agent-dealer 1.2.2 → 1.2.4

package/bundle/server/dist/capacity/muse.js

@@ -3,16 +3,21 @@
 // NOT-247: Muse Code capacity adapter — read stable MSP usage windows.
 // NOT-263: handshake repaired against the stable schema embedded in the
 // shipped binary (`muse schema generate-json-schema`).
+// NOT-270: production reads go through the server-owned long-lived host
+// (`./muse-host.js`). NOT-269 proved a fresh `muse serve` host is
+// structurally unobserved, so the old spawn → `usage/read` → exit poll is
+// retired: only a host that observed the account's provider traffic can
+// answer `usage/read` / emit `usage/changed`.
 //
-// Reads observed capacity through the stable Muse Session Protocol without
-// sending a prompt and without consuming model tokens: `muse serve` over a
-// one-shot managed stdio connection, then `initialize` → `initialized` → one
-// `usage/read`, then shutdown. `usage/changed` notifications received while
-// the connection is alive are recorded. The client enforces a read-only
+// The free read phase reads observed capacity through the stable Muse Session
+// Protocol without sending a prompt or consuming model tokens: `initialize` →
+// `initialized` → `usage/read` on the owned host, with `usage/changed`
+// notifications ingested as received. The client enforces a read-only
 // allowlist (`initialize`, `initialized`, `usage/read`) — any other method
-// throws before it is written, so polling can never start a session, send a
-// prompt, or run model work. It never touches the Keychain or undocumented
-// endpoints.
+// throws before it is written, so a capacity read can never start a
+// session, send a prompt, or run model work. The separate default-on fallback
+// in `muse-probe.ts` runs only after this phase still lacks a complete current
+// pair for an hour. Neither path touches the Keychain or undocumented endpoints.
 //
 // Stable `usage/read` shape:
 //   result: {
@@ -39,12 +44,33 @@
 // adapter passes no credentials (the serve subprocess uses its ambient
 // session) and evidence refs are static strings.
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import fs from "node:fs";
 import { MUSE_CLI_ENV, resolveMuseAuthFile, resolveMuseBin } from "../cli-env.js";
 import { normalizeAdapterWindow, normalizeUnavailableWindow, } from "./adapter.js";
 export const MUSE_RUNTIME = "muse_code";
+/** Muse observations remain the last-known current value until the one-hour
+ * fallback boundary. This avoids the shared adapter's generic 15-minute N/A
+ * gap before a bounded refresh is eligible to run. */
+export const MUSE_CAPACITY_STALE_AFTER_MS = 60 * 60 * 1000;
+export const MUSE_CAPACITY_EXPIRES_AFTER_MS = 60 * 60 * 1000;
 /** Methods this client may ever send. Anything else throws before write. */
 export const MSP_READ_ONLY_METHODS = ["initialize", "initialized", "usage/read"];
+/**
+ * NOT-270: execution methods for REAL Dealer work through the server-owned
+ * serve host (the NOT-269 proven lifecycle: only a host that observes the
+ * account's provider traffic can answer `usage/read`). This is a separate
+ * allowlist from the read-only one above — a capacity read still never sends
+ * these. `session/resume` stays forbidden (state-changing, carries no usage
+ * per NOT-269 leg 2); `turn/steer` and approval writes are never sent by the
+ * headless runner, so they are refused here too.
+ */
+export const MSP_EXEC_METHODS = [
+    "session/start",
+    "turn/start",
+    "turn/cancel",
+    "session/read",
+];
 /**
  * Client identity sent in the `initialize` handshake. The stable schema
  * requires `clientInfo.name` to match `^[a-z0-9_]+$` plus a version string.
@@ -68,6 +94,27 @@ export function assertMuseReadOnlyMethod(method) {
         throw new Error(`muse-serve: refusing non-read method ${method}`);
     }
 }
+export function assertMuseExecMethod(method) {
+    if (!MSP_EXEC_METHODS.includes(method)) {
+        throw new Error(`muse-serve: refusing non-execution method ${method}`);
+    }
+}
+/**
+ * UUIDv7 for MSP `commandId` idempotency handles (session/start, turn/start,
+ * turn/cancel require UUIDv7). Time-ordered; randomness from crypto.
+ */
+export function museUuidv7(nowMs = Date.now()) {
+    const b = Buffer.alloc(16);
+    const ts = BigInt(nowMs) & ((1n << 48n) - 1n);
+    for (let i = 0; i < 6; i++)
+        b[i] = Number((ts >> BigInt(40 - 8 * i)) & 0xffn);
+    randomBytes(10).copy(b, 6);
+    b[6] = 0x70 | (b[6] & 0x0f);
+    b[8] = 0x80 | (b[8] & 0x3f);
+    const hex = b.toString("hex");
+    return (`${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-` +
+        `${hex.slice(16, 20)}-${hex.slice(20)}`);
+}
 function readOnlyRequest(id, method, params) {
     assertMuseReadOnlyMethod(method);
     return `${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`;
@@ -79,9 +126,17 @@ function readOnlyNotification(method, params) {
 /**
  * Stable Session Protocol argv. Fixed: capacity reads never `exec`, and the
  * host takes no `--protocol` flag — `muse serve` with that flag exits 2
- * against the shipped binary, so this stays exactly `["serve"]`.
+ * against the shipped binary.
+ *
+ * NOT-270: the owned host is also the execution host for real Dealer Muse
+ * turns (the NOT-269 precondition — only a host that observes provider
+ * traffic can answer `usage/read`). Sandbox posture is fixed at host
+ * startup and applies to every session on the host, so the host carries the
+ * same `--sandbox-network restricted` every `muse exec` developer invocation
+ * already passes (see runners/muse-code-args.ts — a fixed constant, no
+ * per-session variation). Approval mode stays per-session on the wire.
  */
-export const MUSE_SERVE_ARGV = ["serve"];
+export const MUSE_SERVE_ARGV = ["serve", "--sandbox-network", "restricted"];
 /** JSON-RPC request ids for the one-shot read (init handshake, then usage). */
 export const MSP_INITIALIZE_ID = "muse-capacity-init";
 export const MSP_USAGE_READ_ID = "muse-capacity-1";
@@ -140,6 +195,8 @@ function windowReadingFromEntry(kind, entry, observedAt) {
         usedPercent,
         resetAt,
         observedAt,
+        staleAfterMs: MUSE_CAPACITY_STALE_AFTER_MS,
+        expiresAfterMs: MUSE_CAPACITY_EXPIRES_AFTER_MS,
         source: "supported_protocol",
         // Muse reports exactly this one rolling/weekly pair — it is always the
         // account-wide critical window, never a model-specific extra.
@@ -237,7 +294,8 @@ export function museCapacityTimeoutMs() {
     return 15_000;
 }
 const AUTH_RE = /login is no longer valid|authentication failed|missing \w+ credentials|api key .*rejected|unauthenticated|unauthorized|unauthori[sz]ed|not (signed|logged) in|sign in|\b401\b|\b403\b|forbidden/i;
-function parseRpcLine(line) {
+/** Parse one stdio JSON-RPC line; null for blank/non-JSON chatter. Shared with the owned host. */
+export function parseMuseRpcLine(line) {
     const t = line.trim();
     if (!t)
         return null;
@@ -257,8 +315,19 @@ function errorLooksAuth(error) {
     const e = error;
     return AUTH_RE.test(String(e.message ?? "")) || e.code === 401 || e.code === 403;
 }
+/** Classify an MSP RPC error for the owned host: auth, missing method, or other. */
+export function museClassifyRpcError(error) {
+    if (errorLooksAuth(error))
+        return "auth";
+    if (error !== null &&
+        typeof error === "object" &&
+        error.code === -32601) {
+        return "unsupported";
+    }
+    return "other";
+}
 /** The only credential signals the repo knows (cf. agent-health): env key or login file. */
-function hasMuseCredential(env, authFilePath) {
+export function hasMuseCredential(env, authFilePath) {
     const key = env.META_API_KEY;
     if (typeof key === "string" && key.length > 0)
         return true;
@@ -273,8 +342,11 @@ function hasMuseCredential(env, authFilePath) {
  * Spawn `muse serve`, run the stable handshake (`initialize` with a
  * `clientInfo` identity, then the `initialized` notification), send one
  * `usage/read`, record any `usage/changed` notifications, then shut the
- * connection down. Never throws for provider-side failures — those come back
- * as `failure.kind`. Never sends anything outside MSP_READ_ONLY_METHODS.
