agent-dealer 1.3.1 → 1.3.3

package/bundle/server/dist/adapters/agent-health.test.js

@@ -17,6 +17,8 @@ const { migrate, getDb } = await import("../db/index.js");
 const { createAgent, getAgent } = await import("../repository/agents.js");
 const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, githubIssuesSync, classifyGithubAuthStatus, clearAgentHealthCaches, setCursorProbeTimingForTests, setRunCommandForTests, } = await import("./agent-health.js");
 const { setMuseCapabilityProbeForTests, settleMuseCapabilityCheckForTests } = await import("./muse-capability.js");
+const { recordMuseUsageCap } = await import("../runners/usage-cap.js");
+const { runtimeAvailability, clearAllRuntimeAvailability, } = await import("../repository/runtime-availability.js");
 migrate();
 // NOT-277: health never runs the real (billed) Muse capability probe in tests.
 setMuseCapabilityProbeForTests(async () => ({ status: "capable" }));
@@ -441,6 +443,56 @@ The keychain item is stuck. Delete it and sign in again:
         assert.match(issues[0].message, /panic: something else broke/);
         assert.doesNotMatch(issues[0].message, /muse login/);
     });
+    // ---------------------------------------------------------------------------
+    // NOT-439: agent health renders the exact provider boundary from persisted
+    // availability — the reproduced Muse message resolves to 11:59 AM in
+    // America/Los_Angeles, not the 11:46 AM of the old 30-minute fallback.
+    // ---------------------------------------------------------------------------
+    test("NOT-439: persisted muse provider reset renders the exact boundary, not the fallback", async () => {
+        clearAllRuntimeAvailability();
+        clearAgentHealthCaches();
+        try {
+            // Pinned incident replay: the provider said resets-at 18:59:01Z while the
+            // old fallback stored 18:46:20.154Z. Timezone-safe assertions on the
+            // stored instant itself.
+            const incidentNow = Date.parse("2026-10-12T18:16:20.154Z");
+            const cap = recordMuseUsageCap({
+                kind: "usage_cap",
+                message: "Subscription quota exhausted. Your usage window resets at 2026-10-12T18:59:01Z",
+            }, incidentNow);
+            assert.equal(cap?.unavailableUntil, "2026-10-12T18:59:01.000Z");
+            const stored = runtimeAvailability("muse_code", incidentNow);
+            assert.equal(stored.available, false);
+            if (!stored.available)
+                assert.equal(stored.until, "2026-10-12T18:59:01.000Z");
+            const la = { hour: "2-digit", minute: "2-digit", timeZone: "America/Los_Angeles" };
+            assert.equal(new Date("2026-10-12T18:59:01.000Z").toLocaleTimeString("en-US", la), "11:59 AM");
+            // The superseded fallback instant renders differently, proving the
+            // assertion distinguishes the two.
+            assert.equal(new Date("2026-10-12T18:46:20.154Z").toLocaleTimeString("en-US", la), "11:46 AM");
+            // Live surface: a guaranteed-future provider reset flows verbatim from
+            // persisted availability into the usage_capped health message.
+            const future = new Date(Date.now() + 2 * 3600_000);
+            future.setMilliseconds(0);
+            const resetIso = future.toISOString();
+            const live = recordMuseUsageCap({ kind: "usage_cap", message: `Subscription quota exhausted. Resets at ${resetIso}` });
+            assert.equal(live?.unavailableUntil, resetIso);
+            const stub = stubMuse(`cat ${JSON.stringify(path.join(FIXTURES, "muse-version.txt"))}`);
+            const agent = createAgent({ name: "muse-capped", runtime: "muse_code", deckId: randomUUID() });
+            const result = await withMuseEnv({ MUSE_CLI: stub.bin, META_API_KEY: "k", configHome: emptyConfigHome() }, () => healthForAgent(agent, true, undefined, true, null, NO_GITHUB));
+            const issue = result.issues.find((i) => i.code === "usage_capped");
+            assert.ok(issue, "expected a usage_capped issue from persisted availability");
+            const expectedRendering = new Date(resetIso).toLocaleTimeString([], {
+                hour: "2-digit",
+                minute: "2-digit",
+            });
+            assert.ok(issue.message.includes(expectedRendering), `expected health message ${JSON.stringify(issue.message)} to render ${expectedRendering}`);
+        }
+        finally {
+            clearAllRuntimeAvailability();
+            clearAgentHealthCaches();
+        }
+    });
     test("a muse probe that hangs past the timeout is runtime_unknown", async () => {
         const stub = stubMuse("sleep 30");
         setCursorProbeTimingForTests({ timeoutMs: 150 });

package/bundle/server/dist/adapters/git-worktree.js

@@ -18,6 +18,17 @@ import { withRepoLock } from "../runners/process-registry.js";
  * Kept inside the repo (not `$AGENT_DEALER_HOME`) so `agent-deck use` grants cover the
  * worker cwd and `bind_workspace` to that path can succeed. */
 export const WORKTREES_DIR_NAME = ".agent-dealer-worktrees";
+/** Directory name for coordinator-staged CI visual artifacts inside a reviewer
+ * worktree (NOT-384). The reviewer has no shell, so it cannot list the worktree
+ * root itself — but its file tools read paths the prompt names, and only paths
+ * inside the worktree are readable under Claude Code's `--restricted` file
+ * confinement. The directory is untracked and ignored by `isWorktreeClean`
+ * below, so staged evidence never reads as reviewer dirt. It only ever exists
+ * in detached-HEAD reviewer checkouts (developer sessions never create it); a
+ * developer-side file of the same hidden name would be ignored by the clean
+ * check too, but salvage (`git add -A`) still sweeps it up, so nothing is lost —
+ * and the coordinator never stages it anywhere but a reviewer worktree. */
+export const REVIEWER_VISUAL_STAGING_DIR_NAME = ".agent-dealer-visual";
 const execFileAsync = promisify(execFile);
 const gitCommandObservers = new Set();
 /** Registers `observer` for every adapter `git` invocation; returns the unsubscribe. */
@@ -214,8 +225,34 @@ export async function removeWorktree(opts) {
 async function readOnlyStatus(worktreePath) {
     return (await git(worktreePath, ["--no-optional-locks", "status", "--porcelain"])).stdout;
 }
+/** True when a `git status --porcelain` line names only the coordinator-staged
+ * visual-evidence directory (NOT-384) — `?? .agent-dealer-visual/` for the
+ * untracked dir, or a path under it. Anything else on the line means real dirt. */
+function isVisualStagingStatusLine(line) {
+    const entry = line.slice(0, 2);
+    if (entry !== "??")
+        return false;
+    const shown = line.slice(3).trim().replace(/^"|"$/g, "");
+    return shown === REVIEWER_VISUAL_STAGING_DIR_NAME || shown.startsWith(`${REVIEWER_VISUAL_STAGING_DIR_NAME}/`);
+}
 export async function isWorktreeClean(worktreePath) {
-    return (await readOnlyStatus(worktreePath)).trim().length === 0;
+    const out = (await readOnlyStatus(worktreePath)).trim();
+    if (!out)
+        return true;
+    return out
+        .split("\n")
+        .map((line) => line.trimEnd())
+        .filter((line) => line.length > 0)
+        .every(isVisualStagingStatusLine);
+}
+/** Repo-relative paths changed between `baseSha` and `headSha` (NOT-384: the
+ * UI-affecting classifier's input). Empty when the SHAs match. */
+export async function listChangedFiles(opts) {
+    const { stdout } = await git(opts.worktreePath, ["diff", "--name-only", opts.baseSha, opts.headSha]);
+    return stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
 }
 /** Commit message for a timeout salvage tip (NOT-145). */
 export const SALVAGE_TIMEOUT_MESSAGE = "wip: timeout salvage";

package/bundle/server/dist/adapters/github.js

@@ -334,6 +334,17 @@ export function formatChecksFailureDetails(opts) {
     }
     return parts.join("\n");
 }
+export function parseWorkflowRunInfo(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return null;
+    const row = raw;
+    if (typeof row.databaseId !== "number" || typeof row.headSha !== "string" || !row.headSha) {
+        return null;
+    }
+    const conclusion = typeof row.conclusion === "string" && row.conclusion ? row.conclusion : null;
+    const status = typeof row.status === "string" && row.status ? row.status : null;
+    return { databaseId: row.databaseId, headSha: row.headSha, conclusion, status };
+}
 const NO_COMMITS_PATTERN = /no commits between/i;
 const defaultExec = (args, opts) => run("gh", args, { cwd: opts.cwd, maxBuffer: opts.maxBuffer });
 async function ghPrView(exec, cwd, fields, selector) {
@@ -407,6 +418,45 @@ export function createGithubAdapter(exec = defaultExec) {
                 return "UNKNOWN";
             }
         },
+        async listWorkflowRunsForCommit({ cwd, workflow, commitSha }) {
+            try {
+                const { stdout } = await exec([
+                    "run",
+                    "list",
+                    "--workflow",
+                    workflow,
+                    "--commit",
+                    commitSha,
+                    "--limit",
+                    "5",
+                    "--json",
+                    "databaseId,headSha,conclusion,status",
+                ], { cwd });
+                const rows = JSON.parse(stdout);
+                if (!Array.isArray(rows))
+                    return [];
+                const runs = [];
+                for (const row of rows) {
+                    const parsed = parseWorkflowRunInfo(row);
+                    if (parsed)
+                        runs.push(parsed);
+                }
+                return runs;
+            }
+            catch (err) {
+                const message = err.stderr ?? err.message;
+                throw new Error(`gh run list failed: ${message}`);
+            }
+        },
+        async downloadRunArtifact({ cwd, runId, name, destDir }) {
+            try {
+                await exec(["run", "download", String(runId), "--name", name, "--dir", destDir], { cwd });
+            }
+            catch (err) {
+                const message = err.stderr ?? err.message;
+                throw new Error(`gh run download failed: ${message}`);
+            }
+        },
         async publishReview({ cwd, number, event, bodyFilePath }) {
             const result = await runReview(exec, cwd, number, event, bodyFilePath);
             if (result.ok || event === "COMMENT" || !OWN_PR_REVIEW_PATTERN.test(result.reason)) {

package/bundle/server/dist/adapters/github.test.js

@@ -1,7 +1,7 @@
 // packages/server/src/adapters/github.test.ts
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { parsePrView, summarizeChecks, pollPrChecks, pollPrChecksDetailed, baseRefHasPullRequestWorkflow, workflowHasPullRequestTrigger, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_EVIDENCE_MAX_EXCERPT_LINES, CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, } from "./github.js";
+import { parsePrView, summarizeChecks, pollPrChecks, pollPrChecksDetailed, baseRefHasPullRequestWorkflow, workflowHasPullRequestTrigger, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_EVIDENCE_MAX_EXCERPT_LINES, CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, parseWorkflowRunInfo, } from "./github.js";
 test("parsePrView extracts the ground-truth handoff fields, including draft status", () => {
     const view = parsePrView(JSON.stringify({
         number: 7,
@@ -814,3 +814,91 @@ test("NOT-252: formatChecksFailureDetails labels the excerpt as untrusted, not i
     });
     assert.match(noExcerpt, /excerpt unavailable/);
 });
+test("NOT-384: listWorkflowRunsForCommit filters by workflow and exact commit, parsing runs", async () => {
+    const { exec, calls } = queuedExec([
+        {
+            stdout: JSON.stringify([
+                { databaseId: 42, headSha: HEAD_SHA, conclusion: "success", status: "completed" },
+                { databaseId: 41, headSha: "other", conclusion: null, status: "in_progress" },
+            ]),
+        },
+    ]);
+    const runs = await createGithubAdapter(exec).listWorkflowRunsForCommit({
+        cwd: "/repo",
+        workflow: "visual.yml",
+        commitSha: HEAD_SHA,
+    });
+    assert.deepEqual(calls[0], [
+        "run",
+        "list",
+        "--workflow",
+        "visual.yml",
+        "--commit",
+        HEAD_SHA,
+        "--limit",
+        "5",
+        "--json",
+        "databaseId,headSha,conclusion,status",
+    ]);
+    assert.deepEqual(runs, [
+        { databaseId: 42, headSha: HEAD_SHA, conclusion: "success", status: "completed" },
+        { databaseId: 41, headSha: "other", conclusion: null, status: "in_progress" },
+    ]);
+});
+test("NOT-384: listWorkflowRunsForCommit returns [] when the workflow never ran, skips malformed rows, throws on gh failure", async () => {
+    const empty = queuedExec([{ stdout: "[]" }]);
+    assert.deepEqual(await createGithubAdapter(empty.exec).listWorkflowRunsForCommit({
+        cwd: "/repo",
+        workflow: "visual.yml",
+        commitSha: HEAD_SHA,
+    }), []);
+    const malformed = queuedExec([
+        {
+            stdout: JSON.stringify([
+                { databaseId: "nope", headSha: HEAD_SHA },
+                { databaseId: 42 },
+                null,
+                { databaseId: 43, headSha: HEAD_SHA, conclusion: "", status: "" },
+            ]),
+        },
+    ]);
+    assert.deepEqual(await createGithubAdapter(malformed.exec).listWorkflowRunsForCommit({
+        cwd: "/repo",
+        workflow: "visual.yml",
+        commitSha: HEAD_SHA,
+    }), [{ databaseId: 43, headSha: HEAD_SHA, conclusion: null, status: null }]);
+    const failing = queuedExec([{ error: "HTTP 401" }]);
+    await assert.rejects(createGithubAdapter(failing.exec).listWorkflowRunsForCommit({
+        cwd: "/repo",
+        workflow: "visual.yml",
+        commitSha: HEAD_SHA,
+    }), /gh run list failed/);
+});
+test("NOT-384: parseWorkflowRunInfo rejects rows without a numeric id and head SHA", () => {
+    assert.equal(parseWorkflowRunInfo(null), null);
+    assert.equal(parseWorkflowRunInfo({ databaseId: 1 }), null);
+    assert.equal(parseWorkflowRunInfo({ databaseId: 1, headSha: "" }), null);
+    assert.deepEqual(parseWorkflowRunInfo({ databaseId: 1, headSha: "h" }), {
+        databaseId: 1,
+        headSha: "h",
+        conclusion: null,
+        status: null,
+    });
+});
+test("NOT-384: downloadRunArtifact downloads one named artifact into the dest dir, throwing on gh failure", async () => {
+    const { exec, calls } = queuedExec([{ stdout: "" }]);
+    await createGithubAdapter(exec).downloadRunArtifact({
+        cwd: "/repo",
+        runId: 42,
+        name: "ui-diff",
+        destDir: "/store/ui-diff",
+    });
+    assert.deepEqual(calls[0], ["run", "download", "42", "--name", "ui-diff", "--dir", "/store/ui-diff"]);
+    const failing = queuedExec([{ error: "no such artifact" }]);
+    await assert.rejects(createGithubAdapter(failing.exec).downloadRunArtifact({
+        cwd: "/repo",
+        runId: 42,
+        name: "ui-diff",
+        destDir: "/store/ui-diff",
+    }), /gh run download failed/);
+});

package/bundle/server/dist/capacity/service.js

@@ -5,12 +5,16 @@
 // profiles sharing one account produce one entry — each carrying whatever
 // windows the provider actually reported.
 //
-// Connection health, hard-cap availability, and remaining capacity stay
-// separate states: this service never reads `runtime_availability` and its
-// output never implies health. Only normalized snapshots leave this module —
-// evidence refs and raw provider payloads stay server-side.
+// Connection health and remaining capacity stay separate states: output never
+// implies health. Only normalized snapshots leave this module — evidence refs
+// and raw provider payloads stay server-side.
+//
+// NOT-440: an active hard cap (the same `runtime_availability` row that blocks
+// admission) rides alongside the windows as `activeCap`; stored snapshots are
+// never rewritten, and the overlay disappears with the row's lazy cleanup.
 import { isWindowKnown, Runtime as RuntimeSchema } from "@agent-dealer/shared";
 import { getDb } from "../db/index.js";
+import { activeRuntimeCap } from "../repository/runtime-availability.js";
 import { listAllCapacitySnapshots, recordCapacitySnapshots, } from "../repository/runtime-capacity.js";
 import { normalizeAdapterWindow, normalizeUnavailableWindow, } from "./adapter.js";
 /** Distinct runtimes across Agent profiles — the configured runtime accounts. */
@@ -83,6 +87,61 @@ function classifyWindow(w, nowMs) {
         known: false,
     };
 }
+const PAIR_RUNTIMES = new Set(["claude_code", "codex_local", "muse_code"]);
+const CURSOR_BILLING_WINDOW_KEY = "billing_cycle";
+/** Structured provider limit types that name a compact critical window. */
+const LIMIT_TYPE_ROLE = {
+    five_hour: "five_hour",
+    seven_day: "weekly",
+};
+/** A cap reset and a snapshot reset within this distance name the same boundary. */
+const RESET_MATCH_TOLERANCE_MS = 60_000;
+/** The compact role a stored window presents under, or null when it never renders compactly. */
+function compactRole(runtime, w) {
+    if (runtime === "cursor_local")
+        return w.windowKey === CURSOR_BILLING_WINDOW_KEY ? "billing_cycle" : null;
+    if (PAIR_RUNTIMES.has(runtime))
+        return w.criticalRole;
+    return null;
+}
+/**
+ * Which compact window an active cap exhausts: structured limit metadata
+ * first (a reported non-compact limit stays unmapped), then a tightly bounded
+ * match between the provider reset and exactly one tagged snapshot reset.
+ * A fallback-cooldown cap (no provider reset) is never matched.
+ */
+export function resolveCapWindowRole(runtime, cap, windows) {
+    if (cap.limitType !== null) {
+        const role = LIMIT_TYPE_ROLE[cap.limitType] ?? null;
+        return role !== null && PAIR_RUNTIMES.has(runtime) ? role : null;
+    }
+    if (cap.providerResetAt === null)
+        return null;
+    const capResetMs = Date.parse(cap.providerResetAt);
+    if (!Number.isFinite(capResetMs))
+        return null;
+    const matched = new Set();
+    for (const w of windows) {
+        const role = compactRole(runtime, w);
+        if (role === null || w.resetAt === null)
+            continue;
+        const resetMs = Date.parse(w.resetAt);
+        if (Number.isFinite(resetMs) && Math.abs(resetMs - capResetMs) <= RESET_MATCH_TOLERANCE_MS) {
+            matched.add(role);
+        }
+    }
+    return matched.size === 1 ? [...matched][0] : null;
+}
+function activeCapFor(runtime, windows, nowMs) {
+    const cap = activeRuntimeCap(runtime, nowMs);
+    if (cap === null)
+        return null;
+    return {
+        unavailableUntil: cap.unavailableUntil,
+        reason: cap.reason,
+        windowRole: resolveCapWindowRole(runtime, cap, windows),
+    };
+}
 /**
  * Read model for `GET /api/runtime-capacity`: every configured runtime, its
  * windows with freshness applied, and an explicit unavailable reason whenever
@@ -103,14 +162,15 @@ export function getRuntimeCapacitySnapshot(nowMs = Date.now()) {
     const entries = [...runtimes]
         .sort()
         .map((runtime) => {
-        const windows = (byRuntime.get(runtime) ?? []).map((w) => classifyWindow(w, nowMs).snapshot);
+        const raw = byRuntime.get(runtime) ?? [];
+        const windows = raw.map((w) => classifyWindow(w, nowMs).snapshot);
         const knownCount = windows.filter((w) => w.unavailableReason === null).length;
         let unavailableReason = null;
         if (knownCount === 0) {
             const first = windows.find((w) => w.unavailableReason)?.unavailableReason;
             unavailableReason = first ?? "missing";
         }
-        return { runtime, windows, unavailableReason };
+        return { runtime, windows, unavailableReason, activeCap: activeCapFor(runtime, raw, nowMs) };
     });
     return { runtimes: entries, generatedAt: new Date(nowMs).toISOString() };
 }

package/bundle/server/dist/capacity/service.test.js

@@ -219,3 +219,223 @@ test("a past reset time is never presented as current capacity", async () => {
     assert.equal(muse.windows[0].unavailableReason, "expired");
     assert.equal(muse.unavailableReason, "expired");
 });
+// NOT-440: active hard caps overlay the compact read model without rewriting
+// stored provider observations.
+const NOT440_NOW = Date.parse("2026-10-12T18:20:00.000Z");
+const NOT440_RESET = "2026-10-12T18:59:01.000Z";
+const NOT440_WEEKLY_RESET = "2026-10-16T02:00:00.000Z";
+async function seedPair(runtime, windows) {
+    const { recordCapacitySnapshots } = await import("../repository/runtime-capacity.js");
+    recordCapacitySnapshots(runtime, windows.map((w) => ({
+        windowKey: w.windowKey,
+        providerBucket: "all_models",
+        durationMinutes: w.durationMinutes ?? (w.criticalRole === "weekly" ? 10080 : 300),
+        displayLabel: w.criticalRole === "weekly" ? "1W" : "5H",
+        usedValue: 100 - w.remainingPercent,
+        usedUnit: "percent",
+        remainingPercent: w.remainingPercent,
+        resetAt: w.resetAt,
+        observedAt: "2026-10-12T18:03:00.000Z",
+        freshUntil: "2026-10-12T19:03:00.000Z",
+        expiresAt: "2026-10-12T19:03:00.000Z",
+        source: "observed_event",
+        unavailableReason: null,
+        criticalRole: w.criticalRole,
+    })));
+}
+async function seedReproducedMuse() {
+    await seedPair("muse_code", [
+        { windowKey: "five_hour", criticalRole: "five_hour", remainingPercent: 50, resetAt: NOT440_RESET },
+        { windowKey: "weekly", criticalRole: "weekly", remainingPercent: 52, resetAt: NOT440_WEEKLY_RESET },
+    ]);
+}
+function storedMuseRemaining() {
+    const rows = getDb()
+        .prepare("SELECT window_key, remaining_percent FROM runtime_capacity_snapshots WHERE runtime = 'muse_code'")
+        .all();
+    return Object.fromEntries(rows.map((r) => [r.window_key, r.remaining_percent]));
+}
+const { getDb } = await import("../db/index.js");
+const { clearAllRuntimeAvailability, recordRuntimeAvailability, runtimeAvailability } = await import("../repository/runtime-availability.js");
+const { recordMuseUsageCap } = await import("../runners/usage-cap.js");
+const { resolveCapWindowRole } = await import("./service.js");
+test("NOT-440: reproduced Muse cap maps to 5H without modifying stored snapshots", async () => {
+    clearAllCapacitySnapshots();
+    clearAllRuntimeAvailability();
+    await seedReproducedMuse();
+    assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+    recordMuseUsageCap({ kind: "usage_cap", message: `Subscription quota exhausted. Usage resets at 2026-10-12T18:59:01Z.` }, Date.parse("2026-10-12T18:16:00.000Z"));
+    const snap = getRuntimeCapacitySnapshot(NOT440_NOW);
+    const muse = snap.runtimes.find((r) => r.runtime === "muse_code");
+    assert.deepEqual(muse.activeCap, {
+        unavailableUntil: NOT440_RESET,
+        reason: muse.activeCap.reason,
+        windowRole: "five_hour",
+    });
+    assert.match(muse.activeCap.reason, /muse_code usage capped/);
+    // Windows remain the raw provider observation; the overlay is activeCap.
+    assert.equal(muse.windows.find((w) => w.criticalRole === "five_hour").remainingPercent, 50);
+    assert.equal(muse.windows.find((w) => w.criticalRole === "weekly").remainingPercent, 52);
+    assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+    // Admission/health read the same row.
+    assert.deepEqual(runtimeAvailability("muse_code", NOT440_NOW), {
+        available: false,
+        until: NOT440_RESET,
+        reason: muse.activeCap.reason,
+    });
+});
+test("NOT-440: overlay is absent at and after unavailableUntil; history is kept", async () => {
+    for (const offset of [0, 1]) {
+        clearAllCapacitySnapshots();
+        clearAllRuntimeAvailability();
+        await seedReproducedMuse();
+        recordMuseUsageCap({ kind: "usage_cap", message: `Subscription quota exhausted. Usage resets at 2026-10-12T18:59:01Z.` }, Date.parse("2026-10-12T18:16:00.000Z"));
+        const atMs = Date.parse(NOT440_RESET) + offset;
+        const snap = getRuntimeCapacitySnapshot(atMs);
+        const muse = snap.runtimes.find((r) => r.runtime === "muse_code");
+        assert.equal(muse.activeCap, null, `offset ${offset}ms`);
+        // Normal classification resumes: the 5H reset has passed, 1W is still current.
+        const fiveHour = muse.windows.find((w) => w.criticalRole === "five_hour");
+        assert.equal(fiveHour.remainingPercent, null);
+        assert.equal(fiveHour.unavailableReason, "expired");
+        assert.equal(muse.windows.find((w) => w.criticalRole === "weekly").remainingPercent, 52);
+        assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+        const capRows = getDb()
+            .prepare("SELECT COUNT(*) AS n FROM runtime_availability WHERE runtime = 'muse_code'")
+            .get();
+        assert.equal(capRows.n, 0, "lazy cleanup cleared the expired cap row");
+        assert.deepEqual(runtimeAvailability("muse_code", atMs), { available: true });
+    }
+});
+test("NOT-440: a cap with no provider reset or role stays unmapped (explicit capped)", async () => {
+    clearAllCapacitySnapshots();
+    clearAllRuntimeAvailability();
+    await seedReproducedMuse();
+    // Fallback cooldown that happens to land on the 5H reset is still not a provider boundary.
+    recordRuntimeAvailability({
+        runtime: "muse_code",
+        unavailableUntil: NOT440_RESET,
+        reason: "muse_code usage capped — usage cap",
+    });
+    const muse = getRuntimeCapacitySnapshot(NOT440_NOW).runtimes.find((r) => r.runtime === "muse_code");
+    assert.equal(muse.activeCap.windowRole, null);
+    assert.equal(muse.activeCap.unavailableUntil, NOT440_RESET);
+    assert.deepEqual(storedMuseRemaining(), { five_hour: 50, weekly: 52 });
+});
+const tagged = (windowKey, criticalRole, resetAt) => ({
+    windowKey,
+    providerBucket: "all_models",
+    durationMinutes: 300,
+    displayLabel: "5H",
+    usedValue: 50,
+    usedUnit: "percent",
+    remainingPercent: 50,
+    resetAt,
+    observedAt: "2026-10-12T18:03:00.000Z",
+    freshUntil: "2026-10-12T19:03:00.000Z",
+    expiresAt: "2026-10-12T19:03:00.000Z",
+    source: "observed_event",
+    unavailableReason: null,
+    criticalRole,
+});
+test("NOT-440: cap window role resolution per runtime (metadata first, then reset match)", () => {
+    const pair = [tagged("five_hour", "five_hour", NOT440_RESET), tagged("weekly", "weekly", NOT440_WEEKLY_RESET)];
+    const cases = [
+        {
+            name: "Claude five_hour metadata wins even without a reset match",
+            runtime: "claude_code",
+            cap: { providerResetAt: "2026-10-12T20:00:00.000Z", limitType: "five_hour" },
+            windows: pair,
+            expected: "five_hour",
+        },
+        {
+            name: "Claude seven_day metadata maps to weekly",
+            runtime: "claude_code",
+            cap: { providerResetAt: null, limitType: "seven_day" },
+            windows: pair,
+            expected: "weekly",
+        },
+        {
+            name: "Claude model-specific limit stays unmapped despite a matching weekly reset",
+            runtime: "claude_code",
+            cap: { providerResetAt: NOT440_WEEKLY_RESET, limitType: "seven_day_sonnet" },
+            windows: pair,
+            expected: null,
+        },
+        {
+            name: "Codex reset match on the weekly window",
+            runtime: "codex_local",
+            cap: { providerResetAt: NOT440_WEEKLY_RESET, limitType: null },
+            windows: pair,
+            expected: "weekly",
+        },
+        {
+            name: "Muse reset match on the 5H window (within tolerance)",
+            runtime: "muse_code",
+            cap: { providerResetAt: "2026-10-12T18:59:30.000Z", limitType: null },
+            windows: pair,
+            expected: "five_hour",
+        },
+        {
+            name: "Muse reset outside tolerance stays unmapped",
+            runtime: "muse_code",
+            cap: { providerResetAt: "2026-10-12T19:05:00.000Z", limitType: null },
+            windows: pair,
+            expected: null,
+        },
+        {
+            name: "Cursor reset match on the billing cycle",
+            runtime: "cursor_local",
+            cap: { providerResetAt: "2026-11-01T00:00:00.000Z", limitType: null },
+            windows: [tagged("billing_cycle", null, "2026-11-01T00:00:00.000Z")],
+            expected: "billing_cycle",
+        },
+        {
+            name: "Untagged diagnostic window with a matching reset never maps",
+            runtime: "muse_code",
+            cap: { providerResetAt: "2026-10-13T00:00:00.000Z", limitType: null },
+            windows: [...pair, tagged("muse_account_usage", null, "2026-10-13T00:00:00.000Z")],
+            expected: null,
+        },
+        {
+            name: "Fallback cooldown (no provider reset) never maps",
+            runtime: "codex_local",
+            cap: { providerResetAt: null, limitType: null },
+            windows: pair,
+            expected: null,
+        },
+        {
+            name: "Ambiguous reset matching both pair windows stays unmapped",
+            runtime: "codex_local",
+            cap: { providerResetAt: NOT440_RESET, limitType: null },
+            windows: [tagged("five_hour", "five_hour", NOT440_RESET), tagged("weekly", "weekly", NOT440_RESET)],
+            expected: null,
+        },
+    ];
+    for (const c of cases) {
+        assert.equal(resolveCapWindowRole(c.runtime, c.cap, c.windows), c.expected, c.name);
+    }
+});
+test("NOT-440: Claude structured rate_limit_event persists limit type and maps through the read model", async () => {
+    clearAllCapacitySnapshots();
+    clearAllRuntimeAvailability();
+    await seedPair("claude_code", [
+        { windowKey: "five_hour", criticalRole: "five_hour", remainingPercent: 40, resetAt: NOT440_RESET },
+        { windowKey: "weekly", criticalRole: "weekly", remainingPercent: 70, resetAt: NOT440_WEEKLY_RESET },
+    ]);
+    const { recordUsageCapFromEvents } = await import("../runners/usage-cap.js");
+    recordUsageCapFromEvents([
+        {
+            type: "rate_limit_event",
+            rate_limit_info: {
+                status: "rejected",
+                rateLimitType: "seven_day",
+                resetsAt: Math.floor(Date.parse(NOT440_WEEKLY_RESET) / 1000),
+            },
+        },
+    ], "claude_code", NOT440_NOW);
+    const claude = getRuntimeCapacitySnapshot(NOT440_NOW).runtimes.find((r) => r.runtime === "claude_code");
+    assert.equal(claude.activeCap.windowRole, "weekly");
+    assert.equal(claude.activeCap.unavailableUntil, NOT440_WEEKLY_RESET);
+    clearAllRuntimeAvailability();
+});