From 3cd6eca16a9f498781d5cfd286d7f94dcfb1dad7 Mon Sep 17 00:00:00 2001
From: "swu-echo[bot]" <swu-echo[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:29:14 -0500
Subject: [PATCH 01/10] quota: agree on one payload across surfaces (F1),
 dedupe own push vs local copy (F2)

F1 - QuotaWindowVocabulary.isOwnDeviceWindow checked the local-mac: id
prefix before the producer instance, while FleetOrigin.isOwnPush checks
the instance first.  One payload (local-mac:xai:subscription pushed by a
foreign producer instance) read as this device's own on the phone and
widget and as a copy on the Mac.  The instance now decides first in both,
so the surfaces cannot drift; prefix and source fallbacks are unchanged
when no instance is present.

F2 - QuotaResponse.platformSections keyed its dedupe on the raw window id,
and only across provider-group additions.  This Mac's plan-details window
(local-mac:xai:plan-metadata) and its own push coming back
(xai:plan-metadata) name one payload but survived as two rows.  The key
now strips the localDeviceWindowPrefix and top-level windows dedupe too.

Regression tests pin both: the foreign-instance case against the
prefix-first order, and the one-payload count against the raw-id key.
---
 Sources/QuotaCore/QuotaModels.swift           | 18 +++++++--
 Sources/QuotaCore/QuotaWindowVocabulary.swift | 11 ++++--
 .../PlanDetailsDedupeTests.swift              | 38 +++++++++++++++++++
 .../QuotaWindowVocabularyTests.swift          | 20 ++++++++++
 4 files changed, 80 insertions(+), 7 deletions(-)
 create mode 100644 Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift

diff --git a/Sources/QuotaCore/QuotaModels.swift b/Sources/QuotaCore/QuotaModels.swift
index 04610025..452344e4 100644
--- a/Sources/QuotaCore/QuotaModels.swift
+++ b/Sources/QuotaCore/QuotaModels.swift
@@ -668,12 +668,24 @@ public extension QuotaResponse {
         // merged would drop the fleet `xai:subscription` only for a group to
         // hand back the same duplicate moments later — the one disagreement
         // this dedupe exists to remove, reached by the additive manifest path.
-        var collected = windows.map { $0.normalized() }
+        // The dedupe key ignores the local source prefix:  this Mac's own
+        // window (`local-mac:xai:plan-metadata`) and its own push coming
+        // back (`xai:plan-metadata`) are one payload, and keying on the raw
+        // id let both survive as duplicate plan-details rows.
+        func dedupeKey(_ window: QuotaWindow) -> String {
+            let prefix = QuotaWindowVocabulary.localDeviceWindowPrefix
+            let id = window.id.hasPrefix(prefix) ? String(window.id.dropFirst(prefix.count)) : window.id
+            return "\(window.canonicalProviderKey):\(id)"
+        }
+        var collected: [QuotaWindow] = []
+        var seen: Set<String> = []
+        for window in windows.map({ $0.normalized() }) where seen.insert(dedupeKey(window)).inserted {
+            collected.append(window)
+        }
         // Older responses may not have top-level windows but do have the
         // additive provider groups.  Fill only absent IDs to avoid duplicates.
-        var seen = Set(collected.map { "\($0.canonicalProviderKey):\($0.id)" })
         for group in providerGroups {
-            for window in group.windows.map({ $0.normalized() }) where seen.insert("\(window.canonicalProviderKey):\(window.id)").inserted {
+            for window in group.windows.map({ $0.normalized() }) where seen.insert(dedupeKey(window)).inserted {
                 collected.append(window)
             }
         }
diff --git a/Sources/QuotaCore/QuotaWindowVocabulary.swift b/Sources/QuotaCore/QuotaWindowVocabulary.swift
index 96e4e4c5..376224c4 100644
--- a/Sources/QuotaCore/QuotaWindowVocabulary.swift
+++ b/Sources/QuotaCore/QuotaWindowVocabulary.swift
@@ -600,13 +600,16 @@ public enum QuotaWindowVocabulary {
         producerInstanceId: String?,
         ownInstanceId: String? = nil
     ) -> Bool {
-        if id.hasPrefix(localDeviceWindowPrefix) { return true }
+        // The producer instance decides before the prefix, the same
+        // precedence `FleetOrigin.isOwnPush` applies:  a window carrying this
+        // Mac's `local-mac:` id prefix but ANOTHER installation's producer
+        // instance is a foreign copy of a same-named payload, and the two
+        // surfaces must agree on one payload.  The comparison ignores case.
         let instance = (producerInstanceId ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
         let own = (ownInstanceId ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
-        // The owning installation's own reading, decided the way the Mac
-        // decides it:  the instance decides, and the comparison ignores case.
-        if !instance.isEmpty, !own.isEmpty, instance.lowercased() == own.lowercased() { return true }
+        if !instance.isEmpty, !own.isEmpty { return instance.lowercased() == own.lowercased() }
         if !instance.isEmpty { return false }
+        if id.hasPrefix(localDeviceWindowPrefix) { return true }
         let named = (machine ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
         if !named.isEmpty { return false }
         let src = (source ?? "").trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
diff --git a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
new file mode 100644
index 00000000..81287478
--- /dev/null
+++ b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
@@ -0,0 +1,38 @@
+import XCTest
+@testable import QuotaCore
+
+/// This Mac's own plan-details window exists twice in a merged response:
+/// the local copy (`local-mac:xai:plan-metadata`) and its own push coming
+/// back from the server (`xai:plan-metadata`).  Both name the same payload,
+/// so the section merge must keep exactly one.
+final class PlanDetailsDedupeTests: XCTestCase {
+    private func planDetails(id: String) -> QuotaWindow {
+        QuotaWindow(id: id, provider: "xai", providerKey: "xai", label: "Plan details",
+                    remainingUnknown: true, occurredAt: "2026-10-24T07:00:00Z", source: "test")
+    }
+
+    func testALocalPlanDetailsWindowAndItsOwnPushSurviveOnce() {
+        let response = QuotaResponse(generatedAt: "2026-10-24T07:01:00Z",
+                                     windows: [planDetails(id: "local-mac:xai:plan-metadata"),
+                                               planDetails(id: "xai:plan-metadata")],
+                                     skipModelTypes: [])
+        let sections = response.platformSections(now: Date(timeIntervalSince1970: 1_761_328_860))
+        let planWindows = sections.flatMap(\.windows).map(\.window).filter { $0.id.hasSuffix("plan-metadata") }
+        XCTAssertEqual(planWindows.count, 1,
+                       "the local copy and its own push are one payload, not two rows: \(planWindows.map(\.id))")
+    }
+
+    /// The prefix stripping must not merge genuinely different windows:
+    /// another machine's reading carries its own id and stays.
+    func testADifferentWindowUnderTheSameProviderSurvives() {
+        let response = QuotaResponse(generatedAt: "2026-10-24T07:01:00Z",
+                                     windows: [planDetails(id: "local-mac:xai:plan-metadata"),
+                                               planDetails(id: "xai:plan-metadata"),
+                                               planDetails(id: "xai:subscription")],
+                                     skipModelTypes: [])
+        let sections = response.platformSections(now: Date(timeIntervalSince1970: 1_761_328_860))
+        let ids = sections.flatMap(\.windows).map(\.window).map(\.id)
+        XCTAssertTrue(ids.contains("xai:subscription"), "an unrelated window is untouched: \(ids)")
+        XCTAssertEqual(ids.filter { $0.hasSuffix("plan-metadata") }.count, 1)
+    }
+}
diff --git a/Tests/QuotaCoreTests/QuotaWindowVocabularyTests.swift b/Tests/QuotaCoreTests/QuotaWindowVocabularyTests.swift
index 50ddf647..7c9bc518 100644
--- a/Tests/QuotaCoreTests/QuotaWindowVocabularyTests.swift
+++ b/Tests/QuotaCoreTests/QuotaWindowVocabularyTests.swift
@@ -339,6 +339,26 @@ final class QuotaWindowVocabularyTests: XCTestCase {
                        "a window from another reader is a copy")
     }
 
+    /// A window carrying this Mac's `local-mac:` prefix but ANOTHER
+    /// installation's producer instance id is a foreign copy of a same-named
+    /// payload:  the instance outranks the prefix, the same precedence
+    /// `FleetOrigin.isOwnPush` applies, so the phone, the widget and the Mac
+    /// decide one payload the same way.
+    func testAForeignProducerInstanceOutranksTheLocalMacPrefix() {
+        XCTAssertFalse(QuotaWindowVocabulary.isOwnDeviceWindow(id: "local-mac:xai:subscription",
+                                                               source: "CodeCaps",
+                                                               machine: nil,
+                                                               producerInstanceId: "other-mac",
+                                                               ownInstanceId: "this-mac"),
+                       "a foreign producer instance makes the payload a copy even under the local-mac prefix")
+        XCTAssertTrue(QuotaWindowVocabulary.isOwnDeviceWindow(id: "local-mac:xai:subscription",
+                                                              source: "CodeCaps",
+                                                              machine: nil,
+                                                              producerInstanceId: "this-mac",
+                                                              ownInstanceId: "this-mac"),
+                      "this installation's own instance confirms its own payload")
+    }
+
     /// The owning installation's own window is this device's own reading, even
     /// though it names a producer instance.  Every fleet-sourced window names
     /// one, so without this the phone and the widget read this Mac's own

From 609105731b87ce649fc25424bc78f5c75ce5328b Mon Sep 17 00:00:00 2001
From: "swu-echo[bot]" <swu-echo[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:53:10 -0500
Subject: [PATCH 02/10] fix(quota): dedupe only already-classified own pushes
 at adoption

---
 Sources/CodeCaps/MonitorModel.swift           |  4 +-
 Sources/QuotaCore/QuotaModels.swift           | 34 +++++++------
 Tests/CodeCapsTests/FleetRowSourceTests.swift |  4 ++
 .../PlanDetailsDedupeTests.swift              | 51 +++++++++----------
 4 files changed, 50 insertions(+), 43 deletions(-)

diff --git a/Sources/CodeCaps/MonitorModel.swift b/Sources/CodeCaps/MonitorModel.swift
index d778a25b..00103951 100644
--- a/Sources/CodeCaps/MonitorModel.swift
+++ b/Sources/CodeCaps/MonitorModel.swift
@@ -2388,7 +2388,7 @@ final class MonitorModel: ObservableObject {
 
             // This Mac's own push fills in only a provider no local reader
             // produced — with local readers off, that is every provider.
-            let adopted = ownPush.filter { !localProviders.contains($0.canonicalProviderKey) }
+            let adopted = QuotaLocalScope.adoptedOwnPush(ownPush, localWindows: self.localWindows)
             // A window that carries no reading does not claim its provider.
             // This Mac's plan details are its own push coming back, and they
             // named the Antigravity key, so the fleet's live reading for
@@ -2557,7 +2557,7 @@ final class MonitorModel: ObservableObject {
         let localProviders = QuotaLocalScope.providers(withReadings: localWindows)
         let split = FleetOrigin.split(serverWindows, now: now)
         let ownPush = split.ownPush
-        let adopted = ownPush.filter { !localProviders.contains($0.canonicalProviderKey) }
+        let adopted = QuotaLocalScope.adoptedOwnPush(ownPush, localWindows: localWindows)
         // A window that carries no reading does not claim its provider, the
         // same rule the refresh path uses:  the file poll overwrites the
         // merged response, so a plan-details window that held the fleet's
diff --git a/Sources/QuotaCore/QuotaModels.swift b/Sources/QuotaCore/QuotaModels.swift
index 452344e4..b9a05462 100644
--- a/Sources/QuotaCore/QuotaModels.swift
+++ b/Sources/QuotaCore/QuotaModels.swift
@@ -420,6 +420,22 @@ public enum QuotaLocalScope {
     public static func providers(withReadings windows: [QuotaWindow]) -> Set<String> {
         Set(windows.filter { $0.hasReading }.map(\.canonicalProviderKey))
     }
+
+    /// Own pushes have already been separated from foreign readings by
+    /// FleetOrigin.split. Keep the local copy when the same window returns
+    /// from that installation, without deduping any foreign producers.
+    public static func adoptedOwnPush(_ ownPush: [QuotaWindow], localWindows: [QuotaWindow]) -> [QuotaWindow] {
+        let localProviders = providers(withReadings: localWindows)
+        func key(_ window: QuotaWindow) -> [String] {
+            let prefix = QuotaWindowVocabulary.localDeviceWindowPrefix
+            let id = window.id.hasPrefix(prefix) ? String(window.id.dropFirst(prefix.count)) : window.id
+            return [window.canonicalProviderKey, id]
+        }
+        let localKeys = Set(localWindows.map(key))
+        return ownPush.filter {
+            !localProviders.contains($0.canonicalProviderKey) && !localKeys.contains(key($0))
+        }
+    }
 }
 
 /// Response from GET /api/quota-windows.  `providerGroups` is additive and is
@@ -668,24 +684,12 @@ public extension QuotaResponse {
         // merged would drop the fleet `xai:subscription` only for a group to
         // hand back the same duplicate moments later — the one disagreement
         // this dedupe exists to remove, reached by the additive manifest path.
-        // The dedupe key ignores the local source prefix:  this Mac's own
-        // window (`local-mac:xai:plan-metadata`) and its own push coming
-        // back (`xai:plan-metadata`) are one payload, and keying on the raw
-        // id let both survive as duplicate plan-details rows.
-        func dedupeKey(_ window: QuotaWindow) -> String {
-            let prefix = QuotaWindowVocabulary.localDeviceWindowPrefix
-            let id = window.id.hasPrefix(prefix) ? String(window.id.dropFirst(prefix.count)) : window.id
-            return "\(window.canonicalProviderKey):\(id)"
-        }
-        var collected: [QuotaWindow] = []
-        var seen: Set<String> = []
-        for window in windows.map({ $0.normalized() }) where seen.insert(dedupeKey(window)).inserted {
-            collected.append(window)
-        }
+        var collected = windows.map { $0.normalized() }
         // Older responses may not have top-level windows but do have the
         // additive provider groups.  Fill only absent IDs to avoid duplicates.
+        var seen = Set(collected.map { "\($0.canonicalProviderKey):\($0.id)" })
         for group in providerGroups {
-            for window in group.windows.map({ $0.normalized() }) where seen.insert(dedupeKey(window)).inserted {
+            for window in group.windows.map({ $0.normalized() }) where seen.insert("\(window.canonicalProviderKey):\(window.id)").inserted {
                 collected.append(window)
             }
         }
diff --git a/Tests/CodeCapsTests/FleetRowSourceTests.swift b/Tests/CodeCapsTests/FleetRowSourceTests.swift
index a0d87d87..7b0c90bd 100644
--- a/Tests/CodeCapsTests/FleetRowSourceTests.swift
+++ b/Tests/CodeCapsTests/FleetRowSourceTests.swift
@@ -409,6 +409,8 @@ final class FleetRowSourceTests: XCTestCase {
         await model.refreshTaskForTesting?.value
 
         let merged = model.response.windows.filter { $0.canonicalProviderKey == "google-antigravity" }
+        XCTAssertEqual(merged.filter { $0.id.hasSuffix("plan-metadata") }.count, 1,
+                       "local plan details and their own returning push are one payload")
         let readings = merged.filter { $0.remainingPercent != nil }
         XCTAssertEqual(readings.count, 1,
                        "the fleet's live reading reaches the row")
@@ -424,6 +426,8 @@ final class FleetRowSourceTests: XCTestCase {
         await model.sessionFileTaskForTesting?.value
 
         let rebuilt = model.response.windows.filter { $0.canonicalProviderKey == "google-antigravity" }
+        XCTAssertEqual(rebuilt.filter { $0.id.hasSuffix("plan-metadata") }.count, 1,
+                       "the file poll also keeps one plan-details payload")
         XCTAssertEqual(rebuilt.filter { $0.remainingPercent != nil }.count, 1,
                        "the file poll keeps the fleet's live reading in the row")
     }
diff --git a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
index 81287478..09586578 100644
--- a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
+++ b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
@@ -1,38 +1,37 @@
 import XCTest
 @testable import QuotaCore
 
-/// This Mac's own plan-details window exists twice in a merged response:
-/// the local copy (`local-mac:xai:plan-metadata`) and its own push coming
-/// back from the server (`xai:plan-metadata`).  Both name the same payload,
-/// so the section merge must keep exactly one.
 final class PlanDetailsDedupeTests: XCTestCase {
-    private func planDetails(id: String) -> QuotaWindow {
-        QuotaWindow(id: id, provider: "xai", providerKey: "xai", label: "Plan details",
-                    remainingUnknown: true, occurredAt: "2026-10-24T07:00:00Z", source: "test")
+    private func window(_ id: String, producer: String? = nil) -> QuotaWindow {
+        QuotaWindow(id: id, provider: "xai", providerKey: "xai", label: "Plan Details",
+                    remainingUnknown: true, occurredAt: "2026-10-24T07:00:00Z",
+                    source: "test", producerInstanceId: producer)
     }
 
     func testALocalPlanDetailsWindowAndItsOwnPushSurviveOnce() {
-        let response = QuotaResponse(generatedAt: "2026-10-24T07:01:00Z",
-                                     windows: [planDetails(id: "local-mac:xai:plan-metadata"),
-                                               planDetails(id: "xai:plan-metadata")],
-                                     skipModelTypes: [])
-        let sections = response.platformSections(now: Date(timeIntervalSince1970: 1_761_328_860))
-        let planWindows = sections.flatMap(\.windows).map(\.window).filter { $0.id.hasSuffix("plan-metadata") }
-        XCTAssertEqual(planWindows.count, 1,
-                       "the local copy and its own push are one payload, not two rows: \(planWindows.map(\.id))")
+        let local = [window("local-mac:xai:plan-metadata")]
+        let split = FleetOrigin.split([window("xai:plan-metadata", producer: "this-mac")], host: "this-mac")
+        let adopted = QuotaLocalScope.adoptedOwnPush(split.ownPush, localWindows: local)
+        XCTAssertEqual((local + adopted).count, 1)
     }
 
-    /// The prefix stripping must not merge genuinely different windows:
-    /// another machine's reading carries its own id and stays.
     func testADifferentWindowUnderTheSameProviderSurvives() {
-        let response = QuotaResponse(generatedAt: "2026-10-24T07:01:00Z",
-                                     windows: [planDetails(id: "local-mac:xai:plan-metadata"),
-                                               planDetails(id: "xai:plan-metadata"),
-                                               planDetails(id: "xai:subscription")],
-                                     skipModelTypes: [])
-        let sections = response.platformSections(now: Date(timeIntervalSince1970: 1_761_328_860))
-        let ids = sections.flatMap(\.windows).map(\.window).map(\.id)
-        XCTAssertTrue(ids.contains("xai:subscription"), "an unrelated window is untouched: \(ids)")
-        XCTAssertEqual(ids.filter { $0.hasSuffix("plan-metadata") }.count, 1)
+        let local = [window("local-mac:xai:plan-metadata")]
+        let own = [window("xai:plan-metadata"), window("xai:subscription")]
+        let adopted = QuotaLocalScope.adoptedOwnPush(own, localWindows: local)
+        XCTAssertEqual(adopted.map(\.id), ["xai:subscription"])
+    }
+
+    func testAnotherProducersSameIdWindowSurvives() {
+        let local = [window("local-mac:xai:plan-metadata")]
+        let split = FleetOrigin.split([
+            window("xai:plan-metadata", producer: "this-mac"),
+            window("xai:plan-metadata", producer: "other-mac")
+        ], host: "this-mac")
+        let adopted = QuotaLocalScope.adoptedOwnPush(split.ownPush, localWindows: local)
+        XCTAssertTrue(adopted.isEmpty)
+        XCTAssertEqual(split.groups.flatMap(\.windows).map(\.producerInstanceId), ["other-mac"])
+        let response = QuotaResponse(generatedAt: "", windows: local + split.groups.flatMap(\.windows))
+        XCTAssertEqual(response.platformSections().first(where: { $0.providerKey == "xai" })?.windows.count, 2)
     }
 }

From 976e38fe0797140549e7dc6ba12f45e12cba64f7 Mon Sep 17 00:00:00 2001
From: Instinct Agent <agent@instinct.com>
Date: Sat, 24 Oct 2026 09:23:23 -0500
Subject: [PATCH 03/10] style(quota): keep two-space sentence gap in own-push
 comment

---
 Sources/QuotaCore/QuotaModels.swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Sources/QuotaCore/QuotaModels.swift b/Sources/QuotaCore/QuotaModels.swift
index b9a05462..94c3dc11 100644
--- a/Sources/QuotaCore/QuotaModels.swift
+++ b/Sources/QuotaCore/QuotaModels.swift
@@ -422,7 +422,7 @@ public enum QuotaLocalScope {
     }
 
     /// Own pushes have already been separated from foreign readings by
-    /// FleetOrigin.split. Keep the local copy when the same window returns
+    /// FleetOrigin.split.  Keep the local copy when the same window returns
     /// from that installation, without deduping any foreign producers.
     public static func adoptedOwnPush(_ ownPush: [QuotaWindow], localWindows: [QuotaWindow]) -> [QuotaWindow] {
         let localProviders = providers(withReadings: localWindows)

From 15d9d83889ca73930fe3709ef7a9673037702228 Mon Sep 17 00:00:00 2001
From: "swu-echo[bot]" <swu-echo[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 09:59:49 -0500
Subject: [PATCH 04/10] fix(quota): retain informative own pushes over empty
 local copies

---
 Sources/QuotaCore/QuotaModels.swift           |  5 +-
 Tests/CodeCapsTests/FleetRowSourceTests.swift | 54 +++++++++++++++++++
 .../PlanDetailsDedupeTests.swift              | 19 +++++++
 3 files changed, 77 insertions(+), 1 deletion(-)

diff --git a/Sources/QuotaCore/QuotaModels.swift b/Sources/QuotaCore/QuotaModels.swift
index 94c3dc11..f94331ec 100644
--- a/Sources/QuotaCore/QuotaModels.swift
+++ b/Sources/QuotaCore/QuotaModels.swift
@@ -433,7 +433,10 @@ public enum QuotaLocalScope {
         }
         let localKeys = Set(localWindows.map(key))
         return ownPush.filter {
-            !localProviders.contains($0.canonicalProviderKey) && !localKeys.contains(key($0))
+            // A local reading still owns its provider.  An empty local copy
+            // must not hide an informative returning push with the same key.
+            !localProviders.contains($0.canonicalProviderKey)
+                && (!localKeys.contains(key($0)) || $0.hasReading)
         }
     }
 }
diff --git a/Tests/CodeCapsTests/FleetRowSourceTests.swift b/Tests/CodeCapsTests/FleetRowSourceTests.swift
index 7b0c90bd..94e6cf5e 100644
--- a/Tests/CodeCapsTests/FleetRowSourceTests.swift
+++ b/Tests/CodeCapsTests/FleetRowSourceTests.swift
@@ -431,4 +431,58 @@ final class FleetRowSourceTests: XCTestCase {
         XCTAssertEqual(rebuilt.filter { $0.remainingPercent != nil }.count, 1,
                        "the file poll keeps the fleet's live reading in the row")
     }
+    /// xAI plan metadata survives normalization, so both paths really merge
+    /// a local copy with its own returning push rather than only the push.
+    func testBothMergePathsDedupePlanMetadataThatSurvivesNormalization() async throws {
+        for carriesReading in [false, true] {
+            let iso = ISO8601DateFormatter()
+            let now = Date()
+            let producer = QuotaPublisher.producerInstanceId
+            let machine = QuotaPublisher.machineName
+            let suffix = carriesReading ? "unknown" : "plan-metadata"
+            let local = QuotaWindow(id: "local-mac:xai:\(suffix)", provider: "xai",
+                                    providerKey: "xai", label: "Plan Details", remainingUnknown: true,
+                                    occurredAt: iso.string(from: now), source: "CodeCaps Settings",
+                                    producerInstanceId: producer, machine: machine)
+            var pushed = local
+            pushed.id = "xai:\(suffix)"
+            if carriesReading {
+                pushed.remainingPercent = 73
+                pushed.remainingUnknown = false
+            }
+            var foreign = pushed
+            foreign.id = "xai:foreign-reading"
+            foreign.remainingPercent = 11
+            foreign.remainingUnknown = false
+            foreign.producerInstanceId = "other-mac"
+            foreign.machine = "other-mac"
+            let server = QuotaResponse(generatedAt: iso.string(from: now), windows: [pushed, foreign])
+            let model = MonitorModel(defaults: defaults())
+            model.skipsSnapshotIOForTesting = true
+            model.localReadForTesting = { LocalQuotaResult(windows: [local]) }
+            model.serverFetchForTesting = { server }
+            model.refresh()
+            await model.refreshTaskForTesting?.value
+            func assertMerge(_ path: String, file: StaticString = #filePath, line: UInt = #line) {
+                XCTAssertEqual(model.localWindows.filter { $0.id == local.id }.count, 1,
+                               "\(path): the local fixture survives normalization", file: file, line: line)
+                let merged = model.response.windows.filter { $0.canonicalProviderKey == "xai" }
+                if carriesReading {
+                    let readings = merged.filter { $0.hasReading }
+                    XCTAssertEqual(readings.map(\.remainingPercent), [73],
+                                   "\(path): the own reading wins before foreign fallback", file: file, line: line)
+                    XCTAssertEqual(readings.first?.producerInstanceId, producer, file: file, line: line)
+                } else {
+                    XCTAssertEqual(merged.filter { $0.id.hasSuffix("plan-metadata") }.count, 1,
+                                   "\(path): two metadata copies dedupe to one", file: file, line: line)
+                }
+            }
+            assertMerge("refresh")
+            model.sessionFileReadForTesting = { LocalQuotaResult(windows: [local]) }
+            model.refreshSessionFiles()
+            await model.sessionFileTaskForTesting?.value
+            assertMerge("file poll")
+        }
+    }
+
 }
diff --git a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
index 09586578..84ca1f40 100644
--- a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
+++ b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
@@ -34,4 +34,23 @@ final class PlanDetailsDedupeTests: XCTestCase {
         let response = QuotaResponse(generatedAt: "", windows: local + split.groups.flatMap(\.windows))
         XCTAssertEqual(response.platformSections().first(where: { $0.providerKey == "xai" })?.windows.count, 2)
     }
+    func testAnEmptyLocalCopyDoesNotHideItsReturningReading() {
+        let local = [window("local-mac:xai:unknown")]
+        var pushed = window("xai:unknown")
+        pushed.remainingPercent = 73
+        pushed.remainingUnknown = false
+        let adopted = QuotaLocalScope.adoptedOwnPush([pushed], localWindows: local)
+        XCTAssertEqual(adopted.map(\.remainingPercent), [73])
+    }
+
+    func testALocalReadingStillOwnsItsProviderAcrossDistinctWindowIds() {
+        var local = window("local-mac:xai:weekly")
+        local.remainingPercent = 81
+        local.remainingUnknown = false
+        var pushed = window("xai:subscription")
+        pushed.remainingPercent = 23
+        pushed.remainingUnknown = false
+        XCTAssertTrue(QuotaLocalScope.adoptedOwnPush([pushed], localWindows: [local]).isEmpty)
+    }
+
 }

From 54ee1fee474d4c6f48118efa2a49672ae851f270 Mon Sep 17 00:00:00 2001
From: "swu-echo[bot]" <swu-echo[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 10:09:32 -0500
Subject: [PATCH 05/10] test(quota): assert local fixture through observable
 merge output

---
 Tests/CodeCapsTests/FleetRowSourceTests.swift | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/Tests/CodeCapsTests/FleetRowSourceTests.swift b/Tests/CodeCapsTests/FleetRowSourceTests.swift
index 94e6cf5e..8945a7ff 100644
--- a/Tests/CodeCapsTests/FleetRowSourceTests.swift
+++ b/Tests/CodeCapsTests/FleetRowSourceTests.swift
@@ -459,13 +459,17 @@ final class FleetRowSourceTests: XCTestCase {
             let server = QuotaResponse(generatedAt: iso.string(from: now), windows: [pushed, foreign])
             let model = MonitorModel(defaults: defaults())
             model.skipsSnapshotIOForTesting = true
+            // The fixture itself must survive the same normalization used by
+            // both merge paths.  localWindows is private to MonitorModel.
+            XCTAssertEqual(AntigravityQuotaGroups.normalize([local]).map(\.id), [local.id],
+                           "the local fixture survives normalization before either merge")
             model.localReadForTesting = { LocalQuotaResult(windows: [local]) }
             model.serverFetchForTesting = { server }
             model.refresh()
             await model.refreshTaskForTesting?.value
             func assertMerge(_ path: String, file: StaticString = #filePath, line: UInt = #line) {
-                XCTAssertEqual(model.localWindows.filter { $0.id == local.id }.count, 1,
-                               "\(path): the local fixture survives normalization", file: file, line: line)
+                XCTAssertEqual(model.response.windows.filter { $0.id == local.id }.count, 1,
+                               "\(path): the observable merge retains the local fixture", file: file, line: line)
                 let merged = model.response.windows.filter { $0.canonicalProviderKey == "xai" }
                 if carriesReading {
                     let readings = merged.filter { $0.hasReading }

From 1a8a2adb580870b9184dc946b97d8f7e11b28519 Mon Sep 17 00:00:00 2001
From: "swu-echo[bot]" <swu-echo[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 10:25:55 -0500
Subject: [PATCH 06/10] fix(quota): replace empty merge copies with adopted own
 readings

---
 Sources/CodeCaps/MonitorModel.swift           |  4 +--
 Sources/QuotaCore/QuotaModels.swift           | 27 ++++++++++++-------
 Tests/CodeCapsTests/FleetRowSourceTests.swift |  6 +++--
 .../PlanDetailsDedupeTests.swift              | 16 +++++++++++
 4 files changed, 40 insertions(+), 13 deletions(-)

diff --git a/Sources/CodeCaps/MonitorModel.swift b/Sources/CodeCaps/MonitorModel.swift
index 00103951..20f56778 100644
--- a/Sources/CodeCaps/MonitorModel.swift
+++ b/Sources/CodeCaps/MonitorModel.swift
@@ -2405,7 +2405,7 @@ final class MonitorModel: ObservableObject {
                 return !localProviders.contains(key) && !adoptedReadingKeys.contains(key)
                     && expectedQuotaProviderKeys.contains(key)
             }
-            let merged = self.localWindows + adopted + fleetFallback
+            let merged = QuotaLocalScope.localWindowsForMerge(self.localWindows, adopted: adopted) + adopted + fleetFallback
             var origins: [String: QuotaOrigin] = [:]
             for key in Set(merged.map(\.canonicalProviderKey)) { origins[key] = .local }
             self.originByProvider = origins
@@ -2572,7 +2572,7 @@ final class MonitorModel: ObservableObject {
             return !localProviders.contains(key) && !adoptedReadingKeys.contains(key)
                 && expectedQuotaProviderKeys.contains(key)
         }
-        let merged = localWindows + adopted + fleetFallback
+        let merged = QuotaLocalScope.localWindowsForMerge(localWindows, adopted: adopted) + adopted + fleetFallback
         originByProvider = Dictionary(uniqueKeysWithValues: Set(merged.map(\.canonicalProviderKey)).map { ($0, .local) })
         response = QuotaResponse(generatedAt: ISO8601DateFormatter().string(from: now), windows: merged)
         if let writeForTesting = handoffWriteForTesting {
diff --git a/Sources/QuotaCore/QuotaModels.swift b/Sources/QuotaCore/QuotaModels.swift
index f94331ec..262fee05 100644
--- a/Sources/QuotaCore/QuotaModels.swift
+++ b/Sources/QuotaCore/QuotaModels.swift
@@ -422,23 +422,32 @@ public enum QuotaLocalScope {
     }
 
     /// Own pushes have already been separated from foreign readings by
-    /// FleetOrigin.split.  Keep the local copy when the same window returns
-    /// from that installation, without deduping any foreign producers.
+    /// FleetOrigin.split.  Keep an informative local copy when its push returns;
+    /// an informative push can replace an empty local copy at the merge.
+    /// Foreign producers are never deduped by this local adoption rule.
     public static func adoptedOwnPush(_ ownPush: [QuotaWindow], localWindows: [QuotaWindow]) -> [QuotaWindow] {
         let localProviders = providers(withReadings: localWindows)
-        func key(_ window: QuotaWindow) -> [String] {
-            let prefix = QuotaWindowVocabulary.localDeviceWindowPrefix
-            let id = window.id.hasPrefix(prefix) ? String(window.id.dropFirst(prefix.count)) : window.id
-            return [window.canonicalProviderKey, id]
-        }
-        let localKeys = Set(localWindows.map(key))
+        let localKeys = Set(localWindows.map(windowKey))
         return ownPush.filter {
             // A local reading still owns its provider.  An empty local copy
             // must not hide an informative returning push with the same key.
             !localProviders.contains($0.canonicalProviderKey)
-                && (!localKeys.contains(key($0)) || $0.hasReading)
+                && (!localKeys.contains(windowKey($0)) || $0.hasReading)
         }
     }
+
+    /// Only an informative adopted own push replaces its empty local copy.
+    /// The collector's actual local windows are not changed by this merge view.
+    public static func localWindowsForMerge(_ localWindows: [QuotaWindow], adopted: [QuotaWindow]) -> [QuotaWindow] {
+        let replacementKeys = Set(adopted.filter { $0.hasReading }.map(windowKey))
+        return localWindows.filter { $0.hasReading || !replacementKeys.contains(windowKey($0)) }
+    }
+
+    private static func windowKey(_ window: QuotaWindow) -> [String] {
+        let prefix = QuotaWindowVocabulary.localDeviceWindowPrefix
+        let id = window.id.hasPrefix(prefix) ? String(window.id.dropFirst(prefix.count)) : window.id
+        return [window.canonicalProviderKey, id]
+    }
 }
 
 /// Response from GET /api/quota-windows.  `providerGroups` is additive and is
diff --git a/Tests/CodeCapsTests/FleetRowSourceTests.swift b/Tests/CodeCapsTests/FleetRowSourceTests.swift
index 8945a7ff..ef3c90b9 100644
--- a/Tests/CodeCapsTests/FleetRowSourceTests.swift
+++ b/Tests/CodeCapsTests/FleetRowSourceTests.swift
@@ -468,10 +468,12 @@ final class FleetRowSourceTests: XCTestCase {
             model.refresh()
             await model.refreshTaskForTesting?.value
             func assertMerge(_ path: String, file: StaticString = #filePath, line: UInt = #line) {
-                XCTAssertEqual(model.response.windows.filter { $0.id == local.id }.count, 1,
-                               "\(path): the observable merge retains the local fixture", file: file, line: line)
+                XCTAssertEqual(model.response.windows.filter { $0.id == local.id }.count, carriesReading ? 0 : 1,
+                               "\(path): only an informative own push replaces the empty local copy", file: file, line: line)
                 let merged = model.response.windows.filter { $0.canonicalProviderKey == "xai" }
                 if carriesReading {
+                    XCTAssertEqual(merged.filter { $0.id == local.id || $0.id == "xai:\(suffix)" }.count, 1,
+                                   "\(path): the exact-key payload appears once", file: file, line: line)
                     let readings = merged.filter { $0.hasReading }
                     XCTAssertEqual(readings.map(\.remainingPercent), [73],
                                    "\(path): the own reading wins before foreign fallback", file: file, line: line)
diff --git a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
index 84ca1f40..6f57439c 100644
--- a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
+++ b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
@@ -53,4 +53,20 @@ final class PlanDetailsDedupeTests: XCTestCase {
         XCTAssertTrue(QuotaLocalScope.adoptedOwnPush([pushed], localWindows: [local]).isEmpty)
     }
 
+    func testOnlyAnAdoptedReadingReplacesItsExactEmptyLocalCopy() {
+        let empty = window("local-mac:xai:unknown")
+        let distinct = window("local-mac:xai:plan-metadata")
+        var reading = window("xai:unknown")
+        reading.remainingPercent = 73
+        reading.remainingUnknown = false
+        XCTAssertEqual(QuotaLocalScope.localWindowsForMerge([empty, distinct], adopted: [reading]).map(\.id),
+                       [distinct.id])
+        XCTAssertEqual(QuotaLocalScope.localWindowsForMerge([empty], adopted: []).map(\.id), [empty.id])
+        XCTAssertEqual(QuotaLocalScope.localWindowsForMerge([empty], adopted: [window("xai:unknown")]).map(\.id), [empty.id])
+        var localReading = empty
+        localReading.remainingPercent = 81
+        localReading.remainingUnknown = false
+        XCTAssertEqual(QuotaLocalScope.localWindowsForMerge([localReading], adopted: [reading]).map(\.remainingPercent), [81])
+    }
+
 }

From 394db898ecc623115feb0d0c81f6d47262b5a02d Mon Sep 17 00:00:00 2001
From: "swu-echo[bot]" <swu-echo[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 11:13:38 -0500
Subject: [PATCH 07/10] test(quota): pin legacy split adoption and replacement
 end to end

---
 .../QuotaCoreTests/PlanDetailsDedupeTests.swift  | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
index 6f57439c..b9a8e89d 100644
--- a/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
+++ b/Tests/QuotaCoreTests/PlanDetailsDedupeTests.swift
@@ -69,4 +69,20 @@ final class PlanDetailsDedupeTests: XCTestCase {
         XCTAssertEqual(QuotaLocalScope.localWindowsForMerge([localReading], adopted: [reading]).map(\.remainingPercent), [81])
     }
 
+    func testLegacyProducerlessOwnPushSplitsAdoptsAndReplacesItsEmptyCopy() {
+        let local = window("local-mac:xai:unknown")
+        var legacyPush = window("local-mac:xai:unknown")
+        legacyPush.remainingPercent = 73
+        legacyPush.remainingUnknown = false
+        let split = FleetOrigin.split([legacyPush], host: "injected-host", localWindows: [local])
+        XCTAssertEqual(split.ownPush.count, 1)
+        XCTAssertTrue(split.groups.isEmpty)
+        let adopted = QuotaLocalScope.adoptedOwnPush(split.ownPush, localWindows: [local])
+        XCTAssertEqual(adopted.map(\.remainingPercent), [73])
+        let merged = QuotaLocalScope.localWindowsForMerge([local], adopted: adopted) + adopted
+        XCTAssertEqual(merged.count, 1)
+        XCTAssertEqual(merged.first?.remainingPercent, 73)
+        XCTAssertNil(merged.first?.producerInstanceId)
+    }
+
 }

From f8ec2b6d10d2d18a1bba4632e0a00625d70fa59f Mon Sep 17 00:00:00 2001
From: "swu-echo[bot]" <swu-echo[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 11:45:02 -0500
Subject: [PATCH 08/10] fix(quota): give file polling the same legacy ownership
 context

---
 Sources/CodeCaps/MonitorModel.swift           |  2 +-
 Tests/CodeCapsTests/FleetRowSourceTests.swift | 13 +++++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/Sources/CodeCaps/MonitorModel.swift b/Sources/CodeCaps/MonitorModel.swift
index 20f56778..5c2f3a45 100644
--- a/Sources/CodeCaps/MonitorModel.swift
+++ b/Sources/CodeCaps/MonitorModel.swift
@@ -2555,7 +2555,7 @@ final class MonitorModel: ObservableObject {
         // as a local reading here put the xAI row back to no reading at all
         // within a minute of the refresh fixing it (owner, 2026-10-23).
         let localProviders = QuotaLocalScope.providers(withReadings: localWindows)
-        let split = FleetOrigin.split(serverWindows, now: now)
+        let split = FleetOrigin.split(serverWindows, localWindows: localWindows, now: now)
         let ownPush = split.ownPush
         let adopted = QuotaLocalScope.adoptedOwnPush(ownPush, localWindows: localWindows)
         // A window that carries no reading does not claim its provider, the
diff --git a/Tests/CodeCapsTests/FleetRowSourceTests.swift b/Tests/CodeCapsTests/FleetRowSourceTests.swift
index ef3c90b9..844ea093 100644
--- a/Tests/CodeCapsTests/FleetRowSourceTests.swift
+++ b/Tests/CodeCapsTests/FleetRowSourceTests.swift
@@ -434,7 +434,9 @@ final class FleetRowSourceTests: XCTestCase {
     /// xAI plan metadata survives normalization, so both paths really merge
     /// a local copy with its own returning push rather than only the push.
     func testBothMergePathsDedupePlanMetadataThatSurvivesNormalization() async throws {
-        for carriesReading in [false, true] {
+        for variant in ["metadata", "reading", "legacy-reading"] {
+            let carriesReading = variant != "metadata"
+            let isLegacy = variant == "legacy-reading"
             let iso = ISO8601DateFormatter()
             let now = Date()
             let producer = QuotaPublisher.producerInstanceId
@@ -450,6 +452,13 @@ final class FleetRowSourceTests: XCTestCase {
                 pushed.remainingPercent = 73
                 pushed.remainingUnknown = false
             }
+            if isLegacy {
+                // No prefix, producer, machine or app-name shortcut: only
+                // the matching local timestamp/window proves this own push.
+                pushed.producerInstanceId = nil
+                pushed.machine = nil
+                pushed.source = "synthetic-legacy-source"
+            }
             var foreign = pushed
             foreign.id = "xai:foreign-reading"
             foreign.remainingPercent = 11
@@ -477,7 +486,7 @@ final class FleetRowSourceTests: XCTestCase {
                     let readings = merged.filter { $0.hasReading }
                     XCTAssertEqual(readings.map(\.remainingPercent), [73],
                                    "\(path): the own reading wins before foreign fallback", file: file, line: line)
-                    XCTAssertEqual(readings.first?.producerInstanceId, producer, file: file, line: line)
+                    XCTAssertEqual(readings.first?.producerInstanceId, isLegacy ? nil : producer, file: file, line: line)
                 } else {
                     XCTAssertEqual(merged.filter { $0.id.hasSuffix("plan-metadata") }.count, 1,
                                    "\(path): two metadata copies dedupe to one", file: file, line: line)

From 5b06ce7ca44e0947f557f27d7adb6cd2c6c122f7 Mon Sep 17 00:00:00 2001
From: "Echo (Instinct)" <echo@simplewithus.com>
Date: Mon, 26 Oct 2026 07:19:22 -0500
Subject: [PATCH 09/10] fix: require payload identity or explicit cadence for
 legacy fleet match

---
 Sources/QuotaCore/FleetOrigin.swift           | 10 +++-
 Tests/CodeCapsTests/FleetRowSourceTests.swift | 15 +++++-
 Tests/QuotaCoreTests/FleetOriginTests.swift   | 47 +++++++++++++++++++
 3 files changed, 69 insertions(+), 3 deletions(-)

diff --git a/Sources/QuotaCore/FleetOrigin.swift b/Sources/QuotaCore/FleetOrigin.swift
index 47fdee0c..0327d692 100644
--- a/Sources/QuotaCore/FleetOrigin.swift
+++ b/Sources/QuotaCore/FleetOrigin.swift
@@ -30,6 +30,11 @@ public enum FleetOrigin {
             .replacingOccurrences(of: " ", with: "")
     }
 
+    private static func localPayloadId(_ id: String) -> String {
+        let prefix = QuotaWindowVocabulary.localDeviceWindowPrefix
+        return id.hasPrefix(prefix) ? String(id.dropFirst(prefix.count)) : id
+    }
+
     /// Whether a pulled window is this Mac's own push coming back.  Such a
     /// window belongs under This Mac and must never be duplicated under Fleet.
     public static func isOwnPush(
@@ -61,7 +66,10 @@ public enum FleetOrigin {
             let matchesLocal = localWindows.contains { local in
                 local.canonicalProviderKey == window.canonicalProviderKey
                     && local.occurredAt == occurred
-                    && (local.window == window.window || local.id == window.id)
+                    // Missing cadence tokens do not identify the same payload.
+                    // Compare the same normalized IDs used by local adoption.
+                    && (localPayloadId(local.id) == localPayloadId(window.id)
+                        || (local.window != nil && local.window == window.window))
             }
             if matchesLocal { return true }
         }
diff --git a/Tests/CodeCapsTests/FleetRowSourceTests.swift b/Tests/CodeCapsTests/FleetRowSourceTests.swift
index 844ea093..61c79ec2 100644
--- a/Tests/CodeCapsTests/FleetRowSourceTests.swift
+++ b/Tests/CodeCapsTests/FleetRowSourceTests.swift
@@ -463,8 +463,10 @@ final class FleetRowSourceTests: XCTestCase {
             foreign.id = "xai:foreign-reading"
             foreign.remainingPercent = 11
             foreign.remainingUnknown = false
-            foreign.producerInstanceId = "other-mac"
-            foreign.machine = "other-mac"
+            foreign.producerInstanceId = isLegacy ? nil : "other-mac"
+            foreign.machine = isLegacy ? nil : "other-mac"
+            // The legacy foreign payload shares provider/time and missing cadence,
+            // but not payload ID. It must remain in Fleet on BOTH merge paths.
             let server = QuotaResponse(generatedAt: iso.string(from: now), windows: [pushed, foreign])
             let model = MonitorModel(defaults: defaults())
             model.skipsSnapshotIOForTesting = true
@@ -479,6 +481,15 @@ final class FleetRowSourceTests: XCTestCase {
             func assertMerge(_ path: String, file: StaticString = #filePath, line: UInt = #line) {
                 XCTAssertEqual(model.response.windows.filter { $0.id == local.id }.count, carriesReading ? 0 : 1,
                                "\(path): only an informative own push replaces the empty local copy", file: file, line: line)
+                // Only refresh publishes fleetWindowGroups; polling must be
+                // checked through its actual merged response below, not a stale group.
+                if path == "refresh" {
+                    let groupedForeign = model.fleetWindowGroups.flatMap(\.windows)
+                        .filter { $0.id == foreign.id }
+                    XCTAssertEqual(groupedForeign.count, 1,
+                                   "\(path): distinct legacy payload remains in Fleet", file: file, line: line)
+                    XCTAssertEqual(groupedForeign.first?.remainingPercent, 11, file: file, line: line)
+                }
                 let merged = model.response.windows.filter { $0.canonicalProviderKey == "xai" }
                 if carriesReading {
                     XCTAssertEqual(merged.filter { $0.id == local.id || $0.id == "xai:\(suffix)" }.count, 1,
diff --git a/Tests/QuotaCoreTests/FleetOriginTests.swift b/Tests/QuotaCoreTests/FleetOriginTests.swift
index c64f454c..f6c0a304 100644
--- a/Tests/QuotaCoreTests/FleetOriginTests.swift
+++ b/Tests/QuotaCoreTests/FleetOriginTests.swift
@@ -89,6 +89,53 @@ final class FleetOriginTests: XCTestCase {
         XCTAssertTrue(split.groups.isEmpty)
     }
 
+    /// An arbitrary source avoids the separate legacy app-name fallback.
+    func testMissingCadenceDoesNotIdentifyDistinctLegacyPayloadAsOwn() {
+        let local = window(id: "local-mac:anthropic:five_hour", source: "synthetic-local", sourceApp: nil)
+        let foreign = window(id: "anthropic:weekly", source: "synthetic-remote", sourceApp: nil)
+        XCTAssertNil(local.window)
+        XCTAssertNil(foreign.window)
+        XCTAssertEqual(local.occurredAt, foreign.occurredAt)
+        XCTAssertFalse(FleetOrigin.isOwnPush(foreign, host: "injected-host", localWindows: [local]))
+        let split = FleetOrigin.split([foreign], host: "injected-host", localWindows: [local],
+                                     now: foreign.occurredDate ?? Date())
+        XCTAssertTrue(split.ownPush.isEmpty)
+        XCTAssertEqual(split.groups.flatMap(\.windows).map(\.id), [foreign.id])
+    }
+
+    func testLegacyMatchingPayloadIdSurvivesLocalPrefixNormalization() {
+        let local = window(id: "local-mac:anthropic:five_hour", source: "synthetic-local", sourceApp: nil)
+        let echo = window(id: "anthropic:five_hour", source: "synthetic-remote", sourceApp: nil)
+        XCTAssertTrue(FleetOrigin.isOwnPush(echo, host: "injected-host", localWindows: [local]))
+    }
+
+    func testExplicitMatchingCadenceStillIdentifiesLegacyPayload() {
+        var local = window(id: "local-mac:anthropic:a", source: "synthetic-local", sourceApp: nil)
+        var echo = window(id: "anthropic:b", source: "synthetic-remote", sourceApp: nil)
+        local.window = "five_hour"
+        echo.window = "five_hour"
+        XCTAssertTrue(FleetOrigin.isOwnPush(echo, host: "injected-host", localWindows: [local]))
+        echo.window = "weekly"
+        XCTAssertFalse(FleetOrigin.isOwnPush(echo, host: "injected-host", localWindows: [local]))
+    }
+
+    func testExplicitRemoteProducerOverridesMatchingTimestampAndId() {
+        let local = window(id: "local-mac:anthropic:five_hour", source: "synthetic-local", sourceApp: nil)
+        var remote = window(id: "anthropic:five_hour", source: "synthetic-remote", sourceApp: nil)
+        remote.producerInstanceId = "other-installation"
+        XCTAssertFalse(FleetOrigin.isOwnPush(remote, host: "injected-host", localWindows: [local]))
+    }
+
+    func testNilCadenceFixDoesNotChangeLegacyAppSourceProviderFallback() {
+        let local = window(id: "local-mac:anthropic:a", source: "synthetic-local", sourceApp: nil)
+        for source in ["codecaps", "agent-bar"] {
+            var legacy = window(id: "anthropic:b", source: source, sourceApp: nil)
+            legacy.occurredAt = "2026-09-18T03:37:53.456Z"
+            XCTAssertTrue(FleetOrigin.isOwnPush(legacy, host: "injected-host", localWindows: [local]),
+                          "the separate legacy provider fallback is deliberately unchanged")
+        }
+    }
+
     func testLocalMacPrefixAndSourceAppIdentifiesOwnPush() {
         let prefixed = window(id: "local-mac:anthropic:five_hour", source: "Claude Code", sourceApp: nil)
         XCTAssertTrue(FleetOrigin.isOwnPush(prefixed, host: "unrelated-host"))

From 864bb58ebc0f35e9840db72260c135d3382a9488 Mon Sep 17 00:00:00 2001
From: "Echo (Instinct)" <echo@simplewithus.com>
Date: Mon, 26 Oct 2026 07:57:17 -0500
Subject: [PATCH 10/10] style: keep two-space sentence gap in fixture comment

---
 Tests/CodeCapsTests/FleetRowSourceTests.swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tests/CodeCapsTests/FleetRowSourceTests.swift b/Tests/CodeCapsTests/FleetRowSourceTests.swift
index 61c79ec2..75348ff6 100644
--- a/Tests/CodeCapsTests/FleetRowSourceTests.swift
+++ b/Tests/CodeCapsTests/FleetRowSourceTests.swift
@@ -466,7 +466,7 @@ final class FleetRowSourceTests: XCTestCase {
             foreign.producerInstanceId = isLegacy ? nil : "other-mac"
             foreign.machine = isLegacy ? nil : "other-mac"
             // The legacy foreign payload shares provider/time and missing cadence,
-            // but not payload ID. It must remain in Fleet on BOTH merge paths.
+            // but not payload ID.  It must remain in Fleet on BOTH merge paths.
             let server = QuotaResponse(generatedAt: iso.string(from: now), windows: [pushed, foreign])
             let model = MonitorModel(defaults: defaults())
             model.skipsSnapshotIOForTesting = true