+ * connection down. Low-level primitive (unit-tested); production uses the
+ * owned long-lived host (`./muse-host.js`) — a fresh connection is
+ * unobserved by construction (NOT-269). Never throws for provider-side
+ * failures — those come back as `failure.kind`. Never sends anything
+ * outside MSP_READ_ONLY_METHODS.
  */
 export function requestMuseUsage(opts = {}) {
     const command = opts.command ?? resolveMuseBin();
@@ -309,7 +381,7 @@ export function requestMuseUsage(opts = {}) {
             finish({ payload: null, updates, failure: { kind } });
         };
         const onLine = (line) => {
-            const msg = parseRpcLine(line);
+            const msg = parseMuseRpcLine(line);
             if (!msg)
                 return; // Tolerate non-JSON chatter; malformed verdict comes from the payload.
             if (typeof msg.method === "string" && msg.id === undefined) {
@@ -476,7 +548,226 @@ function failureToUnavailable(nowMs, kind) {
 }
 /** Evidence refs are static — the failure kind only, never tokens or payloads. */
 export function museEvidenceRef(kind) {
-    return `muse-serve:${kind === "read" ? "usage/read" : kind}`;
+    if (kind === "read")
+        return "muse-serve:usage/read";
+    if (kind === "changed")
+        return "muse-serve:usage/changed";
+    return `muse-serve:${kind}`;
+}
+/** Window keys that carry real Muse capacity (NOT-266: never the sentinel). */
+export const MUSE_KNOWN_WINDOW_KEYS = ["rolling_all_models", "weekly_all_models"];
+function observedMs(value) {
+    if (typeof value !== "string")
+        return null;
+    const ms = Date.parse(value);
+    return Number.isFinite(ms) ? ms : null;
+}
+/**
+ * The payload's own arrival stamp (`usage.observedAtMs`), mirroring
+ * `museUsageToReadings` — per-window diagnostics share it so a
+ * present-but-malformed sibling never outranks a valid row by wall clock.
+ */
+export function musePayloadObservedAt(payload, fallback) {
+    if (payload && typeof payload === "object") {
+        const result = payload;
+        const usage = "usage" in result && result.usage !== null && typeof result.usage === "object"
+            ? result.usage
+            : result;
+        const ms = usage.observedAtMs;
+        if (typeof ms === "number" && Number.isFinite(ms)) {
+            return new Date(ms).toISOString();
+        }
+    }
+    return fallback;
+}
+/**
+ * NOT-270: newest-`observedAtMs`-wins ingest for Muse usage observations.
+ * Accepts a `usage/read` result envelope or a bare `usage/changed` params
+ * object (the stable schema carries `SubscriptionUsage` directly in the
+ * notification). Every window compares its `observedAt` against the stored
+ * row for the same key: an older observation never overwrites or deletes a
+ * newer one, so a slow finishing read cannot clobber rows a newer
+ * notification already wrote, and a fresh-host `missing` (no `usage`)
+ * never touches stored rows at all.
+ *
+ * A fully-observed pair also deletes the `muse_account_usage` failure
+ * sentinel; per-window `unparsable` diagnostics apply the same newest-wins
+ * rule and never sit beside a newer valid row for the same window.
+ */
+export async function ingestMuseUsagePayload(payload, opts = {}) {
+    const { recordCapacitySnapshots, listCapacitySnapshots, deleteCapacitySnapshots } = await import("../repository/runtime-capacity.js");
+    const nowMs = Date.now();
+    const fallback = opts.fallbackObservedAt ?? new Date(nowMs).toISOString();
+    const evidenceRef = opts.evidenceRef ?? museEvidenceRef("read");
+    const stored = new Map(listCapacitySnapshots(MUSE_RUNTIME).map((w) => [w.windowKey, w]));
+    const outcome = { written: [], skippedStale: [] };
+    const consider = (input) => {
+        const prev = stored.get(input.windowKey);
+        const prevMs = prev ? observedMs(prev.observedAt) : null;
+        const nextMs = observedMs(input.observedAt);
+        if (prevMs !== null && nextMs !== null) {
+            if (nextMs < prevMs) {
+                // Strictly older observation — never clobbers a newer row.
