feat(events): enablement, per-run caps and mayInvoke (Phase 6)

Two new tables — event_action_settings (the deployment switchboard) and
event_run_budget (what a run has spent and the most it may) — plus verified_at
and verified_by on event_versions. The whole authorisation decision moves behind
one function, events/authorize.js: role, enablement, cap, and the shard's own
switch named as the layer core deliberately does not duplicate.

Three routes, none moved: GET/PUT /admin/events/actions (admin in both
directions) and POST /admin/events/:id/verify (admin, editor — a dry run
dispatches nothing).

Four decisions, settled by the org lead 2026-09-03:

- The default-off line falls between inspect and change, not between notify and
  inspect. Read literally, §K shipped core.wait disabled. The same line is the
  role floor.
- The tightest cap wins where two actions spend one dimension, pinned into the
  run at creation with the action it came from.
- A refusal follows the step's on_failure and takes health to degraded — its own
  status and its own log kind, because a refusal is not an outage.
- The verify gate is enforced for scheduled starts only: a human pressing Start
  now is the review the gate exists to require.

Derived and flagged for review: a dry run fails rather than warns on a disabled
action or an over-cap plan, and the unattended path does not re-check the
starter's role.

+111 tests (1921/1847/73/1 — the one failure pre-existing and environmental),
including a 403 walk over the real router and two concurrent spends against one
cap on a real MariaDB. The live walk found two defects, both fixed here: the run
console route dropped the budget it was handed, and the role refusal used a
plural verb over a one-item list.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T6t8mrAWhZU5vnyYgZTMtL

client/src/App.jsx

@@ -53,6 +53,7 @@ import EventsAdmin from './routes/admin/views/EventsAdmin.jsx'
 import EventsCalendar from './routes/admin/views/EventsCalendar.jsx'
 import EventEditor from './routes/admin/views/EventEditor.jsx'
 import EventRun from './routes/admin/views/EventRun.jsx'
+import EventActions from './routes/admin/views/EventActions.jsx'
 import TeamsAdmin from './routes/admin/views/TeamsAdmin.jsx'
 import AccountAdmin from './routes/admin/views/AccountAdmin.jsx'
 import Moderation from './routes/admin/views/Moderation.jsx'
@@ -206,6 +207,10 @@ export default function App() {
                   literal segment is never read as a definition id. */}
               <Route path="events" element={<EventsAdmin />} />
               <Route path="events/calendar" element={<EventsCalendar />} />
+              {/* The switchboard (Phase 6). A literal segment, declared before
+                  `events/:id` the way the router declares `/actions` before
+                  `/:id` — the same collision, on the other side of the wire. */}
+              <Route path="events/actions" element={<EventActions />} />
               <Route path="events/runs/:runId" element={<EventRun />} />
               <Route path="events/new" element={<EventEditor />} />
               <Route path="events/:id" element={<EventEditor />} />

client/src/api/client.js

@@ -486,6 +486,17 @@ export const api = {
     archiveEvent: (id) => req(`/admin/events/${id}`, { method: 'DELETE' }),
     listEventVersions: (id) => req(`/admin/events/${id}/versions`),
     eventCatalog: () => req('/admin/events/catalog'),
+    // Phase 6. The dry run is admin+editor: it dispatches nothing, and the author
+    // who wrote the definition is who should be able to price it against the caps
+    // before asking an admin to publish it. A report with findings comes back 200
+    // — the request succeeded, the plan has problems.
+    verifyEvent: (id) => req(`/admin/events/${id}/verify`, { method: 'POST' }),
+    // The switchboard, admin only in BOTH directions: reading which actions a
+    // deployment permits is as much configuration as writing it (§K). One action
+    // per write rather than the whole board, so an action that appeared between
+    // the read and the write cannot be overwritten with a default.
+    eventActions: () => req('/admin/events/actions'),
+    saveEventAction: (body) => req('/admin/events/actions', { method: 'PUT', body }),
     eventSeries: () => req('/admin/events/series'),
     // Series writes are admin+editor rather than admin: naming an arc is
     // authoring, and §N2's narrow gate is about committing the deployment to a

