serial nice19; private HOME/XDG_CONFIG_HOME/TMPDIR/MOSAIC_CONFIG; unchanged whole-file budgets
limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"bc8872d6-c10d-4cbc-963c-dd87cf9163e5","source":"@none","code":"baseline-unknown"}
limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max","run":"run1"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"3e17a52f-1444-4d91-a204-87e39766f9c6","source":"@none","code":"baseline-unknown"}
✔ REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it (170.726529ms)
✔ REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota (145.594621ms)
✔ REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it (126.673361ms)
✔ REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none (67.580463ms)
✔ REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers (1.298781ms)
✔ REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names (0.222463ms)
✔ REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced (47.459097ms)
✔ REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count (46.035967ms)
✔ REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through (45.718506ms)
✔ REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time (57.755296ms)
✔ REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code (45.052811ms)
✔ REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer (51.313528ms)
✔ REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded (46.094531ms)
✔ REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check (48.189649ms)
✔ REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report (44.413841ms)
✔ REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws (46.465199ms)
✔ REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report (0.636118ms)
✔ REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set (87.250164ms)
✔ REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name (52.454059ms)
✔ REQ-LIMIT-3 core reaches limit checks only through the plug-in loader (2.054757ms)
✔ P5 missing, ambiguous or invalid model key lookup fails closed without leaking a lookup error (42.170203ms)
✔ P5 trusted lookup uses the retiring run key rather than the agent current key (41.545306ms)
✔ P5 actual model metadata lookup rejects missing/ambiguous owners and never cross-attributes a retiring run (0.418717ms)
✖ REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check (106.432474ms)
✔ REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit (170.782587ms)
✔ REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code (437.666292ms)
✔ REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit (120.745836ms)
✔ REQ-LIMIT-4 a broker with no limit checks configured never stops a run (80.230732ms)
limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0}
organization: {"event":"reload-needs-restart","business":"demo"}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"3646df55-73df-46ac-a828-41d4c0adef5c","source":"@none","code":"baseline-unknown"}
limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null,"run":"run1"},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"ae4d4f3a-9306-4a9d-88c5-234c2f2bfcaf","source":"@none","code":"baseline-unknown"}
✔ REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since (243.095091ms)
organization: {"event":"reload-needs-restart","business":"demo"}
✔ REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed (90.928952ms)
✔ REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive (143.039435ms)
✔ REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1 (136.591564ms)
✔ REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn (171.913947ms)
model-proxy: {"call":"GET /v8/management/config/access/api-keys","status":200,"keyIds":["ddaa88bc74e9"]}
model-proxy: {"action":"proxy.reconcile","addedKeyIds":[],"removedKeyIds":[]}
model-proxy: {"call":"GET /v8/management/config/access/api-keys","status":200,"keyIds":["ddaa88bc74e9"]}
model-proxy: {"call":"PUT /v8/management/config/access/api-keys","status":200,"keyIds":["ddaa88bc74e9","fd2b06e41cec"]}
model-proxy: {"call":"GET /v8/management/config/access/api-keys","status":200,"keyIds":["ddaa88bc74e9","fd2b06e41cec"]}
model-proxy: {"action":"proxy.key.issued","keyIds":["fd2b06e41cec"],"instance":"demo/coder"}
model-proxy: {"call":"GET /v1/models","status":200,"keyIds":["fd2b06e41cec"]}
organization: {"event":"reload-needs-restart","business":"demo"}
limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":null,"model":null,"account":null,"run":"p5-run","modelKeyId":"fd2b06e41cec"},"path":["tokens","keys","fd2b06e41cec"],"limit":2,"count":2,"unknownTurns":0}
limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"fixture","model":"fake","account":null,"modelKeyId":"fd2b06e41cec"},"path":["tokens","keys","fd2b06e41cec"],"limit":2,"count":2,"unknownTurns":0}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ P5 real runtime binds stack usage to issued key, daily stops at stack count and human-only telemetry settings pass broker contract (313.95876ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor (100.42834ms)
✔ runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written (261.328835ms)
✔ vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed (199.005826ms)
✔ P5 usage plugin off by default, default poll is 15 seconds and configured polls skip early ticks (59.508865ms)
✔ P5 safe telemetry stores failures per key and proxy-labelled accounts; no client/upstream value enters store/log/view or quota records (54.132395ms)
✔ P5 unknown msk key goes only to value-free reconcile log and other businesses stay isolated (42.918239ms)
✔ P5 queue failure is safe, does not enforce and does not retry before poll deadline (47.414676ms)
✔ P5 retiring key keeps attribution and telemetry rows remain append-only across reader restart (49.580277ms)
✔ P5 malformed queue batch is atomic: no valid prefix, body or credential can reach store/log/view (42.767702ms)
✔ P5 concurrent ticks issue one bounded queue read and a closed collector never polls again (44.597112ms)
✔ REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses (115.479121ms)
✔ REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket (137.456433ms)
✔ REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once (52.575663ms)
✔ REQ-LIMIT-4 cut: unknown is durable and logged next to every total (47.838399ms)
✔ REQ-LIMIT-4 disabled: unknown is durable and logged next to every total (46.771667ms)
✔ REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total (40.568247ms)
✔ REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total (45.022848ms)
✔ REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total (44.520995ms)
✔ REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts (38.477112ms)
✔ usage records are append-only (38.207707ms)
✔ REQ-LIMIT-4 parse failure logs its safe code, never transcript content (49.361853ms)
✔ REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow (59.674051ms)
✔ REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript (52.284427ms)
✔ REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run (54.284346ms)
✔ REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled (54.236183ms)
✔ REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded (50.417947ms)
✔ row 65 a run bound without a transcript directory records no-transcript (49.190606ms)
✔ P5 immutable stack key attribution survives rotation and restart without key values (45.910581ms)
✔ P5 malformed key metadata is dropped rather than stored or exposed as a key value (45.051417ms)
✔ REQ-PLUG-1 schema: plugins is optional, names known kinds and checked module names (9.756957ms)
✔ REQ-PLUG-1 REQ-ROLE-3 the setter writes plugins through the organization writer and logs old and new names (139.461766ms)
✔ vikunja:19/309 a patch changes only the kinds it names; null removes one kind, explicitly and in the trail (198.116707ms)
✔ vikunja:19/309 an unknown kind (set or removed), a bad module, an empty patch and null on the wrong shape are refused, nothing written (1.940571ms)
✔ REQ-PLUG-1 REQ-ROLE-3 the writer checks the bytes it writes: a Date in plugins is refused there too (23.77339ms)
✔ REQ-PLUG-1 REQ-ROLE-3 a refused setter write throws a code, changes nothing and logs nothing (1.651382ms)
✔ vikunja:19/305 with an exists check, the setter refuses a module no tree file answers to, before anything is written (56.64271ms)
✔ P5 optional usage kind and pollSeconds configure through plugins.set; default stays absent and retention bound is strict (100.452598ms)
✔ P5 only human can enable/disable telemetry or change polling, including direct organization writes (148.009247ms)
✔ REQ-LIMIT-3 schema: each subject kind, limit 0 and no ceiling are accepted; bad limits, times, keys and undeclared instances refuse (12.986058ms)
✔ REQ-LIMIT-3 the writer stamps since: a new limit gets now, a changed one keeps its time, a different time is refused (248.032277ms)
✔ REQ-LIMIT-3 only tokens.* at schema depth holds token limits: agent limits named `limit` save as sent, and a token limit named `limit` is stamped and reset (276.275719ms)
✔ REQ-LIMIT-3 a reset moves since to now, is logged with its actor, and refuses a path that is not a limit (149.313217ms)
✔ REQ-LIMIT-2 schema: launch.account names a credential set; a daily quota needs a reset and an IANA zone and names the account (22.104886ms)
✔ REQ-LIMIT-2 the writer stamps a daily quota's since, keeps its reset and zone, and a reset moves since (155.859496ms)
✔ P5 per-model-key quotas are unset by default, accept digit-leading IDs and only the human changes or resets them (232.766603ms)
✔ probeKey observes 200 with one agent-authenticated GET /v1/models (13.606016ms)
✔ probeKey observes 401 with one agent-authenticated GET /v1/models (2.349516ms)
✔ probeKey observes 503 with one agent-authenticated GET /v1/models (1.394451ms)
✔ proxy-down: agent-key probe connection failure is sanitized (1.448631ms)
✔ proxy-down: silent listener cannot extend probe request deadline (50.92774ms)
✔ agent-key probe returns redirect status without following Location or exposing key (2.519341ms)
✔ proxy-client-invalid: https://127.0.0.1:18318 (0.954469ms)
✔ proxy-client-invalid: http://example.com:18318 (0.688091ms)
✔ proxy-client-invalid: http://localhost:18318 (0.089486ms)
✔ proxy-client-invalid: http://127.0.0.1:8317 (0.072442ms)
✔ proxy-client-invalid: http://user:pass@127.0.0.1:18318 (0.075664ms)
✔ proxy-client-invalid: http://127.0.0.1:18318/path (0.064187ms)
✔ client GET/PUT v8 only, Authorization header, receipt IDs without values or bodies (15.756687ms)
✔ proxy-client-refused (3.167201ms)
✔ proxy-client-response (1.333201ms)
✔ proxy-client-redirect (1.083098ms)
✔ proxy-client-down: transport errors redact details (0.993207ms)
✔ proxy-client-invalid: PUT rejects object key records and empty strings locally (0.155978ms)
✔ proxy-management-key-invalid: missing, symlink and public key file refuse without values (1.086163ms)
✔ bus management-key loader supplies a private fixture key without exposing it on the client (0.529214ms)
✔ proxy-client-response: truncated response remains a redacted named refusal (12.081487ms)
✔ management client ignores ambient fetch dispatchers (1.152012ms)
✔ proxy-key-invalid: Latin-1 leaves complete config/data inventories unchanged (3.391538ms)
✔ proxy-key-invalid: leading space leaves complete config/data inventories unchanged (1.062708ms)
✔ proxy-key-invalid: trailing space leaves complete config/data inventories unchanged (1.046332ms)
✔ proxy-key-invalid: internal space leaves complete config/data inventories unchanged (1.087954ms)
✔ printable non-space ASCII control initializes and authenticates with unchanged existing files (16.664061ms)
✔ OAuth management calls keep URL and state out of receipts (16.723462ms)
✔ upstream key goes only in request body and upstream refusal body is discarded (3.387523ms)
✔ redirected management calls are not followed or retried (1.835042ms)
✔ P5 queue read uses actual bounded fixed management GET and immediately drops client and upstream values (14.543908ms)
✔ P5 bad envelope refuses safely with no retry (2.805976ms)
✔ P5 over count refuses safely with no retry (1.641432ms)
✔ P5 missing key refuses safely with no retry (1.977544ms)
✔ P5 bad counts refuses safely with no retry (1.458ms)
✔ P5 redirect refuses safely with no retry (1.387336ms)
✔ P5 refusal refuses safely with no retry (1.028864ms)
✔ P5 malformed event after a valid event rejects the entire queue before any credential can escape (1.11627ms)
✔ REQ-LIMIT-2 daily-quota exports interface version 2 with mayLaunch, mustStop and report (1.248222ms)
✔ REQ-LIMIT-2 the count sums every kind of the account's known records since the later of the day start and since (11.695173ms)
✔ REQ-LIMIT-2 a launch with no account (pi) is covered by no daily quota (0.286778ms)
✔ REQ-LIMIT-4 an unknown turn adds nothing and is counted apart (0.491571ms)
✔ REQ-LIMIT-2 the day turns at the reset in its zone, not in UTC, and before it the day is yesterday's (0.574704ms)
✔ REQ-LIMIT-2 the spring DST change makes the day after a 00:00 reset 23 hours long (0.368738ms)
✔ REQ-LIMIT-2 the fall DST change makes the day after a 00:00 reset 25 hours long (0.297179ms)
✔ REQ-LIMIT-2 a reset the clocks skip starts the day at the first instant after the gap (0.789063ms)
✔ REQ-LIMIT-2 a reset the clocks repeat starts one day, at the first one (0.436754ms)
✔ REQ-LIMIT-2 a launch is refused at the quota, a turn that reaches it stops, and the next day allows again (1.07467ms)
✔ REQ-LIMIT-2 counts past the safe integer range come back as digit strings (0.372713ms)
✔ REQ-LIMIT-4 bad leaves, records or times throw a code, and the check reads nothing but its arguments (2.387209ms)
✔ REQ-LIMIT-2 no daily quotas: every launch is allowed and the report is empty (0.190068ms)
✔ P5 daily quota for a model key ID matches stack key records and resets the next day (0.797912ms)
✔ REQ-PLUG-1 REQ-LIMIT-4 the registry: usage-source at interface version 1, limit-check at 2 (row 125), each a list (1.067108ms)
✔ REQ-PLUG-1 checkPlugins accepts one key per kind, each a list of names, empty included (0.242701ms)
✔ REQ-PLUG-1 checkPlugins refuses bad shapes, unknown kinds, bad names and duplicates (0.499586ms)
✔ REQ-PLUG-1 a kind that switches on one module takes one name, not a list (0.148124ms)
✔ REQ-PLUG-1 checkPlugins reports through the caller's fail callback (0.132027ms)
✔ P5 usage telemetry is optional, single module, separate from enforcing sources (0.141236ms)
✔ REQ-PLUG-1 fixture modules of each kind switch on from a test organization file, no core file changed (9.357471ms)
✔ REQ-PLUG-1 a name not matching ^[a-z][a-z0-9-]*$ refuses and keeps the old setting (3.869634ms)
✔ REQ-PLUG-1 a missing module directory or index.mjs refuses and keeps the old setting (2.937122ms)
✔ REQ-PLUG-1 a symlinked module directory or index.mjs refuses and keeps the old setting (2.673271ms)
✔ REQ-PLUG-1 a symlinked kind directory refuses and keeps the old setting (2.374164ms)
✔ REQ-PLUG-1 a symlinked packages/plugins refuses (run with --preserve-symlinks so the path keeps it) (27.658454ms)
✔ REQ-PLUG-1 index.mjs swapped for a symlink after the lstat checks refuses at the realpath check (2.627026ms)
✔ REQ-PLUG-1 a path that can't be read refuses as unreadable, is logged and keeps the old setting (2.181959ms)
✔ REQ-PLUG-1 a path that becomes unreadable after the lstat checks refuses at either realpath (2.491019ms)
✔ REQ-PLUG-1 a module that fails to load refuses and keeps the old setting (2.663113ms)
✔ REQ-PLUG-1 a missing export refuses and keeps the old setting (3.78261ms)
✔ REQ-PLUG-1 a different interface version refuses and keeps the old setting (2.634605ms)
✔ REQ-PLUG-1 REQ-LIMIT-3 a version 1 limit check refuses after the bump to 2, and the old setting stays (2.598243ms)
✔ REQ-PLUG-1 a kind refused on its first load has nothing switched on, and the log names kind and name (1.844243ms)
✔ REQ-PLUG-1 the setting's shape: unknown kinds refuse alone, a bad whole setting keeps everything (2.647337ms)
✔ REQ-PLUG-1 loads run one at a time, so the last requested setting wins (102.801872ms)
✔ REQ-PLUG-1 the loader needs a log callback (1.263318ms)
✔ REQ-LIMIT-3 token-limit exports interface version 2 with mayLaunch, mustStop and report (1.188308ms)
✔ REQ-LIMIT-3 each subject kind refuses at its limit and allows under it (1.33092ms)
✔ REQ-LIMIT-3 a limit covers only its own subject's records and launches (0.355614ms)
✔ REQ-LIMIT-4 only known records count; an unknown turn adds nothing and is counted apart (0.231653ms)
✔ REQ-LIMIT-3 a reset moves since: records before it no longer count (0.148217ms)
✔ REQ-LIMIT-3 limit 0 refuses with no records; the first limit hit in file order is named (0.136573ms)
✔ REQ-LIMIT-3 a key limit is not enforced while every record's account is null (decision 150 Q1) (0.176874ms)
✔ REQ-LIMIT-3 counts past the safe integer range come back as digit strings (0.124961ms)
✔ REQ-LIMIT-4 bad records or times throw a code, and the check reads nothing but its arguments (0.607578ms)
✔ REQ-LIMIT-3 no token limits: every launch is allowed and the report is empty (0.23856ms)
✔ REQ-LIMIT-3 token-limit ignores tokens.daily, which the daily-quota check enforces (row 126) (0.114066ms)
✔ P5 a model key ID limit counts stack records by key ID without an account (0.118256ms)
✔ P5 Console displays stack count per safe key separately from optional proxy account numbers (0.841797ms)
✔ P5 Console escapes hostile labels and labels unavailable telemetry without presenting a fresh zero (0.176474ms)
✔ REQ-WEB-1 usage read keeps unknown counts and each token kind; no query or write is accepted (25.573147ms)
✔ REQ-WEB-1 malformed usage is refused instead of shown as zero (4.896859ms)
ℹ tests 170
ℹ suites 0
ℹ pass 169
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 9018.08934

✖ failing tests:

test at packages/bus/tests/limit-stop.test.mjs:51:1
✖ REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check (106.432474ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
  + actual - expected
  ... Skipped lines
  
    [
      {
        business: 'demo',
        subject: {
          account: null,
  ...
          provider: 'anthropic',
  +       run: 'run1'
        }
      },
      {
        business: 'demo',
        subject: {
  ...
          provider: 'anthropic',
  +       run: 'run1'
        }
      }
    ]
  
      at TestContext.<anonymous> (file:///home/jwoltje/.t3/worktrees/mosaic-stack/t3-79263d4f/packages/bus/tests/limit-stop.test.mjs:61:10)
      at async Test.run (node:internal/test_runner/test:1409:7)
      at async startSubtestAfterBootstrap (node:internal/test_runner/harness:387:3) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: [ { business: 'demo', subject: [Object] }, { business: 'demo', subject: [Object] } ],
    expected: [ { business: 'demo', subject: [Object] }, { business: 'demo', subject: [Object] } ],
    operator: 'deepStrictEqual',
    diff: 'simple'
  }