+                outcome.skippedStale.push(input.windowKey);
+                return;
+            }
+            if (nextMs === prevMs && input.source === "unavailable") {
+                // Same-stamp diagnostic — never relabels the stored row (a
+                // same-stamp `usage/changed` + final `usage/read` pair must not
+                // let the diagnostic half win; recovery at a newer stamp still
+                // applies through the strictly-newer path).
+                outcome.skippedStale.push(input.windowKey);
+                return;
+            }
+            // Same-stamp good observation: the final `usage/read` is
+            // authoritative over the earlier `usage/changed` for the same
+            // arrival stamp — rewrite idempotently.
+        }
+        recordCapacitySnapshots(MUSE_RUNTIME, [
+            {
+                windowKey: input.windowKey,
+                providerBucket: input.providerBucket,
+                durationMinutes: input.durationMinutes ?? null,
+                displayLabel: input.displayLabel,
+                usedValue: input.usedValue ?? null,
+                usedUnit: input.usedUnit ?? null,
+                remainingPercent: input.remainingPercent ?? null,
+                resetAt: input.resetAt ?? null,
+                observedAt: input.observedAt,
+                freshUntil: input.freshUntil ?? null,
+                expiresAt: input.expiresAt ?? null,
+                source: input.source,
+                unavailableReason: input.unavailableReason ?? null,
+                evidenceRef,
+                criticalRole: input.criticalRole ?? null,
+            },
+        ]);
+        stored.delete(input.windowKey);
+        outcome.written.push(input.windowKey);
+    };
+    const payloadObservedAt = musePayloadObservedAt(payload, fallback);
+    let parsed = null;
+    try {
+        parsed = museUsageToReadings(payload, fallback);
+    }
+    catch {
+        parsed = null;
+    }
+    if (parsed && parsed.windows.length > 0) {
+        const normalized = parsed.windows.map((w) => normalizeAdapterWindow(MUSE_RUNTIME, w, nowMs));
+        for (let i = 0; i < parsed.windows.length; i++) {
+            const n = normalized[i];
+            if (n.unavailableReason !== null || n.remainingPercent === null) {
+                consider({
+                    windowKey: n.windowKey,
+                    providerBucket: n.providerBucket,
+                    durationMinutes: n.durationMinutes,
+                    displayLabel: n.displayLabel,
+                    observedAt: n.observedAt,
+                    source: "unavailable",
+                    unavailableReason: "unparsable",
+                    criticalRole: n.criticalRole,
+                });
+            }
+            else {
+                const raw = parsed.windows[i];
+                consider({
+                    windowKey: raw.windowKey,
+                    providerBucket: raw.providerBucket,
+                    durationMinutes: raw.durationMinutes,
+                    displayLabel: n.displayLabel,
+                    usedValue: raw.usedValue,
+                    usedUnit: raw.usedUnit,
+                    remainingPercent: n.remainingPercent,
+                    resetAt: n.resetAt,
+                    observedAt: raw.observedAt ?? fallback,
+                    freshUntil: n.freshUntil,
+                    expiresAt: n.expiresAt,
+                    source: "supported_protocol",
+                    criticalRole: raw.criticalRole,
+                });
+            }
+        }
+        for (const kind of museBadWindowKinds(payload)) {
+            const key = kind === "rolling" ? "rolling_all_models" : "weekly_all_models";
+            if (outcome.written.includes(key) || outcome.skippedStale.includes(key))
+                continue;
+            consider({
+                windowKey: key,
+                providerBucket: "all_models",
+                durationMinutes: kind === "weekly" ? MUSE_WEEKLY_DURATION_MINUTES : null,
+                displayLabel: kind,
+                observedAt: payloadObservedAt,
+                source: "unavailable",
+                unavailableReason: "unparsable",
+                criticalRole: kind === "rolling" ? "five_hour" : "weekly",
+            });
+        }
+        if (outcome.written.some((k) => MUSE_KNOWN_WINDOW_KEYS.includes(k))) {
+            deleteCapacitySnapshots(MUSE_RUNTIME, [SENTINEL_WINDOW_KEY]);
+        }
+        return outcome;
+    }
+    if (parsed && museBadWindowKinds(payload).length > 0) {
+        for (const kind of museBadWindowKinds(payload)) {
+            const key = kind === "rolling" ? "rolling_all_models" : "weekly_all_models";
+            consider({
+                windowKey: key,
+                providerBucket: "all_models",
+                durationMinutes: kind === "weekly" ? MUSE_WEEKLY_DURATION_MINUTES : null,
+                displayLabel: kind,
+                observedAt: payloadObservedAt,
+                source: "unavailable",
+                unavailableReason: "unparsable",
+                criticalRole: kind === "rolling" ? "five_hour" : "weekly",
+            });
+        }
+        if (outcome.written.length > 0) {
+            deleteCapacitySnapshots(MUSE_RUNTIME, [SENTINEL_WINDOW_KEY]);
+        }
+        return outcome;
+    }
+    // No observation in the payload (fresh/unobserved host reads `missing`):
+    // never overwrite or delete stored rows.
+    return outcome;
+}
+/**
+ * NOT-270: record a host-level failure without touching last-good rows. A
+ * failure diagnostic (the `muse_account_usage` sentinel) is written only
+ * when no per-window row exists — it must never sit beside or relabel
+ * valid windows, nor beside per-window `unparsable` diagnostics (those
+ * already describe the 5H/1W entry; a sentinel next to them would mix two
+ * diagnostics for the same entry). A stored sentinel alone is refreshed in
+ * place.
+ */
+export async function noteMuseCapacityFailure(reason, nowMs = Date.now()) {
+    const { recordCapacitySnapshots, listCapacitySnapshots } = await import("../repository/runtime-capacity.js");
+    const stored = listCapacitySnapshots(MUSE_RUNTIME);
+    if (stored.some((w) => MUSE_KNOWN_WINDOW_KEYS.includes(w.windowKey)))
+        return "preserved";
+    const normalized = normalizeUnavailableWindow(MUSE_RUNTIME, {
+        windowKey: SENTINEL_WINDOW_KEY,
+        providerBucket: "account",
+        providerLabel: "account_usage",
+        reason,
+        observedAt: new Date(nowMs).toISOString(),
+    }, nowMs);
+    recordCapacitySnapshots(MUSE_RUNTIME, [
+        {
+            windowKey: normalized.windowKey,
+            providerBucket: normalized.providerBucket,
+            durationMinutes: normalized.durationMinutes,
+            displayLabel: normalized.displayLabel,
+            observedAt: normalized.observedAt,
+            freshUntil: normalized.freshUntil,
+            expiresAt: normalized.expiresAt,
+            source: "unavailable",
+            unavailableReason: normalized.unavailableReason,
+            evidenceRef: normalized.evidenceRef,
+            criticalRole: normalized.criticalRole,
+        },
+    ]);
+    return "sentinel";
 }
 /**
  * One bounded, non-billable read of Muse account usage. Never throws:
@@ -572,34 +863,24 @@ export function createMuseCapacityAdapter(opts = {}) {
     };
 }
 /**
- * Bounded refresh: run the live adapter and ingest into normalized snapshots.
- * Reuses the shared ingest path; failures persist as N/A windows, never as
- * health rows. Imported lazily to keep the adapter module free of DB binds.
- *
- * A successful read (real windows or per-window unparsable rows) deletes
- * the failure sentinel (`muse_account_usage`): snapshot writes are
- * per-window upserts that never delete siblings, so without this a stale
- * N/A sentinel would linger next to the recovered rows indefinitely.
+ * NOT-270: the one-shot production poll (`refreshMuseCapacityFromServe` /
+ * `maybeRefreshMuseCapacityFromServe`) is retired. NOT-269 proved a fresh
+ * `muse serve` host is structurally unobserved: spawn → `usage/read` →
+ * exit can only ever read `missing`, so polling it could never refresh
+ * capacity. Production refreshes go through the server-owned long-lived
+ * host (`./muse-host.js`), which holds one connection open, ingests
+ * `usage/changed` as received, and runs throttled `usage/read` on that
+ * same observed host.
  */
-export async function refreshMuseCapacityFromServe(opts = {}) {
-    const { ingestAdapterResult, getRuntimeCapacitySnapshot } = await import("./service.js");
-    const { deleteCapacitySnapshots } = await import("../repository/runtime-capacity.js");
-    const nowMs = opts.nowMs ?? Date.now();
-    const result = await readMuseCapacity({ ...opts, nowMs });
-    await ingestAdapterResult(result);
-    const hasRealRows = result.windows.length > 0 ||
-        result.unavailable.some((u) => u.windowKey !== SENTINEL_WINDOW_KEY);
-    if (hasRealRows) {
-        deleteCapacitySnapshots(MUSE_RUNTIME, [SENTINEL_WINDOW_KEY]);
-    }
-    return getRuntimeCapacitySnapshot(nowMs);
-}
 /** Default minimum gap between production Muse refreshes (5 minutes). */
 export const MUSE_REFRESH_THROTTLE_MS_DEFAULT = 5 * 60 * 1000;
 /**
  * Throttle bound for production refreshes. Override with
- * `AGENT_DEALER_MUSE_CAPACITY_REFRESH_MS` (milliseconds); `off` disables
- * refresh entirely. Non-positive or unparsable values fall back to the default.
+ * `AGENT_DEALER_MUSE_CAPACITY_REFRESH_MS` (milliseconds); `off` disables the
+ * free host read and, for backward-compatible no-spend behavior, also disables
+ * the paid fallback unless `AGENT_DEALER_MUSE_CAPACITY_REFRESH=paid-after-1h`
+ * is explicit. Non-positive or unparsable values fall back to the default.
+ * Shared with the owned host (`./muse-host.js`).
  */
 export function museRefreshThrottleMs() {
     const raw = process.env.AGENT_DEALER_MUSE_CAPACITY_REFRESH_MS;
@@ -612,30 +893,6 @@ export function museRefreshThrottleMs() {
         return n;
     return MUSE_REFRESH_THROTTLE_MS_DEFAULT;
 }
-let lastMuseRefreshMs = 0;
-/** Test helper — reset the refresh throttle so the next refresh runs. */
-export function resetMuseCapacityRefreshState() {
-    lastMuseRefreshMs = 0;
-}
-/**
- * Production trigger for the Muse adapter: throttled, bounded, best-effort.
- * Returns the refreshed snapshot, or null when throttled/disabled. Never
- * throws — a failed refresh persists as N/A through the shared ingest path,
- * and any unexpected error resolves to null so callers (routes) can still
- * serve the last-known snapshot.
- */
-export async function maybeRefreshMuseCapacityFromServe(opts = {}, nowMs = Date.now()) {
-    const throttle = museRefreshThrottleMs();
-    if (!Number.isFinite(throttle) || nowMs - lastMuseRefreshMs < throttle)
-        return null;
-    lastMuseRefreshMs = nowMs;
-    try {
-        return await refreshMuseCapacityFromServe({ ...opts, nowMs });
-    }
-    catch {
-        return null;
-    }
-}
 /** Normalize one unavailable Muse reading for direct persistence (tests/tools). */
 export function normalizeMuseUnavailable(reason, nowMs = Date.now()) {
     return normalizeUnavailableWindow(MUSE_RUNTIME, {

package/bundle/server/dist/capacity/muse.test.js

@@ -16,10 +16,10 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-cap-"));
-import { assertMuseReadOnlyMethod, createMuseCapacityAdapter, MSP_FORBIDDEN_MODEL_METHODS, MUSE_CLIENT_INFO, MUSE_SERVE_ARGV, museRefreshThrottleMs, museUsageToReadings, maybeRefreshMuseCapacityFromServe, normalizeMuseResetsAt, normalizeMuseUnavailable, readMuseCapacity, refreshMuseCapacityFromServe, requestMuseUsage, resetMuseCapacityRefreshState, } from "./muse.js";
+import { assertMuseReadOnlyMethod, createMuseCapacityAdapter, MSP_FORBIDDEN_MODEL_METHODS, MUSE_CLIENT_INFO, MUSE_SERVE_ARGV, museUsageToReadings, normalizeMuseResetsAt, normalizeMuseUnavailable, readMuseCapacity, requestMuseUsage, } from "./muse.js";
 import { normalizeAdapterWindow, normalizeUnavailableWindow } from "./adapter.js";
 const { migrate } = await import("../db/index.js");
-const { clearAllCapacitySnapshots, listCapacitySnapshots } = await import("../repository/runtime-capacity.js");
+const { clearAllCapacitySnapshots } = await import("../repository/runtime-capacity.js");
 const { clearAllRuntimeAvailability, runtimeAvailability, } = await import("../repository/runtime-availability.js");
 const { refreshCapacityFromAdapters } = await import("./service.js");
 const FAKE = new URL("./fixtures/fake-muse-serve.mjs", import.meta.url).pathname;
@@ -44,8 +44,8 @@ function fakeOpts(mode, extra = {}) {
         },
     };
 }
-test("serve argv is the shipping contract: no --protocol flag", () => {
-    assert.deepEqual([...MUSE_SERVE_ARGV], ["serve"]);
+test("serve argv is the shipping contract: no --protocol flag, restricted network", () => {
+    assert.deepEqual([...MUSE_SERVE_ARGV], ["serve", "--sandbox-network", "restricted"]);
     assert.ok(!MUSE_SERVE_ARGV.includes("--protocol"), "muse serve takes no --protocol flag");
 });
 test("handshake identity matches the stable clientInfo shape", () => {
@@ -305,53 +305,10 @@ test("no credential short-circuits to missing without spawning", async () => {
     assert.equal(result.windows.length, 0);
     assert.equal(result.unavailable[0].reason, "missing");
 });
-test("a successful refresh clears the failure sentinel", async () => {
-    clearAllCapacitySnapshots();
-    await refreshMuseCapacityFromServe(fakeOpts("crash").opts);
-    assert.deepEqual(listCapacitySnapshots("muse_code").map((w) => w.windowKey), ["muse_account_usage"]);
-    const snap = await refreshMuseCapacityFromServe(fakeOpts("full").opts);
-    const keys = listCapacitySnapshots("muse_code")
-        .map((w) => w.windowKey)
-        .sort();
-    assert.deepEqual(keys, ["rolling_all_models", "weekly_all_models"]);
-    const muse = snap.runtimes.find((r) => r.runtime === "muse_code");
-    assert.ok(muse);
-    assert.equal(muse.windows.length, 2);
-    assert.equal(muse.unavailableReason, null);
-});
-test("a read with every window unparsable clears the stale sentinel", async () => {
-    clearAllCapacitySnapshots();
-    await refreshMuseCapacityFromServe(fakeOpts("crash").opts);
-    assert.deepEqual(listCapacitySnapshots("muse_code").map((w) => w.windowKey), ["muse_account_usage"]);
-    const result = await readMuseCapacity(fakeOpts("all-bad-windows").opts);
-    assert.equal(result.windows.length, 0);
-    assert.ok(result.unavailable.length > 0);
-    assert.ok(result.unavailable.every((u) => u.windowKey !== "muse_account_usage"));
-    await refreshMuseCapacityFromServe(fakeOpts("all-bad-windows").opts);
-    const keys = listCapacitySnapshots("muse_code").map((w) => w.windowKey);
-    assert.ok(!keys.includes("muse_account_usage"), `stale sentinel cleared, got ${keys}`);
-    assert.ok(keys.length > 0, "per-window unparsable rows persist");
-});
-test("production refresh is throttled and can be disabled", async () => {
-    clearAllCapacitySnapshots();
-    resetMuseCapacityRefreshState();
-    const { opts } = fakeOpts("full");
-    try {
-        assert.equal(museRefreshThrottleMs(), 5 * 60 * 1000);
-        const first = await maybeRefreshMuseCapacityFromServe(opts);
-        assert.ok(first, "first refresh runs");
-        assert.equal(await maybeRefreshMuseCapacityFromServe(opts), null, "second refresh throttled");
-        process.env.AGENT_DEALER_MUSE_CAPACITY_REFRESH_MS = "off";
-        resetMuseCapacityRefreshState();
-        assert.equal(await maybeRefreshMuseCapacityFromServe(opts), null, "refresh disabled");
-        process.env.AGENT_DEALER_MUSE_CAPACITY_REFRESH_MS = "garbage";
-        assert.equal(museRefreshThrottleMs(), 5 * 60 * 1000);
-    }
-    finally {
-        delete process.env.AGENT_DEALER_MUSE_CAPACITY_REFRESH_MS;
-        resetMuseCapacityRefreshState();
-    }
-});
+// NOT-270: the one-shot production poll is retired (see muse-host.test.ts
+// for the owned-host refresh, sentinel, and throttle coverage). The adapter
+// read primitive above stays unit-tested; production ingest moved to
+// `ingestMuseUsagePayload` newest-observedAtMs-wins.
 test("no token, tier, or raw account payload reaches the adapter output", async () => {
     const { opts } = fakeOpts("full");
     const result = await readMuseCapacity(opts);