What the workspace says about itself

The owner's one read, GET /v1/self/workspace, and what each block on it means, including what null means.

GET /v1/self/workspace is the one read a person's settings page makes. It is owner-only (the credential's admin bit) and it folds what the workspace is, whether it can answer, what it has used and has left, who its assistants are, and, since v0.235 and v0.236, whether its copy will come back. This page is the contract for the blocks under workspace; the assistant rows are on Actor doors.

One rule holds everywhere on this read: null means not known, never zero. A number the workspace cannot source honestly is null, and a surface that turns a null into a zero is saying something the workspace did not say.

`plan` and `tier`

plan is a fact of the BODY: operator on a machine that is not hosted, free on a hosted body that carries the free tier's store ceiling and no entitlement, paid on a hosted body with a paid entitlement or with no ceiling. plan_status is the subscription status when an entitlement is on file, else null. tier is the READ's tier, the credential's: on a hosted body the owner reads as operator by construction, so tier is never the plan and a surface prints plan.

`usable`, `not_usable_reason`, `provider_degraded`

usable is the conjunction the readiness report computes (configured, a provider is live, an assistant is present) and, since v0.236, the workspace's model is funded. not_usable_reason names the FIRST unmet condition, in the order a workspace clears them: configuring, no_assistant, provider_starting, provider_unfunded. The last is a fact from outside the workspace and is known before you type: on a free body the gateway's grant is spent, and nothing here can answer until the operator funds it; that is on them, not you.

provider_degraded is a warning beside usable, not a refusal: the workspace can still answer, and its last answer failed at the model. It carries the error's words (at most 240 characters) when the newest provider error names credit, balance, billing, quota or an authorization status and no later run succeeded. It clears when a later run succeeds, never on a clock, and a timeout does not set it. Neither field claims a probe; each says which kind of fact it is.

`boot`

The last successful boot against what bounds this body: peak_bytes, limit_bytes, bounded_by (cgroup, machine, or null when nothing bounds it), percent (null when limit_bytes is null, never 0), boot_unix, and the warn and fail thresholds (85 and 95). A body at or past the warning may not come back after a restart; the remedy depends on bounded_by.

`backup`

Whether the last successful backup covered the signing keys, which is what makes a restore the same workspace rather than a copy of its records: identity_covered, last_covered_unix (the last backup that did cover them, which may be older than last_success_unix), identity_note (prose), and since v0.236 identity_reason, a code a surface can route on: sealed, no_passphrase, passphrase_too_short, no_keys, unsupported, seal_failed, or not_yet_run when no successful backup is on file. See Backup and recovery.

`writeback`

Present when the body holds the write lease on a repository; explicitly null when nothing replicates; absent only on a kernel older than the field. The counters (epoch, flushed_watermark, flushed_store_seq, open_tail_records, pending_last_tick, last_flush_unix, flush_interval_secs, mounted_repo) and, since v0.236, the one honest recovery-point number: oldest_unflushed_age_secs, the age of the OLDEST record not yet in the tree. Three states, which a surface must keep apart: null is not measured (no flush tick yet, or a store with no ingest clock), 0 is nothing pending, measured, and N is that many seconds of work at risk right now. It is never the time since the last flush, which is largest exactly when nothing is wrong. Beside it, derived_records_last_refresh and derived_ceiling say how many records the last derived-plane refresh folded against the ceiling it refuses at.

`restore`

The body's own record of having been restored from a published tree, or null, which a surface words as "not recorded" and never as "never restored" (a restore made before v0.236 wrote no marker, so absence is a fact about the instrumentation, not about history). When present: record_id, restored_unix, locator, repo, namespace, scope, watermark, epoch, restored_at_watermark (the --at cut, when one was used), flushed_store_seq, the four record counts, tail (the open tail's verdict: status, reason, records, not_taken), previous_body_anchor (null when the home was fresh at the restore; a value means it was already a body), spl_version, and restores_on_file. A restore writes this record itself, with the daemon down, so a restore followed by a failure to start is recorded; it lands on a body thread, which a published tree never carries, so a restored body can never inherit its origin's restore history.

`inference`

used_usd from the daily usage fold; remaining_usd by who owns the truth: on a free body the gateway's grant balance (the readiness report probes it once and this read reuses the answer), on a paid body the tier's cap minus today's use, and source: uncapped on an operator's own machine, which is a third fact distinct from not known.