client/src/lib/eventAuthoring.js

@@ -460,6 +460,11 @@ const KIND_WORDS = {
   'phase.gate': 'Advance condition set',
   'condition.evaluated': 'Condition evaluated',
   'phase.advanced': 'Phase advanced',
+  // Phase 6. "Refused" reads differently from "Step" on purpose: an operator
+  // scanning a stopped run needs to see that nothing is broken.
+  'step.refused': 'Refused',
+  'run.budget': 'Caps',
+  'version.verified': 'Dry run passed',
   note: 'Note',
 }
 
@@ -514,6 +519,18 @@ export function describeLogLine(line) {
       return d.because === 'forced'
         ? `${line.phase} advanced by hand after ${d.waitedSeconds}s${d.reason ? `: ${d.reason}` : ''}`
         : `${line.phase} advanced on its ${d.because === 'elapsed' ? 'deadline' : 'condition'} after ${d.waitedSeconds}s`
+    // Phase 6. `step.refused` is its own kind rather than a `step.status` for a
+    // reason an operator feels at 2am: a refusal is not a failure, and the line
+    // has to say which deployment rule stopped it -- the answer to "not enabled"
+    // is a switch, and the answer to "over the cap" is a number.
+    case 'step.refused':
+      return `${d.action} refused: ${d.error}`
+    case 'run.budget':
+      return (d.dimensions || [])
+        .map((x) => `${x.dimension} capped at ${x.cap === null ? 'nothing' : x.cap}${x.from ? ` (${x.from})` : ''}`)
+        .join(', ') || 'no caps apply to this run'
+    case 'version.verified':
+      return `Version ${d.version} passed its dry run — scheduled occurrences may start`
     default:
       return logKindWord(line?.kind)
   }

client/src/routes/admin/AdminLayout.jsx

@@ -137,6 +137,11 @@ export const NAV = [
       // and the arcs it manages are authoring gated on the buttons rather than
       // on the row.
       { to: '/admin/events/calendar', label: 'Calendar', icon: IconCalendar, roles: ['admin', 'editor', 'moderator'] },
+      // Phase 6, and the one row in this group that is NOT staff-wide. §K puts
+      // the switchboard in the same row as the world-changing actions it
+      // governs: what a deployment permits at all is configuration, not a read,
+      // and the server gates both the GET and the PUT on `admin`.
+      { to: '/admin/events/actions', label: 'Actions', icon: IconGear, roles: ['admin'] },
     ],
   },
   {
@@ -223,6 +228,7 @@ const TITLES = {
   '/admin/engagement/retention': 'Retention',
   '/admin/events': 'Events',
   '/admin/events/calendar': 'Event calendar',
+  '/admin/events/actions': 'Event actions',
   '/admin/events/new': 'New event',
 }
 

client/src/routes/admin/views/EventActions.jsx

@@ -0,0 +1,252 @@
+import { useCallback, useEffect, useState } from 'react'
+import { Loading, ErrorState } from '../../../components/PageState.jsx'
+import { api } from '../../../api/client.js'
+
+// Admin → Events → Actions — the deployment's switchboard (EVENTS.md §K, Phase 6).
+//
+// **This screen is the whole of the permission model beyond the role.** A module
+// declaring `uo.creature.spawn` is code the operator installed; it is not a
+// permission they granted. Enablement is the grant, and the cap is how much of
+// it — so this is the one screen in the feature where an operator decides what
+// the deployment *can do at all*, rather than what it is going to do tonight.
+//
+// **Nothing above `notify` and `inspect` arrives enabled.** Installing a module
+// must never start doing things, which is the posture a seeded engagement rule
+// already takes by arriving `enabled = 0`. The line falls between `inspect` and
+// `change` (org lead, 2026-09-03): an `inspect` action reads state and writes
+// nothing, so a deployment gains no risk by having it on, and `core.wait` — which
+// is `inspect` — arriving off would break every published event that waits.
+//
+// **A row with no stored setting is not "off".** It is "the default for its risk
+// class", computed on the server by the same function the runner asks. The screen
+// says which it is looking at, because "an admin turned this on" and "this has
+// always been on" are different facts and only one of them is a decision.
+//
+// **Admin only in both directions**, including the read: §K puts the switchboard
+// in the same row as the world-changing actions it governs, and knowing exactly
+// what a deployment permits is not a staff-wide read.
+
+const RISK_WORD = {
+  notify: 'Tells people something',
+  inspect: 'Reads the world',
+  change: 'Changes the world',
+  irreversible: 'Changes the world irreversibly',
+}
+
+const RISK_COLOR = {
+  notify: 'var(--muted)',
+  inspect: 'var(--muted)',
+  change: '#d9c184',
+  irreversible: '#d98b84',
+}
+
+const REVERSIBLE_WORD = {
+  none: 'nothing to undo',
+  self: 'undoes itself',
+  ledger: 'undone from the ledger at teardown',
+  override: 'restores a baseline',
+}
+
+export default function EventActions() {
+  const [actions, setActions] = useState([])
+  const [loading, setLoading] = useState(true)
+  const [error, setError] = useState(null)
+  const [busy, setBusy] = useState(null)
+  const [problem, setProblem] = useState(null)
+  const [notice, setNotice] = useState(null)
+  // Cap edits are held here until they are saved, keyed `actionId:dimension`.
+  // A cap is a number somebody types digit by digit, and writing on every
+  // keystroke would put "3" in the database on the way to "30".
+  const [drafts, setDrafts] = useState({})
+
+  const load = useCallback(async () => {
+    const data = await api.admin.eventActions()
+    setActions(data.actions || [])
+  }, [])
+
+  useEffect(() => {
+    let alive = true
+    ;(async () => {
+      setLoading(true)
+      try {
+        await load()
+        if (alive) setError(null)
+      } catch (err) {
+        if (alive) setError(err.message)
+      } finally {
+        if (alive) setLoading(false)
+      }
+    })()
+    return () => {
+      alive = false
+    }
+  }, [load])
+
+  /**
+   * Write one action's row.
+   *
+   * The whole row goes every time — the switch and every cap — because the route
+   * takes one action per request and a sparse write would have to decide what an
+   * omitted cap means. Here it can only mean one thing, so it is sent.
+   */
+  const save = async (action, { enabled = action.enabled, caps } = {}) => {
+    setBusy(action.id)
+    setProblem(null)
+    setNotice(null)
+    const nextCaps = caps !== undefined ? caps : capsOf(action)
+    try {
+      await api.admin.saveEventAction({ actionId: action.id, enabled, caps: nextCaps })
+      await load()
+      setDrafts((d) => {
+        const next = { ...d }
+        for (const dimension of action.dimensions) delete next[`${action.id}:${dimension}`]
+        return next
+      })
+      setNotice(`Saved ${action.label}.`)
+    } catch (err) {
+      setProblem(err.message)
+    } finally {
+      setBusy(null)
+    }
+  }
+
+  /** The caps this row would save: the drafts on top of what is stored. */
+  const capsOf = (action) => {
+    const out = {}
+    for (const dimension of action.dimensions) {
+      const draft = drafts[`${action.id}:${dimension}`]
+      const value = draft !== undefined ? draft : action.caps[dimension]
+      if (value === '' || value === undefined || value === null) continue
+      out[dimension] = Number(value)
+    }
+    return out
+  }
+
+  const capValue = (action, dimension) => {
+    const draft = drafts[`${action.id}:${dimension}`]
+    if (draft !== undefined) return draft
+    const stored = action.caps[dimension]
+    return stored === undefined || stored === null ? '' : String(stored)
+  }
+
+  const dirty = (action) =>
+    action.dimensions.some((d) => drafts[`${action.id}:${d}`] !== undefined)
+
+  if (loading) return <Loading />
+  if (error) return <ErrorState message={error} />
+
+  return (
+    <div>
+      <h2 className="sans" style={{ margin: '0 0 4px' }}>Event actions</h2>
+      <p className="sans dim" style={{ margin: '0 0 14px', fontSize: '0.85rem', maxWidth: '62ch' }}>
+        What this deployment permits an event to do, and how much of it per run. Anything that changes
+        the world arrives switched off — installing a module declares a verb, it does not grant
+        permission to use it. Caps are copied into a run when the run is created, so moving a switch
+        never changes what a run already in flight is allowed.
+      </p>
+
+      {problem && (
+        <div className="panel-flat" style={{ padding: 10, marginBottom: 12, borderLeft: '3px solid #d98b84' }}>
+          <span className="sans" style={{ fontSize: '0.85rem' }}>{problem}</span>
+        </div>
+      )}
+      {notice && (
+        <div className="panel-flat" style={{ padding: 10, marginBottom: 12, borderLeft: '3px solid #8fc79a' }}>
+          <span className="sans" style={{ fontSize: '0.85rem' }}>{notice}</span>
+        </div>
+      )}
+
+      {actions.length === 0 && (
+        <div className="panel-flat" style={{ padding: 14 }}>
+          <p className="sans dim" style={{ margin: 0, fontSize: '0.85rem' }}>
+            No module registers an event action. Core always declares its own three, so an empty list
+            here means the registry did not load.
+          </p>
+        </div>
+      )}
+
+      {actions.map((action) => (
+        <div
+          key={action.id}
+          className="panel-flat"
+          style={{
+            padding: 14,
+            marginBottom: 10,
+            borderLeft: `3px solid ${action.enabled ? RISK_COLOR[action.risk] || 'var(--rule)' : 'var(--rule)'}`,
+            opacity: action.enabled ? 1 : 0.75,
+          }}
+        >
+          <div style={{ display: 'flex', gap: 12, alignItems: 'flex-start', flexWrap: 'wrap' }}>
+            <div style={{ flex: '1 1 320px', minWidth: 0 }}>
+              <div style={{ display: 'flex', gap: 8, alignItems: 'baseline', flexWrap: 'wrap' }}>
+                <strong className="sans" style={{ fontSize: '0.95rem' }}>{action.label}</strong>
+                <code className="dim" style={{ fontSize: '0.78rem' }}>{action.id}</code>
+              </div>
+              {action.description && (
+                <p className="sans dim" style={{ margin: '4px 0 0', fontSize: '0.82rem' }}>{action.description}</p>
+              )}
+              <p className="sans dim" style={{ margin: '4px 0 0', fontSize: '0.78rem' }}>
+                <span style={{ color: RISK_COLOR[action.risk] }}>{RISK_WORD[action.risk] || action.risk}</span>
+                {' · '}
+                {REVERSIBLE_WORD[action.reversible] || action.reversible}
+                {/* Which of the two facts this is. A default is not a decision, and
+                    an operator auditing their own deployment needs to see the
+                    difference without reading the risk table in their head. */}
+                {' · '}
+                {action.configured
+                  ? `set by ${action.updatedBy || 'an administrator'}`
+                  : 'never configured — showing the default for its risk class'}
+              </p>
+            </div>
+
+            <label className="sans" style={{ display: 'flex', gap: 6, alignItems: 'center', fontSize: '0.85rem' }}>
+              <input
+                type="checkbox"
+                checked={action.enabled}
+                disabled={busy === action.id}
+                onChange={(e) => save(action, { enabled: e.target.checked })}
+              />
+              Enabled
+            </label>
+          </div>
+
+          {action.dimensions.length > 0 && (
+            <div style={{ marginTop: 10, paