feat(spend-caps): stop a DeepSeek wallet at the floor the operator sets

[dibenkobit]

A spend cap was modelled as a share of a rolling subscription window, so the two harnesses that
actually spend money had no cap at all — and the code said one was impossible, because "a cap is a
fraction of a window, and there is no window here". The window was never the point; the meter was. A
subscription meters windows, a wallet meters money, and the operator's instruction is the same in
both cases: stop spending this harness here.

A cap is now one of two kinds. window_percent is what shipped. wallet_floor is money the lab has
to leave in a wallet, in the currency the vendor reports it in. Both are read the same way, answer
the same withheld block before a run is prepared, hibernate the same way, and free parked work the
same way when the operator loosens either. DeepSeek's balance stops being a display string smuggled
into the plan tier and becomes money per currency, compared as decimals rather than floats — the
wallet was already read on every preflight, so nothing here asks a vendor anything new.

The third commit is a bug this change would otherwise have shipped: giving the cap a discriminator
made every cap already on disk unreadable, and an unreadable settings document leaves the shipped
defaults standing. A lab told to stop Claude at 80% would have come back up spending the whole
ceiling with nothing on screen to say so. A stored cap with no kind is now read as the window cap it
was.

The DeepSeek card stops promising what it cannot do

It claimed "There is no cap". There is one now, and the card says where to set it.

Before	After

The subscriptions page

Both shots are the same lab, the same daemon and the same readings a minute apart; only the
dashboard build differs. An account that meters neither windows nor money no longer draws an empty
meter list under itself, which is what the stray rule under Muse Code is in the before shot.

Before	After

• The wallet row itself is not pictured. It renders per currency the vendor reports, and the
  machine these shots came from holds no DeepSeek key, so the card shows the reading that
  actually happened — No DeepSeek key at ~/.openlab/deepseek.json. The row and its floor field
  are covered by rendering tests instead. Hand the lab a key and I will add the shot.

Muse Code

The card claimed "the CLI reports no token counts, so the lab cannot show you what a run has cost".
That is false: muse exec writes a goal_usage_attribution record per model call into its own
session log, with input, output, cached and reasoning token counts, and Meta publishes the price of
each in the model catalog the CLI caches. What is true is that the lab does not read either yet, and
that is what the card now says. Reading them is the next change, not this one; the card is not
pictured here because the badge beside it names the account Meta bills.

What is verified

pnpm check is green: lint, typecheck, 800+ tests, build. The settings contract was driven against
a real daemon on a disposable OPENLAB_HOME — a legacy cap and a wallet floor round-trip through
PUT /api/settings, and /api/subscriptions serves the balances. The balance-to-withheld path is
covered by tests rather than by a live wallet, for the same reason the row is not pictured.

Written by Claude Opus 5 through the Claude Code harness.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

Note

Add wallet floor spend caps to stop DeepSeek when balance drops to operator-set minimum

• Introduces a WALLET_FLOOR spend cap kind alongside the existing WINDOW_PERCENT kind, with schema validation, duplicate-prevention, and Decimal-based comparison in spend-cap.ts.
• Adds withheldBalances to compare per-currency wallet balances against configured floors, and harnessBlock now returns a WITHHELD block (without a returnsAt) when a wallet is at or under its floor.
• Replaces the single balance: string | null field on HarnessAllowanceReading and HarnessAllowance with a balances: WalletBalance[] array; DeepSeek now returns per-currency amounts instead of a formatted string.
• Adds a WalletFloorField React component in the allowance panel for editing per-currency floors inline, with decimal-only validation and partial-input preservation.
• SpendCapsSchema backfills kind: 'window_percent' for legacy cap objects that lack a kind field, preserving backward compatibility.
• Risk: the balance field is removed from allowance readings and allowances — any consumers outside this PR that read balance will break.

^{Macroscope summarized e296e2b.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openlab-landing	Ready	Preview	Aug 7, 2026 4:30pm

[dibenkobit]

Rebased onto main after #11 landed, which renamed the allowance layer underneath this branch. Two things worth a reviewer's eye, because they were decisions rather than conflict resolution:

One money field, not two. #11 landed balance: string | null — the wallet as one line — while this PR needs money per currency to floor it. Both described the same fact, so balances: [{currency, amount}] is now the only one: it carries everything the joined string did and the floor needs the currency. balance is gone from the protocol.

Muse says it in the panel, not the protocol. #11 had Muse report the sentence "Meta publishes no balance" in the money field. With money now a decimal per currency, prose has nowhere honest to sit, so a reading that succeeded with neither meter says so on the card instead — an empty card would read as a reading that failed, which is what that sentence existed to prevent.

Also carried over from #11: the spent-wallet verdict still drives EXHAUSTED, and the block message calls a wallet a wallet.

Verified on the merge: typecheck, 800+ tests and the build all pass locally.