feat(muse): refresh subscription limits without a model reply#25760

Problem

After a T3 server restart, Muse subscription limits remain unavailable until a model reply supplies a usage notification. Muse Code 1.4.13 can fetch allowance with muse usage --json without a model turn, including when waiting for another reply is impractical.

Scope and approval

Draft follow-up to #25165, based on the CLI usage discovery and live testing. Depends on #25165; do not merge this first. Its commits are currently included because the dependency has not merged. The follow-up-only diff is t3/muse-limits...t3/muse-usage-refresh. Rebase onto main after #25165 merges. Maintainer direction/scope approval is not established; this remains a draft proposal pending that review.

Change

On status refresh, signed-in Muse account instances running 1.4.13 or newer fetch and validate CLI schema-v1 allowance using the configured binary, environment and working directory. Reads have a four-second timeout. Older or unknown CLI versions, API keys, signed-out accounts and failed provider probes skip the command.

CLI observations share timestamp ordering and account generations with streamed notifications. Empty allowances, malformed responses, unknown schemas, command failures and timeouts retain the last valid same-account report. CLI reads run outside the notification permit; account transitions happen before I/O, and results from obsolete generations are discarded. Session duration is explicitly assumed to be five hours because CLI schema v1 omits it.

Managed snapshots now recognize accountLogin labels as account identity when no email is supplied, so a label-only switch cannot retain the previous account's newer bars. User guidance covers the refresh path and fallback behavior. Shared server behavior serves web, desktop, mobile and remote connections; no wire contracts or client changes.

Verification

• vp run check:changed 722c2ea6af: format, lint, both Knip passes, typechecks for 22 affected packages/dependents, and adjacent tests passed.
• Explicit focused tests across Muse adapter/status/catalog/usage/probe and provider-core usage/managed snapshot: 97 passed in 7 files.
• Added tests cover successful refresh with argv/environment/cwd checks; empty/error/malformed/unsupported responses; older and unknown versions; API keys/logout; stale timestamps; bounded reads; notifications publishing while a CLI read is stalled; generation changes during a read; and label/email identity transitions. Three managed-provider identity regression cases failed before the fix and passed afterward.
• Read-only live check against signed-in Muse Code 1.4.13-R6996.1: an empty observation cache refreshed to authenticated/ready with Session 1% used (reset 2026-10-27T09:01:18Z) and Weekly 33% used (reset 2026-11-02T00:00:00Z). checkedAt came from Meta's asOfMs; no model message was sent. A fresh MSP usage/read returned {} while the CLI supplied allowance.
• Opus 5.5 and Grok 4.7 independently reviewed the initial follow-up. Their confirmed notification-lock and label-account findings were fixed with regression coverage; Opus's suggested version gate was added. They have not reviewed the final revision.
• Not verified: Windows runtime, older native Muse binaries, app UI captures or multi-environment deduplication. Older/unsupported command behavior is covered with fake CLI fixtures; generation/state concurrency uses Deferred synchronization and TestClock.

Model: GPT-6.1 Sol | Harness: Codex in T3 Code. Review: Claude Opus 5.5 and Grok 4.7.