fix(sync): validate Usage Monitor quota acknowledgments

[jaywedgeworth22]

Summary

• Require a complete v2 success acknowledgement with matching emitted-event count, nonnegative integer disposition counts, a consistent total, and zero rejected events.
• Surface malformed and partially/fully rejected 2xx responses as sync failures. Accept valid duplicate/pruned acknowledgements without inflating persisted counts.
• Count only emitted quota events and fail before HTTP when none can be published. Preserve generic-webhook HTTP 2xx semantics, local sync opt-out, and existing payload identity/privacy.

Tests

Expanded URLProtocol fixtures cover malformed/missing/invalid ACK fields, count mismatch and overflow, partial/full rejection on 200/202, duplicate/pruned success, stable retry identities, filtered/empty batches, and generic webhook compatibility.
Exact head 16f69ea12fb3d40b9d5e460df6e705c096ccbec4 passes hosted macOS Swift build and full tests (774 reported, 3 expected opt-in skips, zero failures), iOS companion simulator build/launch, Mac widget build, native screenshot jobs, and secret scanning. Run: https://github.com/Simple-With-Us/CodeCaps/actions/runs/37558210936 . git diff --check passes; this workspace has no local Swift toolchain, so native validation was hosted.

Independent source review found no blocker. One Kody thread about neutral presentation when no quotas are publishable remains unresolved; this change avoids an empty v2 request already rejected by the receiver and keeps the existing failure outcome. A separate MonitorModel presentation change overlaps open PR #175 and is outside this ACK-only fileset. Required named review and merge authorization remain separate gates. Draft stays unmerged.

Task notes

Owner-requested usage audit fix. Board reservation fa7a72c66e5343e9acc40b4af21f39e7, CODEX, claimed 2026-10-07; app/#agent-sync coordination posted and current open-PR files checked. No overlapping publisher edit found. Source and tests only; task notes kept here instead of effort-log uploads. Independent read-only review completed. No merge, deployment, credentials, authentication, or sync-setting change.

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[jaywedgeworth22]

Verification update: source head c9c4afc passed hosted macOS Swift build and Swift tests (package job112588813664). Current head16f69ea only expands rejection tests to both HTTP200/202 and realistic rejection detail fields; its full Swift CI run37558210936 is queued behind the prior companion job. Secret scanning passed on the current head. Independent read-only source review found no blocker. Native verification of the final head remains pending; no merge/deployment performed.

[kody-ai]

Markdown rendering can collapse the Tests paragraph’s internal sentence boundaries; use the renderer-safe   gap at each boundary.

Kody rule violation: Use two spaces between sentences in every human-facing string and agent-written paragraph

[kody-ai]

Business Rules Validation

Task: 5708481563 — Settings/Console window layering above Glance popover
Task Link: #164
Referenced PR: #163
Status: Issues Found
Confidence: high

Intent Comparison

• Task intent: Change Settings/Console and Glance popover window coordination so the console is layered above the popover, remains visible while key, and applies the specified dismissal and window-level restoration behavior on focus loss.
• PR intent: Validate Usage Monitor v2 quota-publisher acknowledgments, reject inconsistent or rejected batches, and handle empty publishable batches.
• Alignment: scope_mismatch
• Task-context note: The task context is marked PARTIAL. Its extracted acceptance criteria contain only branch and PR references; the behavioral requirements appear only in the Summary.

Findings

MUST_FIX: PR scope does not match the Settings/Console window-layering task

Requirement: "Reserve and track Settings/Console window layering so the console opens above the Glance popover, stays visible while key, and dismisses the popover / restores normal window level on focus loss." (Summary)
Missing in code: No evidence in this PR diff of changes to Settings/Console window management, Glance popover presentation, window-level assignment, key visibility, or focus-loss handling. Consequently, none of the specified layering behaviors is implemented by the changes shown.
Evidence (Code): The diff is limited to Sources/QuotaCore/QuotaPublisher.swift and Tests/QuotaCoreTests/QuotaPublisherTests.swift, where it changes quota publishing and acknowledgment validation. It does not show changes in the window-layering domain required by the task.
Suggested action: Update the PR with the relevant Settings/Console, Glance popover, and window-management changes. Ensure opening/activation places the console above the popover, preserves its required visibility while key, and handles focus loss by dismissing the popover and restoring the normal window level. Add focused tests for these interaction sequences.

Acceptance Criteria Status

• AC feat: customizable menu bar style and quota selection #1 — MISSING: "Branch: ag/settings-window-layering". No evidence in the supplied PR diff identifies the head branch, and source-code changes cannot establish that administrative metadata. Verify that PR feat(ui): layer Settings/Console window above popover with focus-loss dismissal #163 uses the required branch or update the task reference if it does not.
• AC feat(handoff): publish provider issues, producer, derived status and model family #2 — IMPLEMENTED (administrative linkage): "PR: feat(ui): layer Settings/Console window above popover with focus-loss dismissal #163". The supplied task context and PR reference identify this URL; this criterion does not require a source-code implementation.
• Summary behavioral requirement — MISSING: The Summary's window-layering behavior is not represented by the extracted acceptance criteria and has no implementation evidence in this PR diff, as detailed in the MUST_FIX finding.

---

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.

[jaywedgeworth22]

Exact-head update: 16f69ea passed the hosted macOS Swift build and full Swift tests (package job112592367179), including the expanded HTTP200/202 rejection fixtures. Current-head secret scanning also passed. Companion/iOS/widget verification remains running in https://github.com/Simple-With-Us/CodeCaps/actions/runs/37558210936 . The previous head completed the entire workflow successfully. Draft remains unmerged; independent source review does not substitute for the required named review.

[kody-ai]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

🤔 Insufficient Task Context

I found a task linked to this PR, but it only contains minimal information (title only, no description or acceptance criteria). To perform a meaningful business rules validation, I need more details.

🔍 What I need to validate:

• Business requirements and acceptance criteria
• Expected behavior and business rules
• Edge cases and constraints to consider

💡 How to improve the task context:

• Add a description to the linked ticket
• Include acceptance criteria or business rules
• Describe the expected behavior after the change

⚠️ Important:

A task title alone is not sufficient to determine whether the implementation is correct or complete.

---

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.