@bongos/core 1.20.33 → 1.20.35

package/scripts/gds/autobongos-run.js

@@ -40,7 +40,7 @@ const os = require('node:os');
 const seq = require('./sequence.js');
 const gauge = require('./autonomy-gauge.js');
 const {
-  buildWorkerArgs, buildWorkerPrompt, classifyRun, DEFAULT_MODEL, DEFAULT_WORKER_TIMEOUT_MS,
+  buildWorkerArgs, buildWorkerPrompt, classifyRun, usageLimitHit, DEFAULT_MODEL, DEFAULT_WORKER_TIMEOUT_MS,
 } = require('./autobongos-loop.js');
 const { verifyShip, failureReason } = require('./autobongos-verify.js');
 const fence = require('../../modules/autonomy/fence.js');
@@ -95,55 +95,6 @@ function logPath() {
   try { return require('../../src/instance-config.js').configPath('autobongos-runs.jsonl'); }
   catch (_) { return path.join(REPO_ROOT, 'autobongos-runs.jsonl'); }
 }
-// countWorkedSince — how many tasks this runner has worked since an epoch-second
-// mark. Reads the run log, because that is the only record that survives a
-// restart, and the cap it feeds has to hold across one (a runner that forgets
-// its count on every crash has no cap at all).
-//
-// BOUNDED ON BOTH AXES, because this runs every iteration of a loop that never
-// exits and the log only grows. It reads the TAIL rather than the file, and it
-// scans BACKWARDS and stops at the first row older than the mark — the rows that
-// can possibly count are the newest ones, so the common case touches a handful
-// of lines whatever the log's size.
-//
-// A torn or missing log counts as zero rather than refusing: the fence and the
-// gauge are the gates, this is a bound on top of them, and a bound that bricks
-// the runner when its own log is unreadable is worse than one that occasionally
-// allows an extra task.
-const WORKED_SCAN_TAIL_BYTES = 1024 * 1024;
-const NEWLINE = String.fromCharCode(10);
-
-function countWorkedSince(sinceEpochS) {
-  if (!Number.isFinite(sinceEpochS) || sinceEpochS <= 0) return 0;
-  let text;
-  try {
-    const p = logPath();
-    const { size } = fs.statSync(p);
-    const from = Math.max(0, size - WORKED_SCAN_TAIL_BYTES);
-    const fd = fs.openSync(p, 'r');
-    try {
-      const buf = Buffer.alloc(Math.min(size, WORKED_SCAN_TAIL_BYTES));
-      fs.readSync(fd, buf, 0, buf.length, from);
-      text = buf.toString('utf8');
-    } finally { fs.closeSync(fd); }
-    // A tail read can land mid-line; drop the first partial one.
-    if (from > 0) text = text.slice(text.indexOf(NEWLINE) + 1);
-  } catch (_) { return 0; }
-
-  const lines = text.split(NEWLINE);
-  let n = 0;
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const line = lines[i];
-    if (!line.trim()) continue;
-    let row;
-    try { row = JSON.parse(line); } catch (_) { continue; }   // a torn line costs one row, not the count
-    const at = Date.parse(row.at);
-    if (!Number.isFinite(at)) continue;
-    if (at / 1000 < sinceEpochS) break;   // the log is append-ordered: nothing older can count
-    if (row.event === 'worked') n += 1;
-  }
-  return n;
-}
 
 function record(entry) {
   const row = { at: new Date().toISOString(), ...entry };
@@ -401,9 +352,14 @@ const CLAIM_SET_ASIDE_MS = 30 * 60 * 1000;
 // A bound on claim attempts in ONE pass, so a queue of refusals cannot turn one
 // iteration into dozens of worktree creations.
 const MAX_CLAIM_ATTEMPTS = 5;
+// A limit message with no machine-readable reset (the CLI's human forms name a
+// clock time in a zone we would have to guess). Half an hour is short against a
+// five-hour window and long against a spawn that is cut off in two seconds, so a
+// guess that is wrong costs one wasted spawn per half hour, not one per wake.
+const LIMIT_UNKNOWN_RESET_MS = 30 * 60 * 1000;
 
 function newRunnerState() {
-  return { setAside: new Map(), queueGate: null };
+  return { setAside: new Map(), queueGate: null, limitUntil: null };
 }
 const RUNNER_STATE = newRunnerState();
 
@@ -474,42 +430,30 @@ async function iteration(opts, deps = {}) {
     return log({ event: 'hold', go: false, unknown: !!g.decision.unknown, reason: g.decision.reason, sleep_until: g.decision.sleepUntil ?? null });
   }
 
-  // 1b. A DERIVED gauge buys a BOUNDED amount of work (task 1004178).
-  //
-  // `derived` means the last real reading's window had already reset, so the
-  // baseline is a retired observation rather than a measurement. That is sound
-  // for the FIVE-hour window, which turns over during a night. It does nothing
-  // for the SEVEN-day one, which does not — so the weekly pace check, the thing
-  // the module's notes call what actually binds a heavy week, is simply absent
-  // on a derived reading. A stale weekly figure cannot substitute: usage only
-  // grows, so an under-reported value makes the check more permissive, and that
-  // is the wrong direction to be wrong in.
-  //
-  // So the bound is a task count, not a percentage: on one derived window, do
-  // AUTOBONGOS_DERIVED_TASK_CAP tasks and then hold until a real reading exists.
-  // A terminal session writes one; the owner opening a terminal in the morning
-  // is what lifts it. Default 2 — each worker is wall-clock bounded at 90
-  // minutes, so two of them is well inside a five-hour window even at worst, and
-  // the cap only has to be small enough that being wrong is survivable.
-  if (g.decision.derived) {
-    const cap = Number(process.env.AUTOBONGOS_DERIVED_TASK_CAP ?? 2);
-    const since = Number(g.decision.derivedSince) || 0;
-    const done = countWorkedSince(since);
-    if (Number.isFinite(cap) && cap >= 0 && done >= cap) {
+  // 1b. The usage limit, once HIT (task 1004454). Owner ruling 2026-09-30: no
+  // fixed cap on how much work a reading buys — the gauge above is read before
+  // every task and a derived reading proceeds — and hitting the limit is
+  // acceptable, so long as the runner then waits for the reset and resumes by
+  // itself. A worker cut off by the limit records when it resets; until then no
+  // task is taken, because every worker spawned would be cut off the same way.
+  const state = deps.state || RUNNER_STATE;
+  const now = deps.now ? deps.now() : Date.now();
+  if (state.limitUntil) {
+    if (now < state.limitUntil) {
       return log({
-        event: 'hold', go: false, unknown: false, derived: true, worked_since_derived: done,
-        reason: `derived gauge: ${done} task(s) already done since the window reset and the cap is ${cap} — holding for a real reading (a terminal session writes one)`,
-        sleep_until: null,
+        event: 'hold', go: false, unknown: false, usage_limit: true,
+        reason: 'the subscription usage limit was hit — sleeping to its reset, then resuming by itself',
+        sleep_until: Math.round(state.limitUntil / 1000),
       });
     }
+    log({ event: 'usage_limit_reset', was_until: new Date(state.limitUntil).toISOString() });
+    state.limitUntil = null;
   }
 
   // 1c. A QUEUE-WIDE gate from an earlier pass (task 1004396). While the
   // stranded task it named is still `confirmed`, every claim would be refused, so
   // none is attempted. The wait wakes early when main moves (waitOrJump), which is
   // exactly what the strand landing does.
-  const state = deps.state || RUNNER_STATE;
-  const now = deps.now ? deps.now() : Date.now();
   if (state.queueGate) {
     if (await queueGateHolds(state.queueGate, deps)) return log(queueGatedRow(state.queueGate, now));
     log({ event: 'queue_gate_cleared', waited_on: state.queueGate.owed, waited_s: Math.max(0, Math.round((now - state.queueGate.since) / 1000)) });
@@ -592,6 +536,10 @@ async function iteration(opts, deps = {}) {
   const started = Date.now();
   const res = await spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: wtPath, deps });
   const verdict = classifyRun(res);
+  // Cut off by the usage limit? Recorded here so the NEXT iteration sleeps to the
+  // reset instead of spawning a worker that will be cut off the same way.
+  const limit = verdict.outcome === 'claims_shipped' ? null : usageLimitHit({ envelope: res.envelope, stderr: res.stderr });
+  if (limit) state.limitUntil = limit.resetAt ? limit.resetAt * 1000 : now + LIMIT_UNKNOWN_RESET_MS;
 
   // 6. VERIFY FROM THE LEDGER (task 1003903). Read the task back from Bongos and
   // let IT say what happened — for every outcome, not only a claimed ship. The
@@ -623,6 +571,7 @@ async function iteration(opts, deps = {}) {
     session_id: res.sessionId || null, duration_s: Math.round((Date.now() - started) / 1000),
     cost_usd: verdict.costUsd ?? null,
     output_truncated: !!res.truncated,
+    ...(limit ? { usage_limit: { reset_at: limit.resetAt } } : {}),
     undetermined_decisions: verdict.verdict ? verdict.verdict.undetermined_decisions : null,
     // What the LEDGER says, kept separate from what the worker said, so the run
     // log can be read afterwards without having to trust either one alone.
@@ -1022,6 +971,15 @@ async function forever(opts, deps = {}) {
       // corpse.
       await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined });
       const seen = cadence.classifyEvent(row);
+      // A hold that names its reset SECOND waits until that second (task 1004454).
+      // classifyEvent carries it as an absolute epoch; the cadence has no clock of
+      // its own, so the conversion to a wait lives here beside the one clock read.
+      // Without it every hold waited the fixed idle and the "wake at the reset"
+      // the goal asks for was only ever as accurate as the poll.
+      if (Number.isFinite(Number(seen.sleepUntil)) && seen.sleepUntil !== null) {
+        const nowS = Math.floor((deps.now ? deps.now() : Date.now()) / 1000);
+        seen.sleepUntilS = Math.max(0, Number(seen.sleepUntil) - nowS);
+      }
       state = cadence.nextCadence(state, seen, opts.cadence);
       log({ event: 'cadence', mode: state.mode, consecutive_failures: state.consecutiveFailures, wait_s: state.waitS, class: seen.class, why: state.why });
       // A burst continues only while work is actually landing. Anything else ends
@@ -1082,8 +1040,8 @@ if (require.main === module) {
 
 module.exports = {
   readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
-  worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, countWorkedSince, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
+  worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT, failureReason,
-  newRunnerState, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
+  newRunnerState, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.33'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.35'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_cadence.mjs

@@ -293,6 +293,33 @@ function loopHarness({ rows, maxLoops = 6 }) {
   return { deps, waits: emitted, recorded, opts: { goals: [], maxTasks: 3, maxLoops } };
 }
 
+// ── the usage limit: a wait to a known second, not a failure (task 1004454) ──
+
+test('a worker cut off by the usage limit is quiet, not a failed launch', () => {
+  // It exits in seconds having spent nothing — exactly workerNeverRan()'s shape —
+  // but the machine is fine: the window is spent. Escalating it would put the
+  // runner into probing for a limit the owner has said is acceptable to hit.
+  const seen = classifyEvent({ event: 'worked', outcome: 'worker_failed', duration_s: 2, cost_usd: null, reason: 'x', usage_limit: { reset_at: 1790300000 } });
+  assert.equal(seen.class, 'quiet');
+  assert.equal(seen.sleepUntil, 1790300000);
+});
+
+test('a hold with a reset time makes the loop wait until THAT second, not a fixed idle', async () => {
+  const nowS = 1_790_290_000;
+  const h = loopHarness({ rows: [{ event: 'hold', go: false, reason: 'five-hour burn at the ceiling', sleep_until: nowS + 3600 }], maxLoops: 1 });
+  h.deps.now = () => nowS * 1000;
+  await runner.forever(h.opts, h.deps);
+  assert.equal(h.waits[0].waitS, 3600, 'the wake is the reset second the gauge named');
+});
+
+test('a hold whose reset has already passed waits no time at all', async () => {
+  const nowS = 1_790_290_000;
+  const h = loopHarness({ rows: [{ event: 'hold', go: false, reason: 'x', sleep_until: nowS - 5 }], maxLoops: 1 });
+  h.deps.now = () => nowS * 1000;
+  await runner.forever(h.opts, h.deps);
+  assert.equal(h.waits[0].waitS, 0);
+});
+
 test('PULLING THE NETWORK: the loop backs off and never returns', async () => {
   const h = loopHarness({ rows: [{ event: 'pick_failed', reason: 'fetch failed ECONNREFUSED' }] });
   await runner.forever(h.opts, h.deps);

package/tests/autobongos_loop.mjs

@@ -11,7 +11,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const {
-  WORKER_VERDICT_SCHEMA, buildWorkerArgs, buildWorkerPrompt, parseWorkerEnvelope, classifyRun,
+  WORKER_VERDICT_SCHEMA, buildWorkerArgs, buildWorkerPrompt, parseWorkerEnvelope, classifyRun, usageLimitHit,
 } = require('../scripts/gds/autobongos-loop.js');
 const runner = require('../scripts/gds/autobongos-run.js');
 
@@ -836,119 +836,132 @@ test('workerEnv passes Claude auth through, and still refuses the rest', () => {
     assert.equal(env[leak], undefined, `${leak} must never reach a bypassPermissions worker`);
   }
 });
-// --- a derived gauge buys BOUNDED work (task 1004178) -----------------------
+// --- usage is judged continuously; hitting the limit sleeps to its reset (task 1004454) ---
 //
-// `derived` retires a reading whose window has reset. That is sound for the
-// five-hour window, which turns over during a night. The SEVEN-day one does
-// not, so its stale reading is dropped and the weekly pace check — what the
-// module's notes call the thing that actually binds a heavy week — does not run
-// at all on a derived reading. The task cap is what stands in for it, so the
-// cap has to work, and it has to survive a restart: the count comes from the
-// run log, not from memory.
+// Owner ruling, 2026-09-30: no fixed cap. The derived-gauge cap (task 1004178)
+// held the runner after two tasks on an inferred reading — 776 holds in one
+// 2026-09-26..29 run — for a risk the owner accepts: "if you hit usage limits
+// that's fine, but then restart once the limit resets". So the gauge is still
+// read before every task, a derived reading proceeds, and the limit itself is
+// the stop: a worker cut off by it puts the runner to sleep until the reset.
 
 import { mkdtempSync, writeFileSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-const derivedLog = () => {
-  const dir = mkdtempSync(join(tmpdir(), 'autobongos-cap-'));
-  return join(dir, 'runs.jsonl');
-};
-
-test('countWorkedSince counts only worked rows at or after the mark', () => {
-  const p = derivedLog();
-  process.env.AUTOBONGOS_LOG_FILE = p;
-  const at = (s) => new Date(s * 1000).toISOString();
-  writeFileSync(p, [
-    JSON.stringify({ at: at(1000), event: 'worked', task_id: '1' }),   // before the mark
-    JSON.stringify({ at: at(3000), event: 'hold' }),                   // not a worked row
-    JSON.stringify({ at: at(3100), event: 'worked', task_id: '2' }),
-    '{ this line is torn',                                             // costs one row, not the count
-    JSON.stringify({ at: at(3200), event: 'worked', task_id: '3' }),
-  ].join('\n'));
-  assert.equal(runner.countWorkedSince(2000), 2);
-  assert.equal(runner.countWorkedSince(0), 0, 'a zero/absent mark counts nothing rather than everything');
-  delete process.env.AUTOBONGOS_LOG_FILE;
-});
-
-test('countWorkedSince treats an unreadable log as zero, not as a refusal', () => {
-  process.env.AUTOBONGOS_LOG_FILE = join(tmpdir(), 'autobongos-cap-nope', 'missing.jsonl');
-  assert.equal(runner.countWorkedSince(1), 0,
-    'the fence and the gauge are the gates; a bound that bricks the runner when its own log is gone is worse');
-  delete process.env.AUTOBONGOS_LOG_FILE;
-});
-
-test('a derived gauge HOLDS once the cap is reached, and the reason says why', async () => {
-  const p = derivedLog();
-  process.env.AUTOBONGOS_LOG_FILE = p;
-  process.env.AUTOBONGOS_DERIVED_TASK_CAP = '2';
+test('a derived gauge keeps WORKING however many tasks it has already done — there is no cap', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'autobongos-nocap-'));
+  process.env.AUTOBONGOS_LOG_FILE = join(dir, 'runs.jsonl');
   const at = (s) => new Date(s * 1000).toISOString();
-  writeFileSync(p, [
-    JSON.stringify({ at: at(5100), event: 'worked', task_id: '1' }),
-    JSON.stringify({ at: at(5200), event: 'worked', task_id: '2' }),
-  ].join('\n'));
-
+  const rows = [];
+  for (let i = 0; i < 6; i++) rows.push(JSON.stringify({ at: at(5100 + i), event: 'worked', task_id: String(i) }));
+  writeFileSync(process.env.AUTOBONGOS_LOG_FILE, rows.join('\n'));
+  let reachedPicker = false;
   const events = [];
   await runner.iteration({ goals: [], maxTasks: 1 }, {
+    state: runner.newRunnerState(),
     readFence: async () => ({ raw: { enabled: true, goals: [{ goal_id: 7 }] }, graderBypassed: false }),
     gauge: () => ({ decision: { go: true, unknown: false, derived: true, derivedSince: 5000, reason: 'derived' } }),
-    pickTask: async () => { throw new Error('CAP BREACHED: reached the picker'); },
+    pickTask: async () => { reachedPicker = true; return { none: true, skipped: [] }; },
     record: (row) => { events.push(row); return row; },
-    run: async () => { throw new Error('CAP BREACHED: ran a command'); },
-    spawnWorker: async () => { throw new Error('CAP BREACHED: spawned a worker'); },
   });
-  assert.equal(events[0].event, 'hold');
-  assert.equal(events[0].derived, true);
-  assert.equal(events[0].worked_since_derived, 2);
-  assert.match(events[0].reason, /cap is 2/);
-  delete process.env.AUTOBONGOS_LOG_FILE; delete process.env.AUTOBONGOS_DERIVED_TASK_CAP;
-});
-
-test('a derived gauge still WORKS while under the cap', async () => {
-  const p = derivedLog();
-  process.env.AUTOBONGOS_LOG_FILE = p;
-  process.env.AUTOBONGOS_DERIVED_TASK_CAP = '2';
-  writeFileSync(p, JSON.stringify({ at: new Date(5100 * 1000).toISOString(), event: 'worked', task_id: '1' }));
-  let reachedPicker = false;
+  assert.equal(reachedPicker, true, 'six tasks since the reset must not stop the seventh');
+  assert.ok(!events.some((e) => e.event === 'hold'), 'no hold on a derived reading');
+  delete process.env.AUTOBONGOS_LOG_FILE;
+});
+
+test('the gauge is still read before EVERY task, and a real hold still holds', async () => {
+  let reads = 0;
   const events = [];
-  await runner.iteration({ goals: [], maxTasks: 1 }, {
+  const d = {
+    state: runner.newRunnerState(),
     readFence: async () => ({ raw: { enabled: true, goals: [{ goal_id: 7 }] }, graderBypassed: false }),
-    gauge: () => ({ decision: { go: true, unknown: false, derived: true, derivedSince: 5000, reason: 'derived' } }),
-    pickTask: async () => { reachedPicker = true; return { none: true, skipped: [] }; },
+    gauge: () => { reads += 1; return { decision: { go: false, unknown: false, reason: 'five-hour burn 80% is past the ceiling', sleepUntil: 1790218521 } }; },
+    pickTask: async () => { throw new Error('picked past a hold'); },
     record: (row) => { events.push(row); return row; },
-  });
-  assert.equal(reachedPicker, true, 'one task done against a cap of two must still proceed');
-  delete process.env.AUTOBONGOS_LOG_FILE; delete process.env.AUTOBONGOS_DERIVED_TASK_CAP;
+  };
+  await runner.iteration({ goals: [], maxTasks: 1 }, d);
+  await runner.iteration({ goals: [], maxTasks: 1 }, d);
+  assert.equal(reads, 2);
+  assert.equal(events[1].event, 'hold');
+  assert.equal(events[1].sleep_until, 1790218521);
 });
 
-test('countWorkedSince is bounded: a huge log does not mean a huge scan', () => {
-  const p = derivedLog();
-  process.env.AUTOBONGOS_LOG_FILE = p;
-  const at = (s) => new Date(s * 1000).toISOString();
-  // 40k old rows, then the two that matter. A whole-file parse would touch
-  // every one of them on EVERY iteration of a loop that never exits.
-  const old = [];
-  for (let i = 0; i < 40000; i++) old.push(JSON.stringify({ at: at(1000 + i), event: 'worked', task_id: String(i) }));
-  old.push(JSON.stringify({ at: at(900000), event: 'worked', task_id: 'recent-1' }));
-  old.push(JSON.stringify({ at: at(900100), event: 'worked', task_id: 'recent-2' }));
-  writeFileSync(p, old.join('\n'));
-  const t0 = Date.now();
-  assert.equal(runner.countWorkedSince(800000), 2, 'only the rows at or after the mark count');
-  assert.ok(Date.now() - t0 < 500, 'and it must not walk the whole log to say so');
-  delete process.env.AUTOBONGOS_LOG_FILE;
+test('usageLimitHit reads the reset second out of the CLI\'s own limit message', () => {
+  const env = JSON.stringify({ type: 'result', subtype: 'success', is_error: true, result: 'Claude AI usage limit reached|1790300000' });
+  assert.deepEqual(usageLimitHit({ envelope: env }), { resetAt: 1790300000 });
 });
 
-test('countWorkedSince stops at the first row older than the mark', () => {
-  const p = derivedLog();
-  process.env.AUTOBONGOS_LOG_FILE = p;
-  const at = (s) => new Date(s * 1000).toISOString();
-  writeFileSync(p, [
-    JSON.stringify({ at: at(100), event: 'worked', task_id: 'ancient' }),
-    JSON.stringify({ at: at(5000), event: 'worked', task_id: 'before-mark' }),
-    JSON.stringify({ at: at(9000), event: 'worked', task_id: 'after-mark' }),
-  ].join('\n'));
-  assert.equal(runner.countWorkedSince(8000), 1);
-  delete process.env.AUTOBONGOS_LOG_FILE;
+test('usageLimitHit recognises a limit message with no machine-readable time, and says so', () => {
+  const env = JSON.stringify({ type: 'result', is_error: true, result: "You've hit your limit · resets 3am (America/New_York)" });
+  assert.deepEqual(usageLimitHit({ envelope: env }), { resetAt: null });
+  assert.deepEqual(usageLimitHit({ envelope: '', stderr: '5-hour limit reached ∙ resets 3pm' }), { resetAt: null });
+});
+
+test('usageLimitHit ignores the word "limit" in a worker that FINISHED', () => {
+  // A worker that fixed a GitHub rate-limit bug writes about rate limits in its
+  // verdict. Only an ERROR envelope, or a run with no envelope at all, can be a
+  // limit hit — anything else would put the runner to sleep for doing its job.
+  const env = JSON.stringify({ type: 'result', is_error: false, result: 'Claude AI usage limit reached|1790300000 is the banner text I fixed', structured_output: { outcome: 'shipped', what_happened: 'fixed the usage limit reached banner' } });
+  assert.equal(usageLimitHit({ envelope: env }), null);
+  assert.equal(usageLimitHit({ envelope: JSON.stringify({ is_error: true, result: 'API Error: 500' }) }), null);
+});
+
+function limitHarness(state, now, envelopeText) {
+  const rows = [];
+  const deps = {
+    state, now: () => now.t,
+    gauge: () => ({ decision: { go: true, unknown: false, derived: true, derivedSince: 1, reason: 'derived' } }),
+    readFence: async () => ({ raw: { enabled: true, goals: [{ goal_id: 1000119 }] }, graderBypassed: false }),
+    api: {},
+    verifyDeps: {
+      task: { id: 4242, status: 'active', updated_at: new Date().toISOString() },
+      probeArtifact: async () => ({ checked: true, onMain: false }),
+      fileBlocker: async () => ({ filed: false }),
+    },
+    release: async () => ({ ok: true, code: 0, stdout: '', stderr: '' }),
+    pickTask: async () => ({ task: { id: 4242, title: 't', kind: 'feature', description: 'd'.repeat(300), goal_id: 1000119, touches: [] }, goalId: 1000119, skipped: [] }),
+    worktreeName: () => 'autobongos-4242-abc123',
+    record: (r) => { rows.push(r); return r; },
+    run: async () => ({ ok: true, code: 0, stdout: '', stderr: '' }),
+    spawnWorker: async () => ({ envelope: envelopeText, exitCode: 1, sessionId: 's' }),
+  };
+  return { deps, rows };
+}
+
+test('a worker cut off by the usage limit puts the runner to sleep until the reset, then it resumes by itself', async () => {
+  const state = runner.newRunnerState();
+  const now = { t: 1_790_290_000_000 };
+  const env = JSON.stringify({ type: 'result', is_error: true, result: 'Claude AI usage limit reached|1790300000' });
+  const h = limitHarness(state, now, env);
+
+  const worked = await runner.iteration(opts, h.deps);
+  assert.equal(worked.event, 'worked');
+  assert.deepEqual(worked.usage_limit, { reset_at: 1790300000 }, 'the row says the limit was hit and when it resets');
+
+  let picked = false;
+  const asleep = await runner.iteration(opts, { ...h.deps, pickTask: async () => { picked = true; return { none: true }; } });
+  assert.equal(asleep.event, 'hold');
+  assert.equal(asleep.sleep_until, 1790300000, 'it sleeps to the reset second the CLI named');
+  assert.match(asleep.reason, /usage limit/);
+  assert.equal(picked, false, 'no task is taken while the limit is spent');
+
+  now.t = 1_790_300_001_000;
+  const awake = await runner.iteration(opts, { ...h.deps, pickTask: async () => { picked = true; return { none: true, skipped: [] }; } });
+  assert.equal(picked, true, 'past the reset it picks again without anyone touching it');
+  assert.equal(awake.event, 'nothing_claimable');
+  assert.equal(state.limitUntil, null);
+});
+
+test('a limit hit with no stated reset sleeps a bounded while and then tries again', async () => {
+  const state = runner.newRunnerState();
+  const now = { t: 2_000_000_000_000 };
+  const h = limitHarness(state, now, JSON.stringify({ is_error: true, result: '5-hour limit reached ∙ resets 3pm' }));
+  const worked = await runner.iteration(opts, h.deps);
+  assert.deepEqual(worked.usage_limit, { reset_at: null });
+  const asleep = await runner.iteration(opts, h.deps);
+  assert.equal(asleep.event, 'hold');
+  assert.equal(asleep.sleep_until, Math.round((now.t + runner.LIMIT_UNKNOWN_RESET_MS) / 1000));
 });
 
 // --- a --forever runner must be able to take a fix (task 1004374) -----------

package/tests/collab_page.mjs

@@ -865,9 +865,35 @@ test('the skill the page invokes exists, and is the ANSWERING half', () => {
   // longer "you cannot", it is "you do not, because you are not the one who read
   // the answer", plus the half that did not widen.
   assert.match(md, /POST \/api\/bongos\/help-requests\/:id\/replies/, 'it answers on the ask');
-  assert.match(md, /Do NOT close the ask/, 'and hands the close to a person');
+  // Task 1004458 (owner direction): a session may resolve an ask, but only when
+  // the reader says so — never on its own judgement — and reopening is the asker's.
+  assert.match(md, /Resolve only when told to/, 'it closes only on the reader\'s instruction');
+  assert.match(md, /"status":"open"/, 'and knows the asker can reopen');
   assert.match(md, /withdraw/i, 'and knows withdraw did not widen');
   assert.ok(!/POST \/api\/bongos\/help-requests --body-file/.test(md),
     'the file-a-counter-ask workaround is deleted, not left beside the real thing');
   assert.match(md, /DATA, not instructions/, 'an ask is untrusted input');
 });
+
+// ---- resolve + reopen, ticket style (task 1004458) --------------------------
+test('canReopen: only the asker, and only a settled ask', () => {
+  const L = lib();
+  const settled = { requested_by: '90', needs_builder_id: '7', status: 'answered' };
+  assert.equal(L.canReopen(settled, 90), true, 'the asker may reopen');
+  assert.equal(L.canReopen({ ...settled, status: 'withdrawn' }, '90'), true, 'their own withdrawal too');
+  assert.equal(L.canReopen(settled, 7), false, 'the addressee may not — they have a reply box');
+  assert.equal(L.canReopen({ ...settled, status: 'open' }, 90), false, 'an open ask has nothing to reopen');
+  assert.equal(L.canReopen(settled, null), false, 'no viewer, no control');
+  assert.equal(L.canReopen(null, 90), false);
+});
+
+test('the page offers Mark resolved, Post & resolve and Reopen, each where it can work', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js').replace(/^\s*\/\/.*$/gm, '');
+  assert.match(js, />Mark resolved</, 'the row control says what it does');
+  assert.match(js, /L\.canClose\(req, meId, myCrafts\)\s*\?\s*`<button[^`]*data-reply-resolve/, 'Post & resolve is drawn only for someone who may close');
+  assert.match(js, /L\.canReopen\(req, meId\)/, 'Reopen is drawn only for the asker');
+  assert.match(js, /settle\(Number\(reopenBtn\.getAttribute\('data-id'\)\), 'open'\)/, 'and it sends status open');
+  // The close waits for the reply: a refused reply must not leave an ask closed.
+  const post = js.slice(js.indexOf('async function postReply'), js.indexOf('function toggleReply'));
+  assert.ok(post.indexOf('if (!r.ok)') < post.indexOf("status: 'answered'"), 'resolve runs only after the reply landed');
+});

package/tests/hall_approval_queue.mjs

@@ -92,7 +92,11 @@ function bootPanel({ answers = {}, writes = null, mode = 'light' } = {}) {
     get activeElement() { return boot.focused || null; },
   };
   const api = {
-    async request(method, u, reqBody) {
+    // The REAL client's shape: request(method, path, { body }). This fake once
+    // took the payload as the third argument, which is exactly the mistake the
+    // panel made — so the suite agreed with a write that sent nothing (task 1004458).
+    async request(method, u, opts) {
+      const reqBody = opts && opts.body;
       requests.push({ method, url: u, body: reqBody });
       const key = `${method} ${u}`;
       const hit = answers[key];

package/tests/hall_client_request_shape.mjs

@@ -0,0 +1,103 @@
+// tests/hall_client_request_shape.mjs — every write a hall page sends through the
+// generated client's escape hatch carries its payload UNDER `body` (task 1004458).
+//
+// `api.request(method, path, opts)` reads `opts.body` as the JSON payload and
+// nothing else. Handing it the payload itself fails two quiet ways, and both
+// shipped: `{ decision }` (the mingle buttons) and `{ reason }` / `{ version_id,
+// … }` (the studio's verdicts) have no `body` key, so the request goes out EMPTY;
+// and `{ body: text }` (the Collab reply) sends a bare JSON string, which the
+// server's strict parser refuses as `bad_json`. Neither is visible until someone
+// presses the button on the live site.
+//
+// So this RUNS the real client against a recording fetch to pin what `body`
+// means, then scans every hall-side call for an options object whose keys are
+// not options.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const OPTION_KEYS = new Set(['body', 'query', 'headers', 'hasBody', 'cache']);
+
+function client() {
+  const sent = [];
+  const win = {};
+  const src = fs.readFileSync(path.join(ROOT, 'clients', 'bongos-client', 'bongos-client.global.js'), 'utf8');
+  new Function('window', 'globalThis', 'self', src)(win, win, win);
+  const fetch = async (url, init) => { sent.push({ url, init }); return { ok: true, status: 200, text: async () => '{}' }; };
+  return { sent, api: win.BongosClient.createClient({ fetch, throwOnError: false }) };
+}
+
+test('the escape hatch sends opts.body as the payload, and nothing else', async () => {
+  const { sent, api } = client();
+  await api.request('POST', '/x', { body: { body: 'hello' } });
+  assert.equal(sent[0].init.body, '{"body":"hello"}', 'a nested object arrives as an object');
+  await api.request('POST', '/x', { decision: 'accepted' });
+  assert.equal(sent[1].init.body, undefined, 'a payload passed as options is DROPPED — this is the trap');
+});
+
+// Every `api.request('POST'|'PATCH'|'PUT'|'DELETE', …)` in a hall-side file.
+function hallFiles() {
+  const out = [];
+  for (const mod of fs.readdirSync(path.join(ROOT, 'modules'))) {
+    const dir = path.join(ROOT, 'modules', mod, 'public');
+    if (!fs.existsSync(dir)) continue;
+    for (const f of fs.readdirSync(dir)) if (f.endsWith('.js')) out.push(path.join(dir, f));
+  }
+  return out;
+}
+
+// The top-level arguments of the call starting at `open` (the index of its "(").
+function argsAt(src, open) {
+  const args = [];
+  let depth = 0; let cur = ''; let quote = null;
+  for (let i = open + 1; i < src.length; i++) {
+    const c = src[i];
+    if (quote) { cur += c; if (c === '\\') { cur += src[++i]; } else if (c === quote) quote = null; continue; }
+    if (c === '"' || c === "'" || c === '`') { quote = c; cur += c; continue; }
+    if ('({['.includes(c)) depth++;
+    if (')}]'.includes(c)) { if (depth === 0) { args.push(cur.trim()); return args; } depth--; }
+    if (c === ',' && depth === 0) { args.push(cur.trim()); cur = ''; continue; }
+    cur += c;
+  }
+  return args;
+}
+
+// The keys of an object literal's top level: `{ a, b: 1, ...c }` → ['a', 'b', '...'].
+function topKeys(obj) {
+  const inner = obj.trim().replace(/^\{/, '').replace(/\}$/, '');
+  return argsAt(`(${inner})`, 0).filter(Boolean).map((part) => {
+    if (part.startsWith('...')) return '...';
+    const m = /^([A-Za-z_$][\w$]*)\s*(?::|$)/.exec(part);
+    return m ? m[1] : part;
+  });
+}
+
+test('no hall page hands the client a payload where it expects options', () => {
+  const bad = [];
+  let seen = 0;
+  for (const file of hallFiles()) {
+    const src = fs.readFileSync(file, 'utf8');
+    const re = /\bapi\.request\(\s*'(POST|PATCH|PUT|DELETE)'/g;
+    let m;
+    while ((m = re.exec(src))) {
+      seen++;
+      const args = argsAt(src, src.indexOf('(', m.index));
+      const where = `${path.relative(ROOT, file)}:${src.slice(0, m.index).split('\n').length}`;
+      const opts = args[2];
+      if (!opts) continue;
+      if (!opts.startsWith('{')) { bad.push(`${where} passes \`${opts}\` — wrap it as { body: … }`); continue; }
+      const unknown = topKeys(opts).filter((k) => !OPTION_KEYS.has(k));
+      if (unknown.length) bad.push(`${where} passes ${unknown.join(', ')} as options — they are dropped; nest them under body`);
+    }
+  }
+  assert.ok(seen > 10, `the scan found the calls it is guarding (${seen})`);
+  assert.deepEqual(bad, [], bad.join('\n'));
+});
+
+test('the Collab reply nests its `body` field inside the payload', () => {
+  const js = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'collab.js'), 'utf8');
+  assert.match(js, /\/replies`, \{ body: \{ body: v\.body \} \}\)/, 'a bare string is refused by the server as bad_json');
+});