swarm should explore early. The
	// sampling spread is scaled by min(1, Horizon/50), so a short session
	// chooses its best guess and a long one pays to find out.
	ExplorationHorizon = 50
)
View Source
const HalfLife = 10 * time.Minute

HalfLife is how long a belief takes to lose half its information when nothing new is heard about the lane. It is stated here because the ledger ages a belief on the way in and the chooser ages it on the way out, and a half-life that appeared in two places would be two different half-lives by Christmas.

View Source
const Hysteresis = 250 * time.Millisecond

Hysteresis is how much better acting has to look before it is done.

It is the m of the design's one inequality and it is a statement about people rather than about machines, like the two above: a quarter of a second is about the smallest difference in waiting anybody notices, so buying less than that is not a rescue, it is a controller flapping at its own crossing.

View Source
const Levels = 4

Levels is how many terms a chain has. It is spelled once so that a loop over the components and the length of the array cannot drift apart.

View Source
const MaxSpread = 16 * defaultSpread * defaultSpread

MaxSpread is the widest a belief is ever allowed to become: sixteen times the variance of a lane nobody has ever measured.

IT IS A FLOOR UNDER THE ARITHMETIC AND NOT A JUDGEMENT. Every ceiling that decides anything is tighter than this one — [age] clamps at the sheet's own weight and [ledger.stale] at each level's — and this is only what stops the one unbounded expression in the package from reaching a number no reader of it can hold. At σ ≈ 2.4 the p90 of a belief is already twenty-one times its median, which is the formal spelling of "this says nothing"; sixteen times further would say nothing sixteen times louder.

View Source
const PrefixHold = 5 * time.Minute

PrefixHold is how long a lane is believed to still hold a prefix it served.

FIVE MINUTES IS THE SHORTEST CACHE WINDOW THE ROUTERS PUBLISH, and being wrong in this direction is cheap: believing a warm cache has gone cold costs the router one comparison, while believing a cold cache is warm sends a request to a lane on a discount it will not get. When a lane's own cache TTL is learned from `cached_tokens` this becomes a per-lane number; until then it is one constant and it is stated here.

View Source
const QualityHalfLife = 6 * HalfLife

QualityHalfLife is how long a belief about ANSWERS takes to lose half its information. It is six times HalfLife because the two things this package believes about a lane change on two different scales, and forgetting them at one rate gets one of them wrong.

How quick a lane is right now is a fact about load: it moves minute to minute, and a reading from an hour ago is worth almost nothing. Whether a lane returns a usable answer at all is a fact about the deployment behind it — its quantisation, its context window, its truncation — and that holds for hours. Forgetting the second at the speed of the first makes the quality gate inert rather than lenient: a lane whose requests take five minutes each can never accumulate evidence faster than a ten-minute half-life burns it, so its mass sits at the prior's, the credible bound sits at one, and a lane that refuses one answer in six is never dropped. The simulator found exactly that — see "Part III" in the design, C1 — and the fix is not a wider gate but a memory long enough to hold the evidence the gate is asking for.

View Source
const ReadRate = 18.0

ReadRate is how fast a person reads, in tokens per second.

It is the ceiling on the value of throughput. Text that a person is reading as it arrives cannot be delivered usefully faster than they can take it in, so above this rate two lanes are the SAME SPEED to the person and the cheaper one wins. Eighteen is a normal adult reading pace of roughly 250 words a minute at about four tokens to three words; it is a property of people and not a dial, which is why it is stated once, here.

View Source
const SheetWeight = 4.0

SheetWeight is the k a caller passes to Ledger.Prime: the sheet's pseudo-observation is worth a quarter of one of our own sightings, because it is a half-hour aggregate over everybody's prompts from everywhere and ours is about our prompt from here. Both are evidence; neither is truth.

View Source
const SpokenWithin = time.Second

SpokenWithin is how long any wait in the request path may last before the person is told what it is waiting for.

IT IS NOT A TIMEOUT AND NOTHING IS CUT AT IT. It is the other half of VisiblePatience, and the half this build was missing: ten seconds is when we MOVE, and until this wave it was also the first moment a person heard anything at all. A wait that is real is reported (`docs/design/waiting/ DESIGN.md`), and four waits in the request path had no voice — the limiter's slot, the empty-200 re-ask, the abandon grace and the connectivity probe.

ONE SECOND, because that is the oldest measured number in this whole subject: Miller 1968 and Card 1991 through Nielsen 1993, one second is the limit of a person's uninterrupted flow of thought, and past it they notice the delay and the system owes them a sign that it is working. It costs nothing — a phase line is words, not a request — so there is no trade to make against it.

View Source
const SpreadFloor = 1.0

SpreadFloor is how variable ONE ANSWER from a pair is taken to be when nothing has been published about it, in nats of log-spread.

IT IS THE DIFFERENCE BETWEEN TWO SPREADS AND THE WHOLE OF WHY THERE IS A FLOOR AT ALL. A posterior's variance is the variance of the ESTIMATE — how well the median is known — and it shrinks toward nothing after a few dozen observations. What a wait is judged against is how variable ONE DRAW is, which never shrinks below the lane's own variability, and a controller handed the estimate's spread would believe a tail impossible and would never hedge the lane that has one.

AND IT IS A PRIOR ABOUT ONE DRAW RATHER THAN A FLOOR UNDER EVERY LANE, which is the rule and not the figure. One nat is the shape the measured sheet published on its WORST lanes — a p90 about three and a half times the p50 — and the sheet publishes each lane's own: the one §K's rows were proved against says 430 ms and 900 ms, which is 0.577. Held under every lane, one nat asserted that every lane's tail is the worst tail on the sheet, and `bench/lanelab` measured what that cost — a healthy talk turn crossed the inequality at the action floor, on every request that had not started by then. So a lane's own published dispersion is the floor wherever there is one (Hierarchy.Draw) and this is the prior for where there is not, which is the law the rest of this package keeps everywhere: a measured thing outranks a prior, and a prior is what an unmeasured thing gets instead of a certainty.

AND WHERE NOTHING IS PUBLISHED, WHAT IS OBSERVED OUTRANKS IT TOO. A thinking phase has no sheet row of any kind, so this prior stood under the duration clock permanently and its abnormality gate could never close. It is now what the think chain's own dispersion account starts from and shrinks away from as thoughts are folded in ([chains.draw]), which is the same law again: a measured thing outranks a prior, whoever measured it.

View Source
const SpreadTightest = 0.15

SpreadTightest is the narrowest one draw is ever believed to be, in nats of log-spread.

A DISPERSION LEARNED FROM OBSERVATIONS CAN REACH ZERO AND MUST NOT BE BELIEVED THERE. A model asked the same question at the same rung really does deliberate for nearly the same time, and a handful of such draws would fit a spread of nothing — which says the tail is IMPOSSIBLE, and a controller that believes that acts on the first draw that is a little late. This is a p90 a fifth above the p50, tighter than anything the measured sheet publishes about any lane, so it bounds the claim without bounding what a real measurement of a real model is allowed to say.

View Source
const TurnGiveUp = 90 * time.Second

TurnGiveUp is how long a conversation turn may spend reaching a model before the person is told it could not be reached.

IT IS A BOUND THAT DID NOT EXIST. A turn's give-up was the product of every controller under it — attempts times arms times rungs times models — which is nobody's number, and in practice unbounded: the call census of 2026-09-10 found chains of sixteen and seventeen identical sends running eleven minutes and still ending refused.

NINETY SECONDS, measured. Of the 167 retry chains in ten days that reached a clean answer, 29% landed within thirty seconds, 56% within sixty and 66% within ninety; 120 seconds buys nine points more and costs the person another half-minute of a dead cursor. The ten points between sixty and ninety are exactly where the SECOND MACHINE lands, which is the other fact from the same reading: 126 of those 167 winning chains used two distinct machines and only 41 won on one. So ninety seconds is one fair try at every model in the chain with a move between them, and the third of today's winners that falls outside it is made of same-machine repeats that the never-repeat rule deletes.

View Source
const VisiblePatience = 10 * time.Second

VisiblePatience is the longest a person watching an empty line is asked to wait before this build does something about it.

TEN SECONDS IS A CEILING AND NOT A PRIOR. Everything else in this package is learned; this one is a statement about people rather than about machines, and it is what makes the invariant hold from a cold store, where there is nothing to learn from. It is deliberately far above every believed first token the measured world has — the slowest lane of seventeen starts at 3.0s at the median and 9.3s at the ninetieth — so a healthy lane never reaches it and a stalled one always does.

RE-MEASURED ON 2026-09-10 AND KEPT, against 16,427 finished attempts and the 10,028 of them that recorded a first token (the reading is beside this wave as `af-rec-r4.patience.md`). A watched turn's first token is 1.6s at the median, 8.4s at the ninetieth and 13.1s at the ninety-fifth, so ten seconds is this build's own ninety-second percentile — which is where Dean and Barroso's rule for a hedged request ("issue the second near the ninety-fifth percentile of the expected latency, and one or two percent of extra requests removes most of the tail") and Nielsen's ten-second limit on holding a person's attention land on the same number from opposite directions.

AND FIVE WOULD BE WORSE ON BOTH COUNTS, which is the answer to the obvious question. Acting at five seconds touches 28.9% of all calls against 13.9% at ten — twice the traffic — and the yield per extra request FALLS, from 22.1 rescues per hundred to 17.6, because under ten seconds almost everything still silent is an ordinary call in progress rather than one in trouble. The knee, where silence stops being normal and starts predicting failure, is between ten and fifteen seconds: of the calls still silent at 5s, 10s, 15s and 20s, 82%, 78%, 73% and 70% still answered cleanly.

Variables

View Source
var ErrNoSheet = errors.New("lane: no sheet client")

ErrNoSheet is what a refresh returns while no sheet client is wired in. It is an error rather than a silent success because a beat that thinks it fetched is a beat nobody will ever notice is dead.

View Source
var ErrNoSheetHere = errors.New("lane: the base publishes no endpoints page")

ErrNoSheetHere is what a Fetcher returns when the base ANSWERED, and its answer was that no endpoints ROUTE lives at that address at all.

IT IS THE ONE ANSWER THAT MAKES A BASE SHEETLESS. A timeout, a severed connection, a 500 and a 429 are all a router having an afternoon, and a build that read any of those as "this is not a router" would throw away every lane behaviour it has for five minutes over one bad packet.

AND A 404 IS NOT THIS ANSWER BY ITS STATUS; IT IS BY ITS BODY. The live router answers 404 twice over, and the two mean opposite things about the base (measured 2026-09-02):

GET /api/v1/models/nonexistent/model-xyz/endpoints
→ 404, {"error":{"message":"Not Found","code":404}}

GET /api/v1/nonexistent-route/x/endpoints
→ 404, <!DOCTYPE html>…<title>Not Found | OpenRouter</title>…

The first is the router's own error envelope — the route is there and it answered about ONE MODEL, which simply has no page this round; it is a quiet per-model error and says nothing about the base. Only the second, a 404 whose body is not that envelope, is "no such route", and only that one wraps this error. Which bodies mean which is the transport's decision because only the transport can see a status and a body (internal/provider's sheetFetcher, and its sheetNotFound); everything here only asks whether the error it was handed wraps this one.

View Source
var ErrNoStore = errors.New("lane: no belief store")

ErrNoStore is what a store with nowhere to write answers with, so that "nothing was kept" and "nothing can be kept" are never confused for each other. A file that is simply not there yet is the first of those and reads back as no beliefs and no error.

Functions

func AccountExcludes

func AccountExcludes(lane string) bool

AccountExcludes reports whether the account's own settings are believed to keep this machine from every model. Serves is its one reader that matters.

func BareModel

func BareModel(model string) string

BareModel is a model id with its tier suffix taken off, and every other id unchanged. It is what every door of this package files a belief under, so that a request for `model:high` reads the beliefs and the sheet of `model`.

func Beat

func Beat(ctx context.Context, s Sheet, models []string, every time.Duration)

Beat refreshes models' sheets every `every` until ctx is done, and primes the ledger from every reading it gets.

IT STARTS NOTHING. Nothing in this package ever runs a goroutine of its own: a session that wants a beat runs this in one it owns and can stop, which is what keeps "who is fetching, and when" a question with an answer in the session's own code rather than in a package nobody thought was running.

THE REFRESH AND THE PRIMING ARE ONE ACT, and that is a correction rather than a convenience. A sheet fetched into Sheet.Rows and never folded into the ledger is a prior nothing reads: the chooser asks the LEDGER, so a build that refreshed on a beat and primed somewhere else would work exactly until the two drifted, and then be blind on the first call of every process with no symptom but slowness. Priming here means a fresh sheet always reaches the belief, in the one place a sheet is ever fresh.

The first pass skips a model whose cached sheet is younger than the interval, so opening a session a minute after closing one costs nothing — and it primes from that cached reading anyway, because a prior read off the disk is worth exactly as much as one off the wire.

func ClearAccountExclusion

func ClearAccountExclusion(lane string)

ClearAccountExclusion takes a machine back. Two things call it: an answer that machine SERVED for this process — the router serving from it is proof the account can reach it, which is what a person flipping the setting back looks like from here — and a person pinning that machine again, which is them saying "try again" (internal/provider's RepinLane). A machine that was never excluded costs one read lock.

func Controller

func Controller() control.Factory

Controller is the installed factory, nil when nothing is installed.

func ExcludeForAccount

func ExcludeForAccount(lane, reason string)

ExcludeForAccount writes one machine OUT of every model's serving set, because the router said the account's own settings exclude it, and saves the set so the next process starts knowing.

It is called by the layer that classified the refusal (internal/provider's refusal door) and by nothing else. An unnamed lane writes nothing: an exclusion credited to nobody would take a machine away from nobody, and a blank key in the file would be a row nobody can read.

THE WRITE IS SYNCHRONOUS AND THAT IS DELIBERATE. It happens at most once per machine per [accountExclusionHold] — the whole point of the set is that the refusal which teaches it is not paid twice — on a request that has already spent a round trip being refused, and a scheduled write would leave a test's home directory with a writer still in it.

func Flush

func Flush()

Flush writes down what the writer has not reached yet. It is called on the way out of a process, beside the beat's own stop.

func ForgetAccountExclusionsInMemory

func ForgetAccountExclusionsInMemory()

ForgetAccountExclusionsInMemory empties the set this process holds and leaves the file alone. It is for tests, and it is the one way a test can stage "the next process on the same home".

func ForgetPrefixes

func ForgetPrefixes()

ForgetPrefixes drops every note. It is for tests, which must not inherit one another's cache beliefs.

func ForgetRefusals

func ForgetRefusals()

ForgetRefusals empties the negative half, the account's exclusions with it. It is for tests, which must not inherit another test's refusals; the file the exclusions sleep in is left alone, as ForgetAccountExclusionsInMemory says why.

func HeadOf

func HeadOf(choice Choice) string

HeadOf is the lane this request was expected to land on: the pin if there is one, else the head of the order. It is exported because the transport asks it the same question before it can ask what is believed about the answer, and two spellings of "which lane did we mean" is how a plan comes to be built against one machine and drawn against another.

func HeardPrefsCarried

func HeardPrefsCarried(base string) bool

HeardPrefsCarried, HeardPrefsSilent and HeardPrefsRefused are the three answers a base can give, each with its own door.

THREE DOORS AND NOT ONE FLAG, because the three are different strengths and a caller that handed a boolean across would have to know the ranking to get it right — which is precisely the knowledge that belongs here. Each files under the base it was asked of and under no other, exactly as [sheet.heardLocked] does, and each reports whether it was filed at all: false is a sheet that has moved on, and the caller has learnt nothing about where it points now.

func HeardPrefsRefused

func HeardPrefsRefused(base string) bool

HeardPrefsRefused files the terminal no: the base named the `provider` field in a refusal.

func HeardPrefsSilent

func HeardPrefsSilent(base string) bool

HeardPrefsSilent files the weaker no: a request that carried a preference was answered with no lane information at all.

func Lambda

func Lambda(interactive bool, onCriticalPath bool, slack, expected, deadline time.Duration) float64

Lambda is λ for one request, in seconds per dollar.

The four cases are the design's table, in the order they are asked:

interactive                     → AttentionValue, somebody is watching
on the critical path            → TaskWallValue, the person waits for the end
off the path, slack ≥ expected  → zero, and price wins outright
off the path, slack < expected  → the wall value, faded in as the slack runs out

A DEADLINE CAN LIFT ANY OF THEM. It is asked last and it takes the larger answer, because a missed deadline is a step cost rather than a slow one: urgency is how many times over the remaining time the expected work is, and once the work no longer fits, λ is at least the task's wall value.

slack, expected and deadline are all durations and all optional: zero means "not known", which is why an off-path call that knows nothing about its own graph answers zero rather than guessing that it is urgent.

func LedgerModel

func LedgerModel(model string) string

LedgerModel is the one name a model's beliefs and its sheet are filed under.

Two layers, and only the first is always there: the tier suffix comes off because a tier is not a deployment (see BareModel), and then whatever fold was installed is applied over that. An empty id stays empty, and a fold that answers nothing is ignored rather than obeyed — a blank ledger key would file every model's beliefs together.

The answer is memoised per spelling for the life of the process, for the reason profile.Identity memoises: the installed fold reads a catalog that warms in the background, and asked before it lands and again after it would honestly give two answers. A ledger key that moved halfway through a run would split a history inside one session rather than across two. First answer wins.

ONLY AN ANSWER IS REMEMBERED. A fold that cannot say yet (Servable) hands back nothing, and nothing is used for this one call and forgotten — because the alternative is the bug this file exists to end, made permanent: a process that asked one moment before its catalog landed would key its entire run on the alias and never fold again. So the cost of asking early is one unfolded call, never a session.

IT IS IDEMPOTENT, and it has to be: the same name reaches this from a config slot, from a wire answer and from a row already on disk, and a key that moved on the second application would re-split what the first folded together.

func LoadAccountExclusions

func LoadAccountExclusions()

LoadAccountExclusions folds the saved set into this process's. It is called when a sheet is wired — the moment a process first says which router it is talking to — and calling it again is harmless: a read only ADDS, and keeps the later of two moments for a machine both sides know, so nothing this process learned is ever dropped by a read.

func NoSpending

func NoSpending() control.Purse

NoSpending is the purse of a call that may spend NOTHING on rescuing itself.

It is a person's own switch and not an arithmetic answer: `SetLaneGuard(false)` is somebody saying "do not spend extra to keep an answer moving", and a call carrying this purse has no rescue to be refused rather than one it could not afford. It is spelled as its own constructor because zero dollars already means UNBOUNDED on a plan nobody priced (see control.Plan.SpendUSD), and one figure cannot honestly mean both.

func NoteThought

func NoteThought(model, rung string, took time.Duration, at time.Time)

NoteThought folds in how long one whole run of reasoning really lasted. It is what makes Thinks a measurement rather than a prior, and a ledger that cannot hold one drops it.

func PerceivedSeconds

func PerceivedSeconds(ttft, rate float64, visible, hidden int) float64

PerceivedSeconds is how long a person WAITS on an answer, in seconds.

ttft  +  hidden/rate  +  visible · max(0, 1/rate − 1/ReadRate)

Hidden tokens — reasoning, tool-call JSON, anything a person never reads — are worth their full rate, because every one of them is pure waiting.

THE VISIBLE TERM IS THE WAIT AND NOT THE READING. Text a person reads as it arrives costs them the time it takes to read it no matter which lane wrote it: at the reading rate that is visible/ReadRate seconds, and NO ROUTER CAN REMOVE IT. What a router can remove is the part of the wait where the reader has caught up with the writer, which is the difference between the two rates and nothing else. A lane at or above the reading rate therefore contributes no visible wait at all, and two lanes above it are the SAME SPEED to the person — the fact the whole objective is built on.

Counting the reading time (as `visible/min(rate, ReadRate)` did) put a large constant into every candidate's score. It changed no ranking, but it made every ratio a simulator or a ship gate computed from these numbers — "the wait improved by 30%" — a ratio of mostly reading, which is how a router with no effect at all can be reported as a 5% win. The correction was found by `bench/lanelab`; see docs/design/routing/provider-routing.md, Part III.

ttft is in SECONDS and rate in TOKENS PER SECOND. A rate of zero or less is a lane that never finishes, and it is reported as such rather than as a large finite number somebody might then compare.

func Persist

func Persist(ctx context.Context)

Persist runs the process's belief writer until ctx is done. The session starts it beside the beat, and for the same reason that one is started there.

func PlanFor

func PlanFor(choice Choice, pace Pace, role Role, now time.Time) control.Plan

PlanFor turns a routing answer into a waiting one, and it is the ONE place a plan is built.

ROUTING AND WAITING ARE TWO QUESTIONS. The choice says WHICH LANE and this says WHEN TO ACT, and a choice that expressed no preference at all still yields a plan — with a ceiling, with a floor, and with whatever alternatives the frontier named. That is the whole of "a cold ledger may not switch the clock off".

IT TAKES A Pace RATHER THAN A BELIEF, and the difference is where the belief came from. A test scripts one with PaceOf; the transport asks PaceFor, which prefers the four-level chain — the world's pace plus the provider's offset plus the model's — over a flat belief about a pair nobody has measured. Both answer the same two questions, so the plan is built once and not twice.

func PrefsCarried

func PrefsCarried(base string) bool

PrefsCarried reports whether base will carry a routing preference.

UNKNOWN ANSWERS TRUE, and that is the whole shape of the law: the only way to learn is to ask, and asking is sending. Only a base that has ANSWERED — with silence where a lane name belonged, or with a refusal naming the field — is left off ([prefAnswer] states what teaches which).

The answer is read under the base it was filed against, so a sheet that has since been pointed somewhere else answers about the new base and never about the old one.

func PrefsCarriedHere

func PrefsCarriedHere() bool

PrefsCarriedHere is PrefsCarried about whichever base the live sheet is wired to. It is what a SURFACE asks — a settings row saying whether the lane somebody pinned can be asked for at all — because a panel holds no client and so has no base URL of its own to name.

func PrefsProven

func PrefsProven(base string) bool

PrefsProven reports whether base has SHOWN it carries a routing preference — it served an endpoints page, or it named the lane that answered one.

IT IS THE OTHER HALF OF PrefsCarried AND THE TWO ARE BOTH NEEDED. Carried is "may this go out", and an unasked base answers yes because the asking is the sending. Proven is "has this base earned the default knobs" — the sort word, the fallback flag, the parameter filter — which nobody asked for and which no answer is owed about, and an unasked base answers NO. What goes out on an unasked base is only ever something a PERSON asked for (internal/provider's providerPreferences says it in full).

func PriceOf

func PriceOf(facts Facts, req Request) float64

PriceOf is what this request is expected to cost on a lane, in dollars, with nothing of its prompt already cached there.

It is the pessimistic reading and the right default: a lane this session has never sent to holds none of its prefix, and assuming otherwise would be the router awarding a discount nobody granted.

func PriceWithCache

func PriceWithCache(facts Facts, req Request, cached int) float64

PriceWithCache is the same figure when cached of the prompt's tokens are believed to be sitting in this lane's prompt cache:

$ = in·(prompt − cached) + cache·cached + out·N̂

N̂ IS THE VISIBLE AND HIDDEN SPLIT ADDED BACK UP, because both halves are billed at the same rate and only the WAIT they cause differs (PerceivedSeconds). A request that states neither is priced on its prompt alone, which is the honest answer for a call whose answer length nobody has estimated.

A lane that publishes no cache tariff bills its cached tokens at the fresh rate here. That is not a guess: it is what an endpoint with no cache discount charges, and it is what makes the incumbent lane's advantage disappear exactly when the incumbent has no cache to hold.

func RefuseServing

func RefuseServing(model, lane string)

RefuseServing writes one lane OUT of the set known to serve a model, because the router said on the wire that it does not.

It is called by the layer that saw the refusal (internal/provider's refusal classifier) and by nothing else. An unnamed model or lane writes nothing: a refusal credited to nobody would take a machine away from every model at once.

func RememberPrefix

func RememberPrefix(id ID, prefix string, tokens int, at time.Time)

RememberPrefix notes that a lane served a conversation AT A PROMPT LENGTH, so that the next choice can price the prompt cache it probably still holds WITHOUT pricing the part of the next prompt that lane has never seen.

The transport calls it after every answer — it is the one write this package takes from the send path — and it takes the moment as an argument for the same reason everything else here does. `tokens` is the served answer's own reported prompt length; a caller that does not know it passes zero, and zero is remembered as "not known" rather than as a length.

func RememberedPrefix

func RememberedPrefix(id ID) (string, int, bool)

RememberedPrefix is the read half of RememberPrefix: which conversation a lane last served and at what prompt length, and whether anything is held at all. It is exported for the reason ForgetPrefixes is — the transport that WRITES these notes lives in another package, so the test that its answers arrive with the served identity and the settled length cannot reach the map otherwise. Nothing in the routing path calls it; [cachedTokens] reads the map directly.

func Serves

func Serves(model, lane string) bool

Serves reports whether a lane is still believed to serve a model on the wire.

UNKNOWN IS YES, which is the same reading [capable] takes of every other field it gates on: this half of the serving set holds refusals and nothing else, so a lane nobody has been refused by has said nothing and passes. Only a refusal this process actually collected can take a machine away.

func SetController

func SetController(build control.Factory) (previous control.Factory)

SetController installs the factory every token-generating call is watched with, and hands back the one that was there.

IT RETURNS THE PREVIOUS ONE FOR THE SAME REASON [provider.OnPhase] DOES: a caller that swaps a seam has to be able to put back what it found, and a caller that put back NIL would leave the process with no policy at all — which is a build where nothing waits on anything, arrived at by a test tidying up after itself. A nil factory is still a legal argument, because a caller that really wants the bare stream loop back has to be able to ask.

func SheetServes

func SheetServes(base string) bool

SheetServes reports whether base has HANDED BACK an endpoints page, which is a different and narrower question from PrefsCarried.

IT IS FALSE UNTIL THE BASE HAS SHOWN ONE, where PrefsCarried is true until a base has refused one, and the difference is which way the safe reading points for what is being asked. "Send the preference" cannot be learned without sending it, so an unasked base sends. "This model is served by several machines here" is a claim about the base's shape that costs nothing to be wrong about in the cautious direction: a build that assumed it would offer a person a lane list for a base that has one endpoint, and would read a plain endpoint's 404 as a routing layer emptying a set it does not have.

The shipped router answers true with no request at all, through the `known` hint WireSheet takes.

func Spending

func Spending(plan control.Plan) control.Purse

Spending is one call's own budget as the rail the controller asks before it acts.

It is a small adapter and not a method on control.Plan because the direction of the dependency matters: the controller may not know what this package is, and the plan may not grow a method whose answer depends on prices. A zero allowance is UNBOUNDED and not empty — see control.Plan.SpendUSD — because a plan somebody built by hand priced nothing, and reading "nobody said" as "nothing may be spent" is how the window's refusal would come back by the other door.

func StorePath

func StorePath() string

StorePath is the file beliefs sleep in, `~/.codeaf/v3/lanes.json` under the home this process was pointed at. It is stated once, here, because a path that appears twice is a path that drifts.

It resolves through [stateFile], so a test binary that was handed a home rather than choosing one gets "" and, with it, ErrNoStore — the belief file of the person who started the run is never opened. See undertest.go.

func Thinks

func Thinks(model, rung string, now time.Time) control.Survival

Thinks is how long this model's whole thinking phase is expected to last, in SECONDS, keyed on the model and the effort rung it was asked at.

An unknown one is a real state: the duration clock then has nothing to say and the liveness clock and the ceiling are what bound the phase.

func UsePatience

func UsePatience(factor float64)

UsePatience publishes the person's own patience factor, floored at one — a factor under one is somebody asking this build to give up sooner than the measurement says a turn takes, which is not a patience anybody wants and reads as the default.

func UseServable

func UseServable(resolve Servable)

UseServable installs the catalog-backed fold for this process. It is the same shape as profile.UseIdentity, installed at the same place and the same moment by the surface that owns the catalog.

Installing clears the memo, so a process that installs late is consistent from that point on rather than carrying an answer it gave before it could.

func WantSheet

func WantSheet(model string)

WantSheet asks the beat to fetch one model's sheet once, at once. It returns before anything is sent.

IT IS THE DOOR [Agent.SetModel] KNOCKS ON. The beat's model list is settled when a session opens, from the two config slots, and a person who picks another model afterwards used to get a session that never fetched a sheet for it again — so cold start was the steady state for exactly the models people choose deliberately. A sheet installed by a bench that is not this package's own has no queue and is left alone.

func WireSheet

func WireSheet(base, key string, fetch Fetcher, known bool) bool

WireSheet hands the live sheet the two facts it cannot know and the one thing this package may not own: where the router is, who we are, and something that can open a connection. It is called once, at session open, before the beat starts, and it reports whether the live sheet was one this package built — a bench that installed a sheet of its own is left alone.

`known` is A HINT AND NEVER A REFUSAL. A caller that already knows this base publishes an endpoints page — the shipped router, recognised by its hostname in internal/provider's LaneSheetCertain — passes true, and the sheet skips straight to [answerServes] so the existing path is unchanged in behaviour and costs not one extra round trip. FALSE MEANS "ASK IT", never "it has none": every other base is wired exactly the same way and learns what it is from what it answers.

Types

type Advice

type Advice struct {
	Hedge  bool
	Reason string
}

Advice is what the watch says about a stream in flight.

IT IS ADVICE AND NOT A VERDICT, and the word matters more than it looks. `Verdict` names exactly one thing in this tree — the control answer to a FAILED call, from internal/taxonomy — and this is a different kind of sentence about a different kind of event: a stream that is still arriving, and whether it is worth acting on. The watch advises; the controller decides (internal/lane/control). A law holds the word to one meaning (internal/taxonomy/classifier_law_test.go).

Reason is a short machine word for the log — it is never shown to a person. The only sentence a person sees about a slow stream is shown while something is already being done about it.

type Belief

type Belief struct {
	ID      ID
	Facts   Facts
	TTFT    Posterior
	Rate    Posterior
	Quality Beta
	At      time.Time
	// QualityAt is the moment of the last OUTCOME, and it is a second moment
	// rather than a second use of At because quality is not a timing
	// observation: an answer that arrived promptly and could not be used moves
	// one of these beliefs and not the other. Both are forgotten over
	// [HalfLife] and each needs to know how long it personally has been sitting
	// still. Zero is "nothing to forget", never "since 1970".
	QualityAt time.Time
	// Availability is the believed share of requests this lane ANSWERS, fed by
	// [Outcome.Refused] and by every answer, and forgotten over
	// [AvailabilityHalfLife]. It is not a gate; it multiplies the expected wait,
	// because a lane that refuses four requests in five costs five sends for
	// one answer. Before this axis existed a 429 taught the belief nothing, and
	// the next request for the same model asked the same pool two seconds later
	// (825 of 1,010 in the three days to 2026-09-10).
	Availability   Beta
	AvailabilityAt time.Time
	// Spread is how much ONE first token from this lane has been SEEN to move
	// around what is believed about it, in nats of log-spread — zero on a lane
	// nothing has been measured of, where the sheet's published dispersion
	// ([ledger.Draw]) is the answer instead.
	//
	// IT IS NOT [Posterior.P] AND THE DIFFERENCE IS THE WHOLE POINT, which is
	// the law [SpreadFloor] already states: P is the variance of the ESTIMATE
	// and shrinks toward nothing after a few dozen observations, while how
	// variable ONE DRAW is never shrinks below the lane's own variability. A
	// machine that answers in a second half the time and in a minute the other
	// half has a median nothing is unsure about and a tail that is the whole of
	// what a person pays, and nothing on this type could say so.
	//
	// It is measured with the same three floats and the same pooled-and-floored
	// law a thinking duration is ([chains.widen], [chains.draw]), folded on the
	// same lock and in the same call as the median it sits beside, and FORGOTTEN
	// WITH THAT MEDIAN when a change point fires ([chains.note]) — the two are
	// readings of one body of evidence, and an account that kept the old regime's
	// variance would widen a machine for ever on a tail it no longer has.
	//
	// IT IS THE FIRST TOKEN'S DISPERSION AND NOT THE RATE'S, deliberately. A
	// machine whose GENERATION rate swings is not held here at all: a rate that
	// moves within a regime is what the posterior's own spread covers, and a rate
	// that moves BETWEEN regimes — the 2026-09-11 ninefold collapse — is the
	// change point's job, which is why the rate chain has an alarm on it and no
	// dispersion account. Adding a second one would be two answers to "how fast
	// does this machine write" with nothing deciding between them.
	Spread float64
}

Belief is everything this process thinks about one lane.

Facts ride along with the posteriors because the gate and the score are asked in the same breath and a caller that had to fetch the facts separately would be a caller that could ask about a lane the sheet has since dropped.

TTFT is a belief about MILLISECONDS and Rate about TOKENS PER SECOND, both in the log domain — the same units the sheet publishes, so that no seam in this package has to remember a conversion.

func (Belief) Known

func (b Belief) Known() bool

Known reports whether the belief carries any timing at all. A lane with facts and no timing is a lane the gate can judge and the score cannot, and the difference matters enough to be asked rather than inferred.

func (Belief) Serving

func (b Belief) Serving() float64

Serving is the expected share of requests this lane answers: one when nothing has been refused, and the availability posterior's mean once something has. The zero belief serves everything, which is what makes it safe to divide by.

type Beta

type Beta struct {
	A float64
	B float64
}

Beta is the belief that a lane's answers are usable: A successes, B failures.

Quality is a lane property because lanes really do differ on it — a lane serving four-bit weights, a lane that truncates at its own undisclosed ceiling, a lane whose tool-call JSON the decoder refuses. It is kept as a count pair rather than a rate so that "nine out of ten" and "nine hundred out of a thousand" are not the same belief, which is the whole reason a gate can be honest about a lane it has barely seen.

func QualityPrior

func QualityPrior(quant string) Beta

qualityPrior is what a lane is assumed to be worth before it has answered.

Beta(8, 1) is "probably fine": eight usable answers to one bad one, which a handful of real refusals is enough to move. A lane serving FOUR-BIT WEIGHTS starts at Beta(2, 2) — an open question — because four-bit quantization is the one fact on the sheet that predicts a lane returning tool-call JSON the decoder refuses, and starting it optimistic means paying for that discovery on somebody's real turn. QualityPrior is [qualityPrior] for a caller outside this package: the surface that DRAWS a lane's standing has to age the belief exactly as the chooser does, and ageing needs the prior it decays toward. A surface that invented its own would be describing a different rule from the one doing the dropping.

func (Beta) Known

func (b Beta) Known() bool

Known reports whether anything has been observed or assumed.

func (Beta) Mean

func (b Beta) Mean() float64

Mean is the believed share of answers that will be usable, zero when nothing is known — never a hopeful one. IT IS WHAT A PERSON IS SHOWN AND NEVER WHAT THE GATE RUNS ON; see Beta.Upper for why those must be different numbers.

func (Beta) Observe

func (b Beta) Observe(accepted bool) Beta

Observe folds one outcome in.

func (Beta) Toward

func (b Beta) Toward(prior Beta, dt, halfLife time.Duration) Beta

Toward forgets a quality belief back to its prior over halfLife.

IT IS THE OTHER HALF OF THE FIX ABOVE, and without it the gate is still absorbing — just later. A lane dropped for three bad answers at four o'clock is sent nothing after four o'clock, so nothing can ever contradict those three answers, and a lane that was briefly broken is refused until the process ends. Forgetting is what makes the drop a suspicion with an expiry rather than a verdict: after one half-life the excess evidence over the prior is worth half what it was, after two a quarter, and the lane is back in the running to earn its own contradiction.

The arithmetic is the same shape as Posterior.Predict in the log domain: each count decays toward the prior's own, so the MASS returns to the prior's mass (Beta(8, 1)'s nine) and the SHARE returns to the prior's share, and a belief with no excess evidence over its prior is left exactly where it is.

func (Beta) Upper

func (b Beta) Upper(z float64) float64

Upper is the belief's credible bound at z standard deviations: Upper(1.2816) is the point below which the true share lies with 90% probability.

THE GATE ASKS THE BOUND AND NEVER THE MEAN, and getting this wrong once cost this design its whole candidate set. A lane nobody has judged starts at Beta(8, 1) — "probably fine" — whose MEAN is 0.889, and a talk turn needs 0.90. So a gate on the mean refused every lane of every model on the first request of every process, for lack of evidence rather than for cause, and the refusal was ABSORBING: a lane outside the candidate set is never sent to, so it never earns the ninth good answer that would have let it back. The simulator found it in one run (docs/design/routing/provider-routing.md, Part III).

The bound asks the question the gate means to ask — "could this lane be good enough?" rather than "is its point estimate above the line?" — and it is what makes the gate's evidence requirement honest: Beta(8, 1) is bounded near certainty and passes, and it takes real refusals to pull the bound under the line, because a wide belief is not a bad one.

The bound is the normal approximation to the Beta quantile, mean ± z·√(mean(1−mean)/(A+B+1)), clamped to the unit interval. It is exact enough at the counts a lane accumulates in an afternoon, and it costs one square root on a path that runs in front of somebody's first token.

type Chain

type Chain [Levels]Component

Chain is the four components of one prediction, in Level order.

It is an array and not a map because there are exactly four of them, they are always all present, and a loop over four fixed slots is the cheapest thing this arithmetic can be.

func (Chain) Known

func (c Chain) Known() bool

Known reports whether the chain can predict at all: any component believed is enough, because the sum of the rest is zero and their variances are the honest statement of how little is known.

func (Chain) Predict

func (c Chain) Predict() (mu, variance float64)

Predict is the belief about one pair right now: the sum of the means, and the sum of the variances.

SUMMING THE VARIANCES IS WHY COLD START IS NOT A SPECIAL CASE. A pair with a measured provider and an unmeasured deployment predicts the provider's mean with the provider's certainty plus the pair level's whole prior spread, which is exactly "we know roughly, and not precisely" said in arithmetic.

func (Chain) Survival

func (c Chain) Survival(draw, unit float64) control.Survival

Survival is this chain as the distribution the controller waits against, in SECONDS, floored at how variable one answer from this pair really is.

THE FLOOR IS THE CORRECTION AND WHOSE VARIABILITY IT IS, IS THE RULE. Chain.Predict returns the variance of the ESTIMATE — how well the median is known — which shrinks toward nothing as evidence accumulates. What a wait is judged against is how variable ONE DRAW is, which no amount of watching a lane shrinks. A controller handed the estimate's spread alone would believe a tail impossible and would never hedge the lane that has one.

So draw is a floor and NOT A CONSTANT. Hierarchy.Draw answers it from the dispersion the sheet published for this pair — the distance between its own p50 and p90, which is that lane's measured variability — and SpreadFloor is the prior for a pair nothing has been published about. One figure under every lane said instead that every lane's tail is the worst tail on the sheet: the lane `bench/lanelab` proves this against publishes 0.577 nats, and was waited against one.

unit is how many of the chain's own units make a second: the first-token chain is in milliseconds and passes 1000, a chain already in seconds passes 1.

type Choice

type Choice struct {
	Order  []string
	Only   []string
	Ignore []string
	// PINNED IS A PERSON'S OWN WORD AND IT IS NOT THE SAME FACT AS A DEMAND.
	// A demand is OURS — the set this process admitted, which it may relax the
	// moment the set stops working — and a pin is THEIRS: one machine, named
	// by hand, which nothing may quietly route around. The two looked alike for
	// exactly as long as `Only` held nothing but a pin, and the day the chooser
	// began demanding its own set, counting `Only` would have called every
	// ordinary call pinned: the rescue road turns into a question
	// ([control.Plan.Pinned] takes the `Ask` road), and the person is offered
	// `switch to auto?` about a machine they never asked for. So the fact is
	// carried rather than inferred, written in the one place that knows whether
	// a person spoke (`internal/provider`'s lanepin.go and drawLaneChoice), and
	// read in the one place the plan is built.
	Pinned bool
	// IT SAYS NOTHING ABOUT TIME, and the absence is the law. Routing and
	// waiting are two questions and they must never share one nil: this answers
	// WHICH LANE, and [control.Plan] — built for every token-generating call,
	// whether or not any preference was expressed — answers WHEN TO ACT. They
	// were one value once, so a ledger that had never heard of a model produced
	// no routing opinion AND no clock, and the request that most needed a
	// deadline was the one request that got none. [PlanFor] is the other half
	// and `law_test.go` is what keeps them apart.
	//
	// Frontier is the candidate set after the gate and the Pareto prune — the
	// three to five lanes actually worth choosing between — with the numbers
	// each was scored on. It is what the picker's `auto` row says out loud.
	Frontier []Scored
	// Why is one short sentence in a person's own words, empty when there is
	// nothing honest to say. It is shown under the cursor in the picker.
	Why string
}

Choice is what one request should ask the router for.

Order is a preference and Only is a demand. Both are sent: the machines that survived the gate and the prune are DEMANDED (`provider.only` with fallbacks off) and ranked inside that set by Order, because the machines outside it are ones this process has measured and rejected rather than ones it never heard of. Ignore names the lanes we are SURE about rather than the ones we are merely unlucky with, and it expires with the belief rather than on a timer.

A zero Choice is "no opinion", which is a real answer and the right one when the ledger has never seen this model. The transport sends what it would have sent before.

func (Choice) Empty

func (c Choice) Empty() bool

Empty reports whether the choice asks for nothing at all.

type Chooser

type Chooser interface {
	Choose(Request) Choice
}

Chooser turns a request into a preference.

It is PURE — no clock, no connection, no file — and Request.Now is how the time gets in. Everything it needs to know about the world it reads from the ledger and the sheet it was built with.

type Component

type Component struct {
	X float64
	P float64
}

Component is one term of the sum, as a Gaussian in the LOG DOMAIN.

X is its mean and P its variance. A component with P at zero is one nothing is believed about, which is the honest state of every level of a process that has just started and of the pair level for most pairs forever.

func (Component) Known

func (c Component) Known() bool

Known reports whether anything is believed. Variance is strictly positive for any real belief, so P at zero is the emptiness law in one field.

type Facts

type Facts struct {
	// Tools is whether this lane honours a tool call.
	Tools bool
	// Quant is the weight precision the lane serves at, spelled as the sheet
	// spells it ("fp8", "bf16", "fp4"), empty when the sheet did not say.
	Quant string
	// MaxOut is the longest answer the lane will write, and Context the longest
	// conversation it will read. Zero is "the sheet did not say", never "none".
	MaxOut  int
	Context int
	// Uptime5m is the share of the last five minutes the lane was answering, 0
	// to 100. It is the freshest availability figure the sheet carries and it
	// is what lets a lane earn its way back without a penalty box.
	Uptime5m float64
	// PriceIn, PriceOut and PriceCache are the lane's own tariff per token for
	// a fresh prompt token, an output token, and a token read back out of its
	// prompt cache. THEY ARE THE LANE'S AND NOT THE MODEL'S: an endpoint's
	// tariff is its own, and the model id's published list price is a figure
	// none of them is obliged to match.
	PriceIn    float64
	PriceOut   float64
	PriceCache float64
	// Caches is whether the lane holds a prompt prefix between requests. It is
	// what makes price path-dependent: the cheapest lane on the sheet is not
	// the cheapest lane for a request whose prefix another lane already holds.
	Caches bool
	// Status is THE ROUTER'S OWN HEALTH WORD for the lane, as it publishes it:
	// zero is healthy and anything else is an endpoint the router has itself
	// marked down. It is a gate and never a weight, for the reason quality is:
	// a machine whose operator has flagged it is not a machine to weigh against
	// a cheaper tariff.
	//
	// IT IS THE ONE FIELD HERE WHOSE ZERO MEANS "FINE" RATHER THAN "THE SHEET
	// DID NOT SAY", and it is safe to read that way round because the sheet
	// publishes the column for every row: a row that omits it is a row the
	// router is not derating. The gate that ignored this column was the second
	// of the two reasons the reference model and the shipped build did not
	// admit the same lanes (bench/lanelab/REPORT.md, "the two capability gates
	// do not admit the same lanes").
	Status int
}

Facts are what a lane IS, as opposed to how fast it has lately been.

They are the gate's evidence and they are deterministic: a lane that cannot take a tool call is dropped from the candidate set outright, never sampled and found wanting. A gate drop is never a sampled event — a "fast" lane that silently drops the tool call is a wrong answer rather than a fast one.

Prices are US DOLLARS PER TOKEN, the unit the router publishes, and not the per-million figure a person reads. The conversion belongs to whatever draws it, in one place, so that two surfaces cannot disagree about a factor of a million.

func (Facts) Known

func (f Facts) Known() bool

Known reports whether the SHEET HAS EVER SPOKEN about this lane.

It is the difference between "the router publishes no tool flag for this machine" and "nobody has looked it up yet", and until this method existed the two were the same zero. A lane that has only ever been SEEN — it served an answer, so we know it exists and how quick it was, and nothing else — has facts like these, and a gate that read them as published would refuse it for a tool call it was never asked about (frontier.go's [capable]) and a merge would overwrite a primed row with them (store.go's [fresher]).

Every field is read as the sheet publishes it: any of them carrying anything at all is a row that was decoded, and all of them empty is a row that was never seen. Facts.Status is deliberately not among them — its zero means "healthy" rather than "nobody said", which is the one field here that reads that way round.

type Fetcher

type Fetcher interface {
	Fetch(ctx context.Context, url, bearer string) (io.ReadCloser, error)
}

Fetcher is the connection this package may not open for itself.

It is spelled in terms of a URL and a bearer key rather than in terms of a request and a response, because naming those types here would mean importing the transport this package is forbidden to know about. The implementation lives beside the router client, applies the same timeout the catalog reader uses, and turns a status that is not a success into an error — everything below this line only ever sees bytes or a reason there are none.

type Hierarchy

type Hierarchy interface {
	// Wait is the chain over ln first-token in MILLISECONDS for one pair, aged
	// to now.
	Wait(id ID, now time.Time) Chain
	// Rate is the chain over ln tokens-a-second for one pair, aged to now.
	Rate(id ID, now time.Time) Chain
	// Think is the chain over ln SECONDS of a whole thinking phase for one
	// MODEL. It is keyed on the model alone because how long a model deliberates
	// is a property of the model and of the effort rung it was asked at; a lane
	// can only make the same thought arrive faster, which the rate chain already
	// says.
	Think(model string, rung string, now time.Time) Chain
	// Draw is how much ONE ANSWER from this pair varies around what is
	// believed about it, in nats of log-spread: the first token and the gap
	// between two tokens.
	//
	// IT IS THE OTHER HALF OF [Chain.Survival] AND IT IS NOT THE CHAIN'S. A
	// chain holds how well a median is known and that is a belief this process
	// sharpens by watching; how variable one answer is around it is a property
	// of the machine, and the sheet publishes it as the distance between a p50
	// and a p90. A pair nothing has been published about answers [SpreadFloor],
	// which is the prior for the same quantity.
	Draw(id ID) (first, gap float64)
	// ThinkDraw is the same quantity for the one clock no sheet speaks about:
	// how much ONE run of thought by this model at this rung varies around what
	// is believed about it.
	//
	// IT IS MEASURED WHERE [Hierarchy.Draw] IS READ, and that is the only
	// difference between them. Nobody publishes how variable a thinking phase
	// is, so [Hierarchy.NoteThinking]'s own observations are the dispersion, and
	// [SpreadFloor] is the prior for a model nothing has been watched of.
	ThinkDraw(model, rung string) float64
	// Shifted reports whether a change point has just reset this pair's own
	// component toward its parents, and clears the flag. It is what the call log
	// records and what the HUD may explain a sudden re-route with.
	Shifted(id ID) bool
	// NoteThinking folds in how long one whole run of reasoning lasted.
	//
	// IT IS ON THIS DOOR RATHER THAN ON [Ledger] because it is the only
	// observation in the design that is not about a deployment: a lane cannot
	// make a model think less, it can only make the same thought arrive faster,
	// which the rate chain already says. [Hierarchy.Think] is what reads it back,
	// and the two belong to one another — a build that could predict a thinking
	// phase but never record one would be predicting from the prior forever.
	NoteThinking(model, rung string, took time.Duration, at time.Time)
}

Hierarchy is the belief store's door for everything the controller needs.

It is a SECOND DOOR onto the same ledger rather than a second ledger: one sighting moves the chain and the flat belief together, because two accounts of one lane that were updated separately would disagree the first time one of them was fixed. Ledger answers "which lane" and this answers "how long", and the registry hands out one object that is both.

type ID

type ID struct {
	Model string
	Lane  string
}

ID names one machine serving one model.

Both halves are needed and neither is enough. The same endpoint serves many models at different speeds, and the same model is served by endpoints that have nothing in common, so a belief keyed on either alone is a belief about an average nobody ever waits on.

Lane is spelled exactly as the wire spelled it — the `provider` field of a streamed chunk, the `provider_name` of a sheet row. Nothing in this package knows a vendor's name; every name in it arrived from the wire a moment ago.

func (ID) String

func (id ID) String() string

String is the key form, "model|lane". It is a map key and a file key and is never shown to a person.

func (ID) Zero

func (id ID) Zero() bool

Zero reports whether the id names nothing. A sighting that could not say who served it carries a zero id, and a zero id is never written to the ledger: crediting an anonymous measurement to some lane is how a ledger learns a fact about a machine that was not involved.

type Ledger

type Ledger interface {
	// Note folds one timed answer in.
	Note(Sighting)
	// NoteOutcome folds in whether an answer could be used.
	NoteOutcome(Outcome)
	// Belief is what is believed about one lane, false when nothing is.
	Belief(ID) (Belief, bool)
	// Beliefs is every lane believed in for one model, in no promised order.
	Beliefs(model string) []Belief
	// Prime folds a sheet row in as a PSEUDO-OBSERVATION worth 1/k of a real
	// sighting. The sheet is a thirty-minute aggregate over everybody's
	// prompts and our own measurements are about our prompts from our region:
	// both are evidence, neither is truth, and k is how much less the public
	// one weighs. It is also what gives a lane nobody has used a prior, so
	// that nothing is blind on the first call of a process.
	Prime(row Row, k float64)
}

Ledger is what this process has measured and what it now believes.

It is the only mutable state in the package. Everything that writes to it is an observation — a finished stream, a probe, an answer the caller could not use, a sheet row — and everything that reads from it gets a Belief that has already been aged to the moment it is asked about.

type Level

type Level uint8

Level names one term of the sum above, and the order is the order of the terms: broadest first, narrowest last.

const (
	// LevelWorld is μ: one number for everything this process has ever timed.
	LevelWorld Level = iota
	// LevelLane is a[lane]: the provider's own offset, shared by every model it
	// serves. It is the level that makes a never-seen pair predictable.
	LevelLane
	// LevelModel is b[model]: the model's own offset, shared by every provider
	// serving it.
	LevelModel
	// LevelPair is e[model, lane]: this deployment and nothing else.
	LevelPair
)

type Outcome

type Outcome struct {
	ID       ID
	Accepted bool
	Reason   string
	At       time.Time
	// Refused says the lane did not answer at all — a 429 naming its pool, a
	// dead path, an upstream 4xx — as opposed to answering badly. It is the
	// AVAILABILITY axis rather than the quality one, and the two are kept apart
	// because they forget at different speeds: a pool that is full now is
	// usually fine in five minutes, while a lane that writes broken tool calls
	// is not. Accepted is false whenever Refused is true.
	Refused bool
}

Outcome is what became of an answer: whether the caller could use it.

It is the quality axis, and it is deliberately thin. The signals that fill it in are ones the harness already produces and that are attributable to the lane that served the call — a tool call the decoder refused, a reply that stopped on length below its own ceiling, an empty answer, a lane that claims caching and returned no cached tokens. Reason is for the log and never for a person; it is a short machine-readable word.

type Pace

type Pace struct {
	First control.Survival
	Gap   control.Survival
}

Pace is what is believed about the machine expected to serve, as the two distributions a wait is judged against: how long its first word takes, and how long a gap between two visible ones may be. Both are in SECONDS, and an unknown one is a real state that leaves the ceiling as the only bound.

func PaceFor

func PaceFor(id ID, now time.Time) Pace

PaceFor is what THIS PROCESS believes about one pair right now.

IT ASKS FOR THE BETTER DOOR AND FALLS BACK TO THE PLAINER ONE. A four-level chain answers for a pair nobody has measured — which is the whole of cold start — and a flat belief answers only for a pair it has seen. The ledger is one object that may be both (Hierarchy beside Ledger), so a build whose ledger is only the plainer kind still gets a plan, with a ceiling under it either way.

func PaceOf

func PaceOf(belief Belief) Pace

PaceOf is one lane's FLAT belief as a Pace, with nothing known about how variable one answer from it is.

It is the door for a caller holding a belief and no ledger, so what one draw moves by is SpreadFloor, the prior. PaceFor asks the ledger for the lane's own published figure and is what the transport waits against.

type Posterior

type Posterior struct {
	X float64
	P float64
}

Posterior is one scalar belief in the log domain: X is the mean of the log of the quantity, P the variance of that mean.

The natural-unit reading of X is the MEDIAN, not the mean — exp of the mean of a log is a median — and that is deliberate: a median first-token wait is what a person experiences, while a log-normal's mean is dragged up by a tail that happens one time in a hundred.

A zero Posterior is NO BELIEF and reads as one everywhere: Posterior.Known is false, Posterior.Mean is zero rather than one, and Posterior.Update adopts its first observation outright instead of averaging with a certainty it does not have.

func (Posterior) Innovation

func (p Posterior) Innovation(z, R float64) float64

Innovation is how surprising an observation is, in standard deviations of what was expected. It is what a strike wanted to be, and unlike a strike it is comparable between a lane whose normal is four hundred milliseconds and one whose normal is four seconds.

func (Posterior) Known

func (p Posterior) Known() bool

Known reports whether anything has been believed yet. Variance is strictly positive for any real belief — a filter that has seen one observation with noise R has P = R — so P at zero is the honest signal for "nothing here".

func (Posterior) Mean

func (p Posterior) Mean() float64

Mean is the belief in its natural unit: milliseconds for a first-token posterior, tokens per second for a rate one. It is zero when nothing is believed, which the emptiness law then renders as nothing at all.

func (Posterior) Predict

func (p Posterior) Predict(dt, halfLife time.Duration) Posterior

Predict ages a belief that has been sitting still.

THE HALF-LIFE IS A HALF-LIFE OF CONFIDENCE, NOT OF THE ESTIMATE. After one half-life with no evidence the variance has doubled, so the information in the belief — which is one over the variance — has halved. That is exactly what "a ten-minute half-life" should mean and it needs nothing but the posterior itself: the estimate is not moved, because we have no reason to think a lane got faster or slower, only a reason to be less sure.

A belief therefore never has to be un-demoted. Its variance widens until the sheet's pseudo-observation or a sampled draw puts it back in the running, which is why there is no penalty box and no cooldown timer anywhere in this package. The ledger clamps P at the prior's variance so that ageing can make a belief worthless but never worse than the public sheet.

── AND IT IS BOUNDED, BECAUSE DOUBLING FOREVER REACHES INFINITY (2026-09-10)

The doubling above is unbounded in dt, and a belief left alone long enough overflows: P starts near σ² = 0.36 and 2^(dt/10 min) passes the largest float there is after about seven days. Nothing stopped it. Every caller that ages a pair the sheet publishes no spread for went through [age] with a ceiling of zero — so the clamp there was skipped — and the scorer ages beliefs by calling this function directly with no clamp at all.

What that cost is written down twice. `+Inf` reached Posterior.Update, where the gain is P/(P+R) — infinity over infinity — and the belief became NaN; NaN passes every `> ceiling` test as false, so nothing repaired it, and the belief file then refused to compact for days on `json: unsupported value: NaN`. On the way to that, a P of about 673 — eleven half-lives of a lane nobody sent to — priced acting at exp(μ + P/2) and put 1.99e+146 in the `cost_s` column of the model-call log.

SO WIDENING STOPS WHERE A BELIEF STOPS SAYING ANYTHING. Past MaxSpread the tail is already wider than any decision could use, and every further doubling buys nothing but a bigger number for the arithmetic downstream to break on.

func (Posterior) Quantile

func (p Posterior) Quantile(z float64) float64

Quantile is the belief at z standard deviations, in the natural unit: Quantile(1.2816) is the p90 and Quantile(-1.2816) the p10.

It is how the tail gets priced. A lane that is fastest at the median and among the worst at the ninety-ninth percentile loses here, because a person remembers the twelve-second wait and not the four-hundred-millisecond one.

func (Posterior) Update

func (p Posterior) Update(z, R float64) Posterior

Update folds one observation z — already in the log domain — with observation noise R, and returns the posterior that results.

R is where the judgement lives and it is the caller's: a first-token measurement behind a sixty-thousand-token prompt is a noisy claim about the lane, because most of that wait was prefill nobody's endpoint could avoid, so it arrives with a large R. A probe measured on ten tokens is the sharpest claim there is and arrives with a small one. The sheet arrives as a pseudo-observation with R inflated by a constant, so that a public aggregate keeps pulling the belief toward reality without drowning our own answers.

ON A POSTERIOR THAT KNOWS NOTHING the gain would be zero and the observation would be discarded, which is the one thing a first measurement must not be. An unknown belief is an infinitely wide prior, and the limit of the update there is to adopt the observation outright.

AND A BELIEF THAT IS NOT A NUMBER IS NO BELIEF. Posterior.Known is P > 0, which is TRUE of +Inf and FALSE of NaN — so an overflowed belief used to walk straight into the gain below as if it were measured, come out NaN, and then read as unknown everywhere forever without any path ever repairing it. It is read here as what it is: nothing was known, so the observation is adopted outright, exactly as it is for a lane this process has never sent to.

type ProbeGate

type ProbeGate func(model string) bool

ProbeGate answers whether a probe is worth sending at all right now. False is "nobody is waiting, or the pool is already pacing", and it is asked before every pair rather than configured once, because both facts change by the second.

type ProbeSend

type ProbeSend func(ctx context.Context, model, lane string) (time.Duration, error)

ProbeSend is the transport half: it sends a one-token request to exactly one lane and reports how long the first token took.

It is a function rather than an interface because there is one thing to do and no state to hold. An error is a real answer — a lane that refuses is a lane worth knowing about — and the wait it reports on the way to that error is not recorded, because a refusal times a refusal.

type Prober

type Prober interface {
	Probe(ctx context.Context, model string, lanes []string)
}

Prober buys freshness before it is needed.

The sheet is half an hour old and our own belief may be minutes old, but we know seconds in advance that a request is coming: the composer got a keystroke. A one-token request to the top of the frontier costs about two hundredths of a cent, warms the connection so that TLS is out of the real first-token wait, and lands as a sighting with a small R because it measured exactly our path, right now.

It is fire-and-forget by construction: nothing waits for a probe, and a probe that fails teaches the ledger what a failure teaches it and nothing more.

func NewProber

func NewProber(config ProberConfig) Prober

NewProber builds a prober around a transport. It is what the transport calls to wire itself in; the registry is still the only place the EMPTY one is built, because a caller must never get a half-wired prober by accident.

type ProberConfig

type ProberConfig struct {
	Send   ProbeSend
	Gate   ProbeGate
	Ledger Ledger
	Now    func() time.Time
	// Every is the shortest interval between pairs, [probeEvery] when zero.
	Every time.Duration
}

ProberConfig is everything the real prober needs from the layers around it.

Every field is optional and the zero value of each is the safe reading: no send is a prober that sends nothing, no gate is a prober that is always allowed, no clock is the wall clock, and no ledger is the registry's own.

type Queue

type Queue interface {
	// Wanted is the models that have been asked for and not yet fetched.
	Wanted() <-chan string
}

Queue is the other end of that channel, which is Beat's alone.

type Registry

type Registry struct {
	// contains filtered or unexported fields
}

Registry holds the one live set of implementations.

Every accessor returns something usable — never nil. A seam nobody has filled in yet answers with the honest empty implementation below it: no rows, no belief, no opinion. A caller must never have to check.

func Default

func Default() *Registry

Default is the registry this process routes through.

func (*Registry) Chooser

func (r *Registry) Chooser() Chooser

Chooser is the live chooser.

func (*Registry) Ledger

func (r *Registry) Ledger() Ledger

Ledger is the live ledger.

func (*Registry) Prober

func (r *Registry) Prober() Prober

Prober is the live prober.

func (*Registry) Reset

func (r *Registry) Reset()

Reset puts every seam back to the empty implementation. It is for tests, and a test that installs anything must defer it.

func (*Registry) SetChooser

func (r *Registry) SetChooser(chooser Chooser)

SetChooser installs a chooser.

func (*Registry) SetLedger

func (r *Registry) SetLedger(beliefs Ledger)

SetLedger installs a ledger.

func (*Registry) SetProber

func (r *Registry) SetProber(prober Prober)

SetProber installs a prober.

func (*Registry) SetSheet

func (r *Registry) SetSheet(sheet Sheet)

SetSheet installs a sheet. A nil argument restores the empty one rather than leaving a hole for a caller to trip over.

func (*Registry) SetStore

func (r *Registry) SetStore(store Store)

SetStore installs a store.

func (*Registry) Sheet

func (r *Registry) Sheet() Sheet

Sheet is the live sheet.

func (*Registry) Store

func (r *Registry) Store() Store

Store is where beliefs sleep.

type Request

type Request struct {
	// Model is the model as it was asked for, normalized.
	Model string
	// PromptTokens is roughly how long the conversation is. It is the noise
	// term on a first-token measurement — most of a long prompt's wait is
	// prefill, which is not the lane's fault — and it is half of the price.
	PromptTokens int
	// Prefix identifies the conversation whose prompt cache is at stake, empty
	// when there is none. A lane that served this prefix recently probably
	// still holds it, and a switch forfeits it: the score pays that forfeit
	// explicitly, which is also what stops the router flapping between two
	// lanes that are otherwise equal.
	Prefix string
	// Visible is how many tokens of this answer a person will read and Hidden
	// how many they will not — reasoning, tool-call JSON, anything that is
	// pure waiting. The split is what [PerceivedSeconds] needs and it is the
	// difference between a talk turn and a tool loop.
	Visible int
	Hidden  int
	// Tools says the request carries tools, and MaxTokens the ceiling on the
	// answer. Both are gate facts: a lane that cannot take a tool call or
	// cannot write that many tokens is dropped, never scored.
	Tools     bool
	MaxTokens int
	// ValueOfTime is λ, IN SECONDS PER DOLLAR: how many seconds of waiting one
	// dollar is worth buying out of. It is a property of who is waiting and
	// what their wait costs, and it is computed per request from attention and
	// slack rather than set in a config — a person watching an empty line is
	// worth about ninety seconds to the dollar, a node with slack off the
	// critical path is worth nothing and price wins outright.
	//
	// ZERO IS PRICE ONLY. It is the honest reading of "nobody is waiting" and
	// it is what the routing row's `price` word sets for everything.
	ValueOfTime float64
	// QualityNeed is the share of answers that must come back usable for a
	// lane to stay in the candidate set — higher for work than for talk. It is
	// a GATE and never a weight.
	QualityNeed float64
	// Horizon is roughly how many more calls this session will make. It scales
	// exploration: a three-call session should never explore and a
	// five-hundred-call swarm should explore early, and Thompson sampling on
	// its own is blind to the difference.
	Horizon int
	// Role is WHO this call is being made for, carried whole rather than
	// flattened into the two or three numbers a chooser happens to want today.
	//
	// IT IS THE ONE PLACE A POLICY ABOUT WAITING MAY COME FROM. The role table
	// (roles.go) already declares how long this kind of call waits and whether
	// anybody reads its stream, and those two columns are the whole of what
	// separates a preference from a veto and a median from a tail
	// ([patience]). Copying a column into a field here would be a second table
	// to keep in step with the first; naming a role in a condition would be a
	// third. A role added to the table gets the right behaviour with nothing in
	// this package edited.
	//
	// EMPTY IS A CALL SITE THAT DID NOT SAY, AND IT REFUSES NOTHING. The two
	// behavioural columns read from [RoleUnknown]'s row — how a call nobody
	// described is treated, which the table has always answered — but the
	// DEADLINE is left at zero rather than borrowed from it, because a deadline
	// is a refusal and a refusal made out of a default nobody wrote down is a
	// machine struck off the wire's table on behalf of a call site that never
	// said anything. So an unnamed call is ranked by the same expectation as
	// everybody else and vetoes no machine at all, which is exactly what every
	// call did before this field existed. See [patienceFor].
	Role Role
	// Now is the moment the request is being made. See the note on the type.
	Now time.Time
	// Typical, when set, ranks on posterior means and does not sample.
	// It is the display question: which machine would auto pick if it
	// were not exploring this turn. The send path never sets it. A
	// picker that asked the send-path question on every frame named a
	// different via each paint, because Choose seeds its draws on Now.
	Typical bool
}

Request is everything the chooser is allowed to know.

It carries its own Now because the chooser is PURE: same request, same beliefs, same answer. That is what makes the choice testable at all, and a clock read inside it would make every test of it a test of the machine it ran on. A structural test fails the build when a choosing file names time.Now.

type Role

type Role string

Role is who a model call is being made for.

const (
	// RoleUnknown is a call that named no role. It is treated as a hidden
	// background errand — the conservative reading, because a call that claims
	// to be a person waiting when it is not buys speed with somebody's money.
	RoleUnknown Role = ""
	// RoleTalk is the conversation's own turn: a person is sitting in front of
	// it, reading the answer as it arrives.
	RoleTalk Role = "talk"
	// RoleLeafAttached is a task node's turn while somebody is watching the
	// room it runs in, and RoleLeafUnattended the same node with nobody there.
	// They differ ONLY in what a second is worth, which is the whole of the
	// argument in internal/session's turnLambda.
	RoleLeafAttached   Role = "leaf.attached"
	RoleLeafUnattended Role = "leaf.unattended"
	// RoleStanding is a standing order's run: unattended by construction.
	RoleStanding Role = "standing"
	// RoleMemory is the memory reflex and the consolidation pass.
	RoleMemory Role = "memory"
	// RoleRecall prepares a person's next answer. Its output is private, but
	// its delay is interactive because the main request has not started yet.
	RoleRecall Role = "recall"
	// RoleAuxiliary is a side errand of the turn's — a title, a route question,
	// a fold-up, a reply check. It is the role the reflex tier mostly serves.
	RoleAuxiliary Role = "auxiliary"
	// RoleJudge is a gate reading an answer: the route judge, the checkpoint
	// reader, the guardian. It is the one role whose quality bar is high and
	// whose speed is worth little.
	RoleJudge Role = "judge"
	// RoleDesign is the harness designer and the craft passes.
	RoleDesign Role = "design"
	// RoleProbe is the one-token measurement bought on a keystroke.
	RoleProbe Role = "probe"
	// RoleTool is a HAND ON THE BELT asking a model a question: `view_image`
	// looking at a picture, `read` sensing a screenshot, a recording or a video
	// (internal/session's toolask.go).
	//
	// IT IS NOT [RoleAuxiliary] AND THE DIFFERENCE IS WHO IS WAITING. A title, a
	// route question and a fold-up happen beside a turn and nobody is held up by
	// them; a tool's question happens INSIDE one, with the person watching a tool
	// row that cannot finish until it answers — so a second of it costs what a
	// second of talk costs, and it is impatient for the same reason talk is.
	// Calling it auxiliary bought it a background errand's patience, which is how
	// a look at a screenshot came to be allowed four and a half minutes.
	//
	// IT IS NOT [RoleMedia] EITHER, and the difference there is what comes back.
	// Media is work that MAKES something — a picture, a piece of music — and
	// produces no token stream at all, which is what excludes it from the token
	// controller. This produces TEXT, so it is watched like every other role that
	// does; what is not true of it is that anybody READS that text arriving,
	// which is [RoleFacts.Visible] and is false here.
	RoleTool Role = "tool"
	// THERE IS NO ROLE FOR A HEDGE, and the absence is the law. The second
	// request of a race is the SAME ERRAND as the first — the same person is
	// waiting for the same answer — so it inherits the role it is rescuing and
	// is routed, priced and drawn exactly as that errand is. A role of its own
	// would say that a rescue of a naming errand is something a person is
	// reading, which is how the status line came to show a side call's lane
	// under somebody's talk answer in the first place.
	// RoleMedia is an image, a piece of music, a transcription or a document
	// parse. It produces no token stream at all, which is why it is named here
	// and excluded there (see [RoleFacts.Streams]).
	RoleMedia Role = "media"
)

func Roles

func Roles() []Role

Roles is every role in the table, for the structural test that insists each one is exercised. The order is not meaningful.

func (Role) Ceiling

func (r Role) Ceiling() time.Duration

Ceiling is the longest this role waits before something is done about a silence, whatever is believed about the lane serving it.

EVERY ROLE HAS ONE. A role that returned zero here would be a role outside the invariant, and there is no such role: RoleFacts.Patience scales the ceiling and a role the table forgot borrows RoleUnknown's rather than being handed forever.

func (Role) Facts

func (r Role) Facts() RoleFacts

Facts is what is believed about a role. An unregistered role reads as RoleUnknown rather than as a zero struct, so a name nobody added to the table behaves like a background errand instead of like a free one.

func (Role) GiveUp

func (r Role) GiveUp() time.Duration

GiveUp is how long a call in this role may spend reaching a model before it stops trying, and it is the WHOLE of that bound — the one deadline docs/design/recovery/DESIGN.md §4 replaced eleven budgets with.

IT IS THE CEILING'S ARITHMETIC APPLIED TO THE OTHER MEASURED NUMBER. The ceiling is when we ACT on a silence (VisiblePatience × the role's patience); this is when we stop acting at all (TurnGiveUp × the same patience), so the two scale together off one column and a role cannot be patient about one and impatient about the other. Talk is ninety seconds, a task node's four and a half minutes, a standing pass's nine, a probe's forty-five seconds.

WHAT IT REPLACED, and why none of those numbers is missed: six attempts and two minutes for a watched call, sixty attempts and ten minutes for a patient one, three transport faults, eight free moves, four arms and one ladder arm — each bounding a different axis, their product nobody's number, and the census of 2026-09-10 measuring what it produced (chains of seventeen identical sends over eleven minutes, ending refused). A person can be told this one. AND THE PERSON'S OWN PATIENCE MULTIPLIES IT (UsePatience), because the one thing they could ever turn about how hard this build tries is a statement about how long they are willing to wait — which is this figure and nothing else now.

func (Role) Known

func (r Role) Known() bool

Known reports whether this role is in the table. It is what the funnel's own check reads: a call that named nothing is legal in production and a defect in a test (see internal/provider's roles_test.go).

func (Role) Lambda

func (r Role) Lambda() float64

Lambda is what a second of this role's wait is worth, in seconds per dollar. It is Lambda asked with the role's own answers rather than with a call site's guess, which is the whole point of the table.

func (Role) Visible

func (r Role) Visible() bool

Visible reports whether a person is reading this role's stream as it arrives.

type RoleFacts

type RoleFacts struct {
	// Interactive and Critical are what [Lambda] is asked, in that order: is
	// somebody waiting on this answer, and is it on the path to something else
	// that is waiting.
	//
	// AN UNATTENDED NODE IS NEITHER, and the second half of that is worth
	// stating because it looks like an oversight. A node nobody is watching is
	// on the path to a report nobody has asked to read yet, and paying to make
	// it arrive sooner buys a person nothing: the seconds are only worth money
	// once somebody is there to spend them. That is the argument
	// [Agent.turnLambda] has always made and this row is where it now lives.
	Interactive bool
	Critical    bool
	// QualityNeed is the share of answers that must come back usable, and it
	// is a GATE and never a weight (Decision 10's law). Zero is "no bar", which
	// is the honest reading for an errand that can simply be asked again.
	QualityNeed float64
	// Horizon is roughly how many more calls a session in this role will make.
	// It scales exploration: a role that will ask once must not spend that once
	// on a lane it is curious about.
	Horizon int
	// Visible says whether a person is reading THIS stream as it arrives, which
	// is what decides whether the phase clock and the served segment are this
	// call's to move.
	Visible bool
	// Streams says whether this role produces a token stream at all. A role
	// that does not — media — has no first token, no rate and no drift test,
	// so it takes the deadline-only half of the watch and its phase is a
	// single word with a clock under it.
	Streams bool
	// Verb is the phase word for this role while it is producing. It is
	// "writing" for everything that makes text and "drawing" for media, and it
	// is here rather than in the surface because a role is what decides it.
	Verb string
	// Patience is how many times [VisiblePatience] this role will wait before
	// something is done about the silence, whatever is believed about the lane.
	//
	// IT SCALES THE CEILING AND NEVER DECIDES WHETHER THERE IS ONE. That is the
	// funnel law said about waiting: a role sets what a second is worth and how
	// long is too long, and no role is exempt from being asked. A role with no
	// figure here reads as [RoleUnknown]'s, which is the conservative direction
	// — a background errand waits longer than a person does, never less.
	Patience float64
}

RoleFacts is everything the router needs to know about a role, and it is the ONLY place any of it is written down.

type Roster

type Roster interface {
	Roster() []string
}

Roster is the optional half of a Sheet that can name every lane it has ever seen, across every model. It is what gives a never-seen model somewhere to borrow a provider-level belief from.

type Row

type Row struct {
	ID    ID
	Facts Facts

	// At is when this reading was taken, zero when nobody said.
	//
	// IT IS HERE BECAUSE A ROW IS AN OBSERVATION LIKE ANY OTHER, and every other
	// observation in this package carries its moment ([Sighting.At],
	// [Outcome.At]). Without it the ledger folds a FRESH public reading into a
	// belief still holding the certainty it had ten minutes ago, and a lane this
	// process stopped sending to — whose belief is therefore both stale and
	// confident — can never be corrected by the sheet saying it recovered. That
	// is a penalty box, arrived at by arithmetic rather than by a timer, and §5
	// of the design forbids it either way.
	At time.Time

	TTFTp50 float64
	TTFTp75 float64
	TTFTp90 float64
	TTFTp99 float64

	Ratep50 float64
	Ratep75 float64
	Ratep90 float64
	Ratep99 float64
}

Row is one line of the sheet: the public, thirty-minute account of a lane.

The percentiles are the ROUTER'S, over everybody's prompts, and they are the prior rather than the belief. TTFT is in MILLISECONDS and Rate in TOKENS PER SECOND, which is how the sheet publishes them; the whole package stays in those units so that no seam has to remember a conversion.

A row with a p50 and a p90 is enough to fit a log-normal prior — the median is the location and the spread between them is the scale — which is why the four percentiles are named fields rather than a slice nobody can index correctly twice.

func (Row) Known

func (r Row) Known() bool

Known reports whether the row carries enough to fit a prior. A row whose p50 is zero is a lane the sheet published no timing for, and a prior invented from it would be this process refusing lanes on a number nobody measured.

type Scored

type Scored struct {
	ID      ID
	Score   float64
	TTFT    float64
	Rate    float64
	Price   float64
	Quality float64
}

Scored is one candidate lane with the numbers the choice was made on.

It exists so that the choice can EXPLAIN ITSELF with the same numbers it decided on. A picker that recomputed them would be a second opinion nobody asked for, and the first time the two drifted the explanation would be a polite fiction.

SCORE'S UNIT FOLLOWS λ, and lower is better either way. With somebody waiting (λ > 0) a dollar is worth λ seconds by construction, the two terms are commensurable, and the score is SECONDS — the perceived wait plus the price converted through λ. With nobody waiting (λ = 0) a second is worth nothing, dividing by λ is a division by zero dressed up as a preference, and the score is DOLLARS: what this request is expected to cost on this lane, with the perceived wait left to break the ties. The two are never compared with each other, because one request has one λ.

TTFT is milliseconds, Rate tokens per second, Price the dollars this whole request is expected to cost on this lane, Quality the believed share of usable answers.

type Servable

type Servable func(model string) string

Servable turns one spelling of a model into the id the router will actually serve it under. It must be pure, cheap and non-blocking: it is read on the send path as well as at launch, and a fold that went and looked something up would be a fetch in front of a request, which is the law this package opens with.

AN EMPTY ANSWER MEANS "I CANNOT SAY YET", and it is a required answer rather than a rude one. The catalog behind this seam warms in the background, and a fold that answered the id as written while it was still in flight would be indistinguishable from a fold that had looked and found nothing to move — which LedgerModel would then remember for the life of the process. A spelling nobody can resolve yet is not a spelling anybody may file under.

NON-BLOCKING IS NOT LOCK-FREE, and the difference is worth stating here because a comment in this package once got it wrong the other way round. LedgerModel takes an ordinary in-process mutex around its memo — one uncontended lock and a map lookup, held for no I/O — which is a different thing from the EXCLUSIVE FILE lock the store takes to compact. That one is no longer taken in front of a stream: it belongs to the writer goroutine alone ([ledger.Persist]), and every lock in this package is now asked for without waiting (issue #264, store.go). What this seam promises is that resolving a name never waits on a disk, a network or another process.

type Sheet

type Sheet interface {
	// Rows is what is known about model's lanes right now, from memory, with
	// no clock and no connection. It returns nothing when nothing has been
	// fetched, which is a normal state and not an error.
	Rows(model string) []Row
	// Refresh fetches model's sheet and replaces what Rows returns. It is
	// called from the beat.
	Refresh(ctx context.Context, model string) error
}

Sheet is the public account of who serves a model and how fast.

IT HAS TWO HALVES ON PURPOSE. Sheet.Rows reads what is already in memory and can be called from anywhere, including the encoder that runs immediately before a send. Sheet.Refresh goes to the network and MAY NEVER BE CALLED FROM A SEND PATH — it belongs to a background beat and to nothing else. A missing sheet is "no prior, use the belief alone"; it is never a reason to make somebody wait. `internal/provider/lane_law_test.go` fails the build when any non-test file in the transport package so much as names Refresh.

type Sighting

type Sighting struct {
	ID ID
	// TTFT is the wait before the first token, and Gen is the window from the
	// first token to the last. Gap is the widest quiet stretch inside the
	// answer, which is how a lane that assembles the reply server-side and
	// delivers it in lumps tells on itself.
	TTFT time.Duration
	Gen  time.Duration
	Gap  time.Duration
	// Tokens is what the answer was worth in output tokens. PromptTokens and
	// CachedTokens are what it cost to be read, and the second of them is the
	// only evidence there is that a lane really held our prefix.
	Tokens       int
	PromptTokens int
	CachedTokens int
	// Probe marks a sighting bought on purpose: a one-token request sent while
	// somebody was still typing, which measures exactly our path to this lane
	// right now. It is a first-token measurement and NEVER a rate one — an
	// answer one token long rates the handshake.
	Probe bool
	At    time.Time
}

Sighting is one answer, timed.

It is the ledger's unit. TTFT and Gen are separated because they fail for different reasons — queueing before the first token, contention during the writing — and timing them together would price a warm lane behind a long prompt as a slow one.

func (Sighting) Rate

func (s Sighting) Rate() float64

Rate is output tokens per second over the generation window, zero when the answer was too short or too quick to rate. It is derived here rather than carried so that two callers cannot compute it two ways.

type Store

type Store interface {
	Load() ([]Belief, error)
	Save([]Belief) error
}

Store is where a belief sleeps between processes.

A NEW PROCESS STARTS FROM YESTERDAY'S BELIEF, AGED. That is the whole point of persisting: Posterior.Predict widens a stale belief until it is worth about as much as the sheet, so what survives a restart is "mostly the prior, a little memory" rather than a claim about a machine that was busy last Tuesday.

IT IS TWO FILES AND Store.Load IS THE COMPACTED HALF. `~/.codeaf/v3/lanes.json` (StorePath) holds the state as of the last compaction, and `~/.codeaf/v3/lanes.log` (journal.go) holds one appended line per observation since. Load answers with the state alone; replaying the journal over it is [Journal]'s, and the ledger does both. The split is what lets two processes share an afternoon: last-writer-wins over one file cannot merge the levels of a hierarchy that both of them folded evidence into, so neither of them writes the whole belief on the send path and the compaction that does is taken under the exclusive lock.

type Wanter

type Wanter interface {
	// Wants queues one model for the next beat and returns at once.
	Wants(model string)
}

Wanter is the optional half of a Sheet: one that can be ASKED about a model without being made to fetch on the spot.

It is a SECOND interface rather than a third method on Sheet for the reason Prober is one: queueing is a thing the live sheet has and a fixture in a bench does not, and a sheet that does not offer one makes the capability ABSENT rather than present and failing. Nothing here waits, ever.

type Watch

type Watch struct {
	// contains filtered or unexported fields
}

Watch follows one stream from the moment it is sent.

func NewWatch

func NewWatch(choice Choice, belief Belief, now time.Time) *Watch

NewWatch starts a watch over one stream from the choice that sent it.

IT ASSUMES A PERSON IS READING, because a race is a rescue and a rescue is the errand it is rescuing. A caller that knows better builds its own [Plan] with PlanFor and hands it to Watching; nothing here may guess a role.

func Watching

func Watching(plan control.Plan) *Watch

Watching builds a watch over a plan. It is the door a caller that knows the role, the purse and the frontier uses; NewWatch is the older one.

func (*Watch) Alt

func (w *Watch) Alt() string

Alt is the lane an act would go to, empty when there is nobody worth acting on.

func (*Watch) Asked

func (w *Watch) Asked() bool

Asked reports whether an offer has been raised on this request. A pin is asked, never overridden, and it is asked once.

func (*Watch) Deadline

func (w *Watch) Deadline() time.Duration

Deadline is that moment as a wait from the request going out, which is what the phase clock draws a countdown against.

func (*Watch) DeadlineAt

func (w *Watch) DeadlineAt() time.Time

DeadlineAt is the next moment worth waking for, so a beat arms a timer rather than polls. It is never in the past.

func (*Watch) Heartbeat

func (w *Watch) Heartbeat(t time.Time)

Heartbeat records a sign of life that is not a token.

IT IS NOT A QUESTION. A comment line is proof about the PATH and about nothing else, so it moves the dead-path claim and nothing in the controller — and a caller that has no verdict to honour cannot drop one. The beat is what asks; this only answers "somebody is still on the other end".

func (*Watch) Hedged

func (w *Watch) Hedged() bool

Hedged reports whether this request has already put a second arm on the wire.

IT IS NO LONGER A BOOLEAN THAT REFUSES THE NEXT ONE. A request may earn more than one arm and what bounds them is the purse; this only says whether one has gone out.

func (*Watch) Last

func (w *Watch) Last() control.Act

Last is the act that fired, empty until one has.

func (*Watch) PathFault

func (w *Watch) PathFault() bool

PathFault reports whether the act this watch raised was about the path rather than about the lane, which is the flag that keeps a belief honest.

func (*Watch) Phase

func (w *Watch) Phase() control.Phase

Phase is which distribution is governing right now.

func (*Watch) Quiet

func (w *Watch) Quiet(now time.Time) control.Act

Quiet says nothing has arrived by now, and asks the same question.

func (*Watch) Read

func (w *Watch) Read(reading control.Reading) control.Act

Read folds in one moment of the stream and returns the verdict with the numbers it was made on. It is the surface everything else here is written in terms of.

func (*Watch) Serving

func (w *Watch) Serving(lane string, belief Belief, now time.Time)

Serving says which lane the stream itself named, with what is believed about it, so that everything after the first chunk is judged against the machine that is really answering.

func (*Watch) SetExpectedTokens

func (w *Watch) SetExpectedTokens(n int)

SetExpectedTokens says roughly how long this answer is going to be, which is the other half of the commitment arithmetic. It has to be said before the stream starts, which is where the transport says it.

func (*Watch) Silence

func (w *Watch) Silence(t time.Time) Advice

Silence records that nothing has arrived by t, and says whether that silence has gone on long enough to act on.

func (*Watch) Token

func (w *Watch) Token(n, visible int, t time.Time) Advice

Token records that n tokens have now arrived — of which visible are tokens a person can read — and says whether the stream should be acted on.

THE TWO COUNTS ARE NOT INTERCHANGEABLE. Visible text starts the wait again only while its measured rate keeps up. A hidden delta is the endpoint writing where nobody can read, so it moves the phase and leaves the silence exactly where it was.

type Workload

type Workload struct {
	Model   string    `json:"model"`
	Class   string    `json:"class"`
	Visible int       `json:"visible"`
	Hidden  int       `json:"hidden"`
	At      time.Time `json:"at"`
}

Workload is a completed answer's measured generation, split by whether a person could read it while the next operation was waiting. Class identifies the caller's work and reasoning setting; it never identifies a provider.

type Workloads

type Workloads interface {
	NoteWorkload(Workload)
	Workload(model, class string, now time.Time) (visible, hidden int, known bool)
}

Workloads is the optional forecasting seam. Alternative ledgers need not implement it: missing history leaves the caller's request as the evidence.

Directories

Path Synopsis
Package control decides WHEN a wait has gone on long enough to act on, and it is the only thing in this build that decides that.
Package control decides WHEN a wait has gone on long enough to act on, and it is the only thing in this build that decides that.
Package lanestub is a fake router with lanes of a scripted speed: the shared measuring instrument for everything in `internal/lane`.
Package lanestub is a fake router with lanes of a scripted speed: the shared measuring instrument for everything in `internal/lane`.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL