jules-orchestrator-kit 0.33.0 → 0.34.0

package/README.md

@@ -120,7 +120,7 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 * **🚀 Zero-Test Bootstrapping (`agentctl bootstrap`):** Synthesizes deterministic syntax-check and smoke-test verification oracles for untested legacy repositories so agents always operate against a falsifiable feedback loop.
 
-* **📈 Proven Scale & Reliability:** Empirically tested with **498 unit tests across 75 suites passing in < 10.0s**. An adversarial red-team suite (`test/adversarial-claims.test.mjs`) continuously attempts to falsify the safety guarantees documented above — including cross-platform probes for the case-insensitive filesystems on macOS and Windows — and a documentation-sync gate (`scripts/doc-sync-check.mjs`) blocks any release whose docs have drifted from the code.
+* **📈 Proven Scale & Reliability:** Empirically tested with **510 unit tests across 77 suites passing in < 10.0s**. An adversarial red-team suite (`test/adversarial-claims.test.mjs`) continuously attempts to falsify the safety guarantees documented above — including cross-platform probes for the case-insensitive filesystems on macOS and Windows — and a documentation-sync gate (`scripts/doc-sync-check.mjs`) blocks any release whose docs have drifted from the code.
 
 <br/>
 
@@ -297,9 +297,9 @@ scope:
 limits:
   diffKb: 75             # 75 KB Diff Payload Governor limit
   promptKb: 50           # Maximum prompt payload size
-  dailyTasks: 300        # Daily task session quota limit
+  dailyTasks: 300        # Task quota per rolling 24h window (not per calendar day)
   repairAttempts: 3      # Maximum OODA repair iterations
-  concurrency: 1         # Worker slot concurrency limit
+  concurrency: 15        # Worker slots; the ultra plan allows up to 60
 
 # Dynamic Complexity & Cost Router — opt-in, disabled by default.
 # Provider-agnostic: "fast"/"complex" accept any provider key ("jules" |

package/bin/agentctl.mjs

@@ -9,7 +9,7 @@ import { acquireLock, releaseLock, lockStatus, getQueueDir } from "../src/state.
 import { worktreePrune } from "../src/git.mjs";
 import { reapOrphanedIntents, reapStaleMutexDirs } from "../src/journal.mjs";
 import { KIT_VERSION } from "../src/version.mjs";
-import { budgetStatus, listOpenReservations, releaseOpenReservations } from "../src/budget.mjs";
+import { budgetStatus, listOpenReservations, releaseOpenReservations, resolveConcurrency } from "../src/budget.mjs";
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -21,11 +21,14 @@ export const VERSION = KIT_VERSION;
  * counter. The ledger counts what *this checkout* dispatched; sessions started
  * from the web UI or another machine spend the same quota unseen, so a bare
  * "N / M used" invites the reader to trust a figure that cannot be complete.
+ * "last 24h", not "today": the provider's allowance resets on a rolling
+ * window, so a figure labelled by the calendar day would be a different number
+ * from the one being enforced.
  * @param {{ used: number, limit: number, source: string, certain: boolean }} b
  */
 export function formatBudgetLine(b) {
-  const scope = `${b.used} / ${b.limit} used (this repo)`;
-  if (b.source === "learned") return `${scope} — provider refused further work today`;
+  const scope = `${b.used} / ${b.limit} used in the last 24h (this repo)`;
+  if (b.source === "learned") return `${scope} — provider refused further work`;
   if (b.certain) return `${scope} — limit from ${b.source === "env" ? "JULES_DAILY_BUDGET" : "config"}`;
   return `${scope} — limit estimated from tier "${b.tier || "?"}", not enforced`;
 }
@@ -57,7 +60,7 @@ Commands:
   rollback              Restore git state & working tree to atomic pre-flight checkpoint
   resume                Resume warm session with human response (--response "<text>")
   status                Display queue and system status summary
-  budget                Show today's task budget and its provenance (reset --yes to reconcile)
+  budget                Show the 24h task budget, worker slots and their provenance (reset --yes)
   scan                  Scan codebase for TODO/FIXME task candidates
   hydrate [prompt]      Prepend active system learnings and baton-pass state to a prompt
   harvest               Harvest failure traces and record/quarantine resolution rules
@@ -333,7 +336,7 @@ async function main() {
         const confirmed = args.includes("--yes") || args.includes("-y");
         if (!dryRun && !confirmed) {
           const open = listOpenReservations(root);
-          console.log(`Would release ${open.length} open reservation(s) from today's ledger.`);
+          console.log(`Would release ${open.length} open reservation(s) from the last 24 hours.`);
           console.log("This rewrites nothing — it appends `budget_released` entries.");
           console.log("Re-run with --yes to confirm, or --dry-run for detail.");
           process.exit(0);
@@ -353,9 +356,15 @@ async function main() {
         process.exit(0);
       }
 
-      console.log(`Daily Budget : ${formatBudgetLine(b)}`);
+      const slots = resolveConcurrency(config);
+      console.log(`Task Budget  : ${formatBudgetLine(b)}`);
       console.log(`  ${b.note}`);
-      console.log(`  Open reservations today: ${listOpenReservations(root).length}`);
+      console.log(`  Window opened at ${b.windowStart} — the quota resets ${b.windowHours}h after each task,`);
+      console.log("  not at midnight, so this count spans yesterday's ledger too.");
+      console.log(`  Open reservations in the window: ${listOpenReservations(root).length}`);
+      console.log("");
+      console.log(`Worker Slots : ${slots.concurrency} concurrent`);
+      console.log(`  ${slots.note}`);
       console.log("");
       console.log("The ledger counts this checkout only — sessions started from the Jules");
       console.log("web UI or another machine spend the same quota without appearing here.");

package/index.mjs

@@ -49,6 +49,9 @@ export {
   rollbackBudgetReservation,
   withBudget,
   checkDailyBudget,
+  scanBudgetWindow,
+  getLedgerPathsInWindow,
+  ROLLING_WINDOW_MS,
   acquireLock,
   releaseLock,
   lockStatus,
@@ -140,6 +143,7 @@ export {
   isDailyQuotaRejection,
   listOpenReservations,
   releaseOpenReservations,
+  resolveConcurrency,
   CEILING_FILE,
 } from "./src/budget.mjs";
 export { KIT_VERSION } from "./src/version.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Orchestration kit for running Google Jules autonomous agents.",
   "repository": {
     "type": "git",

package/src/budget.mjs

@@ -1,25 +1,32 @@
 import { existsSync, readFileSync, writeFileSync, openSync, fsyncSync, closeSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { resolveRoot } from "./config.mjs";
-import { getStateDir, getDailyLedgerPath, ensureDir, appendLedger, checkDailyBudget } from "./state.mjs";
+import {
+  getStateDir,
+  ensureDir,
+  appendLedger,
+  checkDailyBudget,
+  scanBudgetWindow,
+  ROLLING_WINDOW_MS,
+} from "./state.mjs";
 
 /**
  * Where the observed quota ceiling lives, outside the ledger so it survives
  * rotation.
  *
- * Deliberately scoped to the day it was observed. The local ledger only counts
- * tasks dispatched from *this* checkout, while the account's quota is also
- * spent from the web UI and other machines, so the local count at the moment of
- * a refusal is a lower bound on the real allowance — not the allowance. Treated
- * as permanent it would hard-block the operator below their own quota, which is
- * the exact failure this whole mechanism exists to prevent.
+ * Deliberately short-lived. The local ledger only counts tasks dispatched from
+ * *this* checkout, while the account's quota is also spent from the web UI and
+ * other machines, so the local count at the moment of a refusal is a lower
+ * bound on the real allowance — not the allowance. Treated as permanent it
+ * would hard-block the operator below their own quota, which is the exact
+ * failure this whole mechanism exists to prevent.
  *
- * What it does mean is precise and useful: *today* the provider has started
- * refusing, so stop asking until tomorrow.
+ * What it does mean is precise and useful: within the last 24 hours the
+ * provider started refusing, so stop asking until that refusal ages out.
  */
 export const CEILING_FILE = "budget-ceiling.json";
 
-/** Local calendar day, matching the ledger's own rotation key. */
+/** Local calendar day, retained as the fallback key for pre-0.34 records. */
 function today() {
   return new Date().toISOString().split("T")[0];
 }
@@ -67,10 +74,17 @@ function writeAtomic(filePath, content) {
 
 /**
  * Read the stored ceiling, whenever it was observed.
+ *
+ * A refusal expires 24 hours after it happened, matching the window the quota
+ * itself resets on. Expiring it at midnight instead — as this did before —
+ * either freed the operator hours before the provider would, or kept them
+ * blocked hours after it already had.
+ *
  * @param {string} [root]
- * @returns {{ ceiling: number, day: string, observedAt: string, source: string, stale: boolean } | null}
+ * @param {number} [now] - Epoch ms; injectable for tests.
+ * @returns {{ ceiling: number, day: string, observedAt: string, source: string, stale: boolean, expiresAt: string, msRemaining: number } | null}
  */
-export function readObservedCeiling(root = resolveRoot()) {
+export function readObservedCeiling(root = resolveRoot(), now = Date.now()) {
   const filePath = join(getStateDir(root), CEILING_FILE);
   if (!existsSync(filePath)) return null;
   try {
@@ -78,12 +92,24 @@ export function readObservedCeiling(root = resolveRoot()) {
     if (!parsed || typeof parsed.ceiling !== "number" || !Number.isFinite(parsed.ceiling)) return null;
     if (parsed.ceiling < 0) return null;
     const day = typeof parsed.day === "string" ? parsed.day : String(parsed.observedAt || "").slice(0, 10);
+    const observedAt = typeof parsed.observedAt === "string" ? parsed.observedAt : "";
+
+    // Records written before 0.34.0 carry only a day. Falling back to the old
+    // calendar comparison keeps them honest rather than reviving a ceiling
+    // whose age cannot be established.
+    const observedMs = Date.parse(observedAt);
+    const dated = Number.isFinite(observedMs);
+    const age = dated ? now - observedMs : Number.POSITIVE_INFINITY;
+    const stale = dated ? age >= ROLLING_WINDOW_MS : day !== today();
+
     return {
       ceiling: Math.floor(parsed.ceiling),
       day,
-      observedAt: typeof parsed.observedAt === "string" ? parsed.observedAt : "",
+      observedAt,
       source: typeof parsed.source === "string" ? parsed.source : "provider-rejection",
-      stale: day !== today(),
+      stale,
+      expiresAt: dated ? new Date(observedMs + ROLLING_WINDOW_MS).toISOString() : "",
+      msRemaining: dated ? Math.max(0, ROLLING_WINDOW_MS - age) : 0,
     };
   } catch (_) {
     return null;
@@ -94,14 +120,14 @@ export function readObservedCeiling(root = resolveRoot()) {
  * The ceiling only if it still applies — i.e. observed today.
  * @param {string} [root]
  */
-export function readActiveCeiling(root = resolveRoot()) {
-  const rec = readObservedCeiling(root);
+export function readActiveCeiling(root = resolveRoot(), now = Date.now()) {
+  const rec = readObservedCeiling(root, now);
   return rec && !rec.stale ? rec : null;
 }
 
 /**
  * Record that the provider refused further work after `usedAtRejection` tasks
- * were dispatched locally today.
+ * were dispatched locally inside the current window.
  *
  * Zero is a legitimate value: it means the quota was already spent elsewhere
  * (the web UI, another machine) before this checkout dispatched anything.
@@ -166,16 +192,17 @@ export function resolveDailyLimit(config, root = resolveRoot()) {
     };
   }
 
-  // Only today's observation may enforce. Yesterday's refusal says nothing
-  // about today's remaining quota, and carrying it forward would keep the
-  // operator locked out after the quota reset.
+  // Only a refusal from the last 24 hours may enforce. An older one says
+  // nothing about the remaining quota, and carrying it forward would keep the
+  // operator locked out after the window had already reset.
   const learned = readActiveCeiling(root);
   if (learned) {
+    const hours = Math.max(1, Math.round(learned.msRemaining / 3600000));
     return {
       limit: learned.ceiling,
       source: "learned",
       certain: true,
-      note: `the provider refused further work today after ${learned.ceiling} local task(s); resets tomorrow`,
+      note: `the provider refused further work after ${learned.ceiling} local task(s); that refusal ages out in ~${hours}h`,
     };
   }
 
@@ -189,71 +216,61 @@ export function resolveDailyLimit(config, root = resolveRoot()) {
 }
 
 /**
- * List reservations that today's ledger still counts as spent.
+ * Resolve how many workers may run at once, and against what ceiling.
+ *
+ * The same provenance rule as {@link resolveDailyLimit}: a figure the operator
+ * stated is authoritative, a tier preset is a default. The difference is that
+ * exceeding this one is not the kit's call to refuse — the provider enforces
+ * its own slot limit, and an operator pooling several accounts legitimately
+ * runs past any single plan's ceiling. So an overrun is reported, never
+ * blocked.
+ *
+ * @param {object} config - A config from loadConfig().
+ * @returns {{ concurrency: number, ceiling: number, source: "config"|"tier", overCeiling: boolean, note: string }}
+ */
+export function resolveConcurrency(config) {
+  const concurrency = Math.max(1, Math.floor(Number(config?.limits?.concurrency) || 1));
+  const ceiling = Math.floor(Number(config?.limits?.maxConcurrency) || 0);
+  const source = config?.provenance?.concurrency === "config" ? "config" : "tier";
+  const overCeiling = ceiling > 0 && concurrency > ceiling;
+  const tier = config?.tier || "unknown";
+
+  let note;
+  if (overCeiling) {
+    note = `${concurrency} workers exceeds what the "${tier}" plan allows (${ceiling}); sessions past the ${ceiling}th will be refused unless the account pools several plans`;
+  } else if (source === "config") {
+    note = ceiling > 0 ? `set in .agent/config.yml (plan allows up to ${ceiling})` : "set in .agent/config.yml";
+  } else {
+    note = ceiling > 0
+      ? `tier default for "${tier}" — the plan allows up to ${ceiling}, held back to leave slots for sessions this ledger cannot see`
+      : `tier default for "${tier}"`;
+  }
+  return { concurrency, ceiling, source, overCeiling, note };
+}
+
+/**
+ * List reservations the rolling 24-hour window still counts as spent.
  *
  * A reservation is open until a `budget_rolled_back` or `budget_released` entry
  * names it. `budget_committed` deliberately does not close one — a committed
  * dispatch really did consume quota — so the open set is "everything reserved
- * today that was not given back".
+ * inside the window that was not given back".
  *
- * Anonymous reservations (no `reservationId`, as older kit versions and
- * scripts/utils.mjs wrote them) are counted too, as records with
- * `reservationId: null`. They must be, or a reconcile would silently leave them
- * charged against the day: `checkDailyBudget` counts them, and with no id there
- * is nothing a targeted release could name. They are matched by count, the same
- * way the counter itself treats them.
+ * Anonymous reservations (no `reservationId`, as older kit versions wrote them)
+ * appear as records with `reservationId: null`. They must, or a reconcile would
+ * silently leave them charged: the counter counts them, and with no id there is
+ * nothing a targeted release could name.
  *
  * @param {string} [root]
+ * @param {object} [opts] - Forwarded to scanBudgetWindow (`now`, `windowMs`).
  * @returns {{ reservationId: string|null, timestamp: string, committed: boolean }[]}
  */
-export function listOpenReservations(root = resolveRoot()) {
-  const filePath = getDailyLedgerPath(root);
-  if (!existsSync(filePath)) return [];
-
-  /** @type {Map<string, { reservationId: string, timestamp: string, committed: boolean }>} */
-  const open = new Map();
-  /** @type {{ reservationId: null, timestamp: string, committed: boolean }[]} */
-  const anonymous = [];
-  let raw = "";
-  try {
-    raw = readFileSync(filePath, "utf-8");
-  } catch (_) {
-    return [];
-  }
-
-  for (const line of raw.split("\n").filter(Boolean)) {
-    let entry;
-    try {
-      entry = JSON.parse(line);
-    } catch (_) {
-      continue;
-    }
-    if (!entry || !entry.event) continue;
-
-    if (entry.event === "budget_reserved") {
-      if (entry.reservationId) {
-        open.set(entry.reservationId, {
-          reservationId: entry.reservationId,
-          timestamp: entry.timestamp || "",
-          committed: false,
-        });
-      } else {
-        anonymous.push({ reservationId: null, timestamp: entry.timestamp || "", committed: false });
-      }
-    } else if (entry.event === "budget_committed") {
-      const rec = entry.reservationId ? open.get(entry.reservationId) : null;
-      if (rec) rec.committed = true;
-    } else if (entry.event === "budget_rolled_back" || entry.event === "budget_released") {
-      if (entry.reservationId) open.delete(entry.reservationId);
-      else anonymous.pop();
-    }
-  }
-
-  return [...open.values(), ...anonymous];
+export function listOpenReservations(root = resolveRoot(), opts = {}) {
+  return scanBudgetWindow(root, opts).open;
 }
 
 /**
- * Give today's open reservations back, by appending `budget_released` entries.
+ * Give the window's open reservations back, by appending `budget_released` entries.
  *
  * The ledger is append-only and hash-chained, so a miscounted day is corrected
  * forwards — never by editing or deleting the file, which would break the chain
@@ -286,10 +303,16 @@ export function releaseOpenReservations(opts = {}) {
 
   for (const rec of openRecords) {
     const entry = { event: "budget_released", reason: opts.reason || "operator-reconcile" };
-    // An anonymous reservation is released by an equally anonymous entry: the
-    // counter decrements those by count, so naming an id here would leave the
-    // original charged and subtract from someone else's total instead.
-    if (rec.reservationId) entry.reservationId = rec.reservationId;
+    if (rec.reservationId) {
+      entry.reservationId = rec.reservationId;
+    } else {
+      // An anonymous reservation is released by an equally anonymous entry —
+      // naming an id here would leave the original charged and subtract from
+      // someone else's total instead. The timestamp pins which one it cancels,
+      // so the pair does not drift apart as the rolling window advances past
+      // the reservation but not yet past its release.
+      entry.releasedTimestamp = rec.timestamp;
+    }
     appendLedger(entry, root);
   }
   return result;
@@ -311,6 +334,10 @@ export function budgetStatus(config, root = resolveRoot()) {
     source: resolved.source,
     certain: resolved.certain,
     note: resolved.note,
+    // The count is a rolling 24h window, not a calendar day — surfaced so a
+    // caller reporting "used today" cannot quietly mean something else.
+    windowStart: check.windowStart || "",
+    windowHours: ROLLING_WINDOW_MS / 3600000,
     // Only a limit we actually know may stop a dispatch.
     enforced: resolved.certain,
     exhausted: check.used >= resolved.limit,

package/src/config.mjs

@@ -281,35 +281,63 @@ export function resolveVerify(root = process.cwd(), userVerify = {}) {
  * guess — see `isTierGuess()` and the learned-ceiling logic in src/state.mjs.
  * An explicit `limits.daily_tasks` in .agent/config.yml always wins.
  */
+/**
+ * Per-tier defaults, with the vendor's own ceiling recorded alongside them.
+ *
+ * `maxConcurrency` is what the plan allows; `concurrency` is what the kit will
+ * start by using. They differ on purpose, for the same reason the daily count
+ * is a lower bound: this ledger sees one checkout, while the account's slots
+ * are also taken by the web UI, the CLI and other machines. A default sitting
+ * on the ceiling would collide with every session the kit cannot see.
+ *
+ * The defaults used to sit at 1/2/3 against ceilings of 3/15/60 — a Pro
+ * account running two workers where it could run fifteen. Raising them is the
+ * single largest throughput change available; leaving headroom is what keeps
+ * it from being reckless. An operator who knows their account is theirs alone
+ * can state `limits.concurrency` up to the ceiling.
+ *
+ * Ceilings verified against the vendor's published limits page
+ * (jules.google/docs/usage-limits, 2026-08-20). They are a vendor number and
+ * may change without notice. The URL is written without a scheme on purpose:
+ * test/egress-allowlist.test.mjs treats every host literal in shipped source
+ * as a destination this kit might contact, and a citation is not one.
+ */
 export const TIER_PRESETS = {
   free: {
     dailyTasks: 15,
     repairAttempts: 1,
-    concurrency: 1,
+    // The whole allowance is 15 tasks a day; there is no headroom worth
+    // reserving, so the default is the ceiling.
+    concurrency: 3,
+    maxConcurrency: 3,
     staggerMs: 3000,
     diffKb: 50,
   },
   pro: {
     dailyTasks: 100,
     repairAttempts: 2,
-    concurrency: 2,
+    concurrency: 8,
+    maxConcurrency: 15,
     staggerMs: 1500,
     diffKb: 75,
   },
   ultra: {
     dailyTasks: 300,
     repairAttempts: 3,
-    concurrency: 3,
+    concurrency: 15,
+    maxConcurrency: 60,
     staggerMs: 1000,
     diffKb: 75,
   },
   // Not a vendor plan: a self-hosted/pooled profile for operators who front
   // several accounts. Defined here so `tier: enterprise` resolves to what the
-  // wizard writes instead of silently collapsing onto the ultra preset.
+  // wizard writes instead of silently collapsing onto the ultra preset. Its
+  // ceiling is whatever the pool adds up to, so the kit does not claim one.
   enterprise: {
     dailyTasks: 1000,
     repairAttempts: 3,
     concurrency: 10,
+    maxConcurrency: 0,
     staggerMs: 500,
     diffKb: 100,
   },
@@ -420,6 +448,7 @@ export function loadConfig(root = resolveRoot(), explicitPath = null) {
           : normalizedLimits.dailyTasks !== undefined
             ? "config"
             : "tier",
+      concurrency: normalizedLimits.concurrency !== undefined ? "config" : "tier",
     },
     isolation: parsed.isolation || DEFAULTS.isolation,
     runner: parsed.runner || DEFAULTS.runner,

package/src/ops/doctor-registry.mjs

@@ -2,6 +2,8 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { execFileSync, spawnSync } from "node:child_process";
+import { loadConfig } from "../config.mjs";
+import { resolveConcurrency } from "../budget.mjs";
 
 /**
  * @typedef {"pass" | "warn" | "fail" | "skip" | "unknown"} DiagnosticStatus
@@ -261,6 +263,41 @@ export async function runDoctorChecks(options = {}) {
     });
   }
 
+  // 3b. Worker slots against the plan's ceiling.
+  //
+  // A warning, never a failure: the kit cannot see the account, only the
+  // config. Pooled accounts legitimately exceed a single plan's ceiling, and
+  // the provider refuses what it will not allow regardless of what we think.
+  try {
+    const cfg = loadConfig(root);
+    const slots = resolveConcurrency(cfg);
+    addResult({
+      id: "limits.concurrency",
+      category: "Config",
+      title: "Worker Slots vs Plan Ceiling",
+      status: slots.overCeiling ? "warn" : "pass",
+      severity: slots.overCeiling ? "medium" : "info",
+      summary: `${slots.concurrency} concurrent worker(s) — ${slots.note}`,
+      evidence: [
+        { label: "concurrency", value: slots.concurrency, sensitive: false },
+        { label: "planCeiling", value: slots.ceiling, sensitive: false },
+        { label: "source", value: slots.source, sensitive: false },
+      ],
+      remediation: slots.overCeiling
+        ? [
+            {
+              summary: `Set limits.concurrency to ${slots.ceiling} or lower in .agent/config.yml, unless this account pools several plans`,
+              risk: "low",
+              automatic: false,
+              requiresProbe: false,
+            },
+          ]
+        : [],
+    });
+  } catch (_) {
+    // A config the loader rejects is already reported by config.present.
+  }
+
   // 4. Verification Oracle Checks
   const pkgPath = join(root, "package.json");
   if (existsSync(pkgPath)) {

package/src/state.mjs

@@ -55,6 +55,129 @@ export function getDailyLedgerPath(rootOrOpts = resolveRoot()) {
   return join(getStateDir(root), `ledger-${dateStr}.jsonl`);
 }
 
+/**
+ * How far back a task still counts against the allowance.
+ *
+ * The provider's daily quota resets on a rolling 24-hour window, not at
+ * midnight. Counting per calendar day — which the ledger's `ledger-<date>`
+ * rotation invites — is wrong in both directions: a batch dispatched at 23:00
+ * stops being counted at 00:01 while the provider still refuses on it, and
+ * yesterday's last hours vanish from a count that should still include them.
+ *
+ * The files stay day-scoped, because rotation is a storage concern. Counting
+ * is not: it spans whatever files the window touches and filters on entry
+ * timestamps.
+ */
+export const ROLLING_WINDOW_MS = 24 * 60 * 60 * 1000;
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Ledger files that can hold entries inside the rolling window, oldest first.
+ *
+ * One day wider than the window itself: an entry timestamped 23:59 UTC sits in
+ * that day's file, and a window opening moments later still has to see it.
+ *
+ * @param {string} [root]
+ * @param {number} [now] - Epoch ms; injectable so tests need not wait a day.
+ * @param {number} [windowMs]
+ * @returns {string[]}
+ */
+export function getLedgerPathsInWindow(root = resolveRoot(), now = Date.now(), windowMs = ROLLING_WINDOW_MS) {
+  const stateDir = getStateDir(root);
+  const spanDays = Math.ceil(windowMs / DAY_MS) + 1;
+  const paths = [];
+  for (let i = spanDays - 1; i >= 0; i--) {
+    const dateStr = new Date(now - i * DAY_MS).toISOString().split("T")[0];
+    const filePath = join(stateDir, `ledger-${dateStr}.jsonl`);
+    if (!paths.includes(filePath) && existsSync(filePath)) paths.push(filePath);
+  }
+  return paths;
+}
+
+/**
+ * Replay the budget events in the rolling window and report what is still spent.
+ *
+ * Reservations carrying a `reservationId` are matched by name. Legacy id-less
+ * ones — written by older kit versions — can only be matched by position, so a
+ * release without a `releasedTimestamp` consumes the oldest still-open
+ * anonymous reservation. `releaseOpenReservations` records that timestamp
+ * precisely so the pairing survives the window boundary: without it, an
+ * anonymous release could outlive the reservation it cancelled and start
+ * subtracting from a later one instead.
+ *
+ * Entries whose timestamp will not parse are counted. A budget event the kit
+ * cannot place in time is safer treated as spent than as free.
+ *
+ * @param {string} [root]
+ * @param {object} [opts]
+ * @param {number} [opts.now]
+ * @param {number} [opts.windowMs]
+ * @returns {{ used: number, open: { reservationId: string|null, timestamp: string, committed: boolean }[], windowStart: string }}
+ */
+export function scanBudgetWindow(root = resolveRoot(), opts = {}) {
+  const now = Number.isFinite(opts.now) ? opts.now : Date.now();
+  const windowMs = Number.isFinite(opts.windowMs) ? opts.windowMs : ROLLING_WINDOW_MS;
+  const cutoff = now - windowMs;
+
+  /** @type {Map<string, { reservationId: string, timestamp: string, committed: boolean, inWindow: boolean }>} */
+  const byId = new Map();
+  /** @type {{ reservationId: null, timestamp: string, committed: boolean, inWindow: boolean }[]} */
+  const anonymous = [];
+
+  const inWindow = (timestamp) => {
+    const ts = Date.parse(timestamp || "");
+    return Number.isFinite(ts) ? ts >= cutoff : true;
+  };
+
+  for (const filePath of getLedgerPathsInWindow(root, now, windowMs)) {
+    let raw = "";
+    try {
+      raw = readFileSync(filePath, "utf-8");
+    } catch (_) {
+      continue;
+    }
+    for (const line of raw.split("\n")) {
+      if (!line) continue;
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch (_) {
+        continue;
+      }
+      if (!entry || !entry.event) continue;
+      const timestamp = entry.timestamp || "";
+
+      if (entry.event === "budget_reserved") {
+        const record = { timestamp, committed: false, inWindow: inWindow(timestamp) };
+        if (entry.reservationId) byId.set(entry.reservationId, { reservationId: entry.reservationId, ...record });
+        else anonymous.push({ reservationId: null, ...record });
+      } else if (entry.event === "budget_committed") {
+        // A commit does not free the slot — the task really ran — it only marks
+        // the reservation as having reached the provider.
+        const record = entry.reservationId ? byId.get(entry.reservationId) : null;
+        if (record) record.committed = true;
+      } else if (entry.event === "budget_rolled_back" || entry.event === "budget_released") {
+        if (entry.reservationId) {
+          byId.delete(entry.reservationId);
+        } else if (entry.releasedTimestamp) {
+          const idx = anonymous.findIndex((r) => r.timestamp === entry.releasedTimestamp);
+          if (idx !== -1) anonymous.splice(idx, 1);
+        } else {
+          anonymous.shift();
+        }
+      }
+    }
+  }
+
+  const open = [...byId.values(), ...anonymous].filter((r) => r.inWindow);
+  return {
+    used: open.length,
+    open: open.map(({ reservationId, timestamp, committed }) => ({ reservationId, timestamp, committed })),
+    windowStart: new Date(cutoff).toISOString(),
+  };
+}
+
 export class MutexTimeoutError extends Error {
   constructor(message = "Failed to acquire VFS mutex lock within timeout") {
     super(message);
@@ -187,43 +310,24 @@ export function readLedger(filePath) {
   }
 }
 
-export function checkDailyBudget(arg1 = resolveRoot(), arg2 = 300) {
+/**
+ * Tasks still counted against the allowance, over the rolling 24-hour window.
+ *
+ * The name is kept for compatibility; "daily" here means the provider's day,
+ * which is the last 24 hours rather than the calendar one.
+ */
+export function checkDailyBudget(arg1 = resolveRoot(), arg2 = 300, opts = {}) {
   let root = typeof arg1 === "string" ? arg1 : resolveRoot();
   let limit = typeof arg1 === "number" ? arg1 : typeof arg2 === "number" ? arg2 : 300;
 
-  const filePath = getDailyLedgerPath(root);
-  if (!existsSync(filePath)) {
-    return { ok: true, used: 0, budget: limit, remaining: limit };
-  }
   try {
-    const content = readFileSync(filePath, "utf-8");
-    const lines = content.split("\n").filter(Boolean);
-    let count = 0;
-    const activeIds = new Set();
-    for (const line of lines) {
-      try {
-        const entry = JSON.parse(line);
-        if (entry && entry.event === "budget_reserved") {
-          if (entry.reservationId) {
-            activeIds.add(entry.reservationId);
-          } else {
-            count++;
-          }
-        } else if (entry && (entry.event === "budget_rolled_back" || entry.event === "budget_released")) {
-          if (entry.reservationId) {
-            activeIds.delete(entry.reservationId);
-          } else {
-            count = Math.max(0, count - 1);
-          }
-        }
-      } catch (_) {}
-    }
-    const used = count + activeIds.size;
+    const scan = scanBudgetWindow(root, opts);
     return {
-      ok: used < limit,
-      used,
+      ok: scan.used < limit,
+      used: scan.used,
       budget: limit,
-      remaining: Math.max(0, limit - used),
+      remaining: Math.max(0, limit - scan.used),
+      windowStart: scan.windowStart,
     };
   } catch (_) {
     return { ok: true, used: 0, budget: limit, remaining: limit };
@@ -244,42 +348,32 @@ export function reserveBudgetAtomic(stateDirOrRoot = resolveRoot(), limit = 300,
   const mutexDir = join(stateDir, ".budget.mutex");
 
   return withVfsMutex(mutexDir, () => {
-    const dateStr = new Date().toISOString().split("T")[0];
+    const now = Number.isFinite(opts.now) ? opts.now : Date.now();
+    const dateStr = new Date(now).toISOString().split("T")[0];
     const filePath = join(stateDir, `ledger-${dateStr}.jsonl`);
 
-    let count = 0;
-    const activeIds = new Set();
+    // The count spans the rolling window; the hash chain does not. A chain is
+    // per file, so the new entry links to today's last hash even when the
+    // reservations it is counted against were written yesterday.
+    const used = scanBudgetWindow(root, { ...opts, now }).used;
     let prevHash = "0".repeat(64);
 
     if (existsSync(filePath)) {
       try {
         const raw = readFileSync(filePath, "utf-8");
         const lines = raw.split("\n").filter(Boolean);
-        for (const line of lines) {
+        for (let i = lines.length - 1; i >= 0; i--) {
           try {
-            const entry = JSON.parse(line);
-            if (entry && entry.event === "budget_reserved") {
-              if (entry.reservationId) {
-                activeIds.add(entry.reservationId);
-              } else {
-                count++;
-              }
-            } else if (entry && (entry.event === "budget_rolled_back" || entry.event === "budget_released")) {
-              if (entry.reservationId) {
-                activeIds.delete(entry.reservationId);
-              } else {
-                count = Math.max(0, count - 1);
-              }
-            }
+            const entry = JSON.parse(lines[i]);
             if (entry && entry.hash) {
               prevHash = entry.hash;
+              break;
             }
           } catch (_) {}
         }
       } catch (_) {}
     }
 
-    const used = count + activeIds.size;
     // `enforce: false` marks a limit the kit only guessed (a tier preset rather
     // than a stated or provider-demonstrated figure). Blocking on a guess would
     // refuse work the provider would happily have accepted, so an uncertain
@@ -289,8 +383,8 @@ export function reserveBudgetAtomic(stateDirOrRoot = resolveRoot(), limit = 300,
       throw new BudgetError(`Daily budget exhausted (${used}/${limit} tasks executed)`);
     }
 
-    const timestamp = new Date().toISOString();
-    const reservationId = `res-${Date.now()}-${Math.random().toString(36).substring(2, 8)}`;
+    const timestamp = new Date(now).toISOString();
+    const reservationId = `res-${now}-${Math.random().toString(36).substring(2, 8)}`;
     const rawPayload = { timestamp, event: "budget_reserved", reservationId, budget: limit, prevHash };
     const hash = createHash("sha256").update(JSON.stringify(rawPayload)).digest("hex");
     const payload = { ...rawPayload, hash };

package/src/wizard-init.mjs

@@ -60,10 +60,15 @@ export function tierOptions() {
   return order.map((name) => {
     const p = TIER_PRESETS[name];
     const worker = p.concurrency === 1 ? "worker" : "workers";
+    // The ceiling is shown next to the default so the number the wizard writes
+    // reads as a starting point rather than as the plan's limit.
+    const slots = p.maxConcurrency > p.concurrency
+      ? `${p.concurrency} ${worker} (plan allows ${p.maxConcurrency})`
+      : `${p.concurrency} ${worker}`;
     return {
       label: TIER_LABELS[name] || name,
       value: name,
-      description: `${p.concurrency} ${worker}, ~${p.dailyTasks} daily tasks, ${p.diffKb} KB diff limit`,
+      description: `${slots}, ~${p.dailyTasks} daily tasks, ${p.diffKb} KB diff limit`,
     };
   });
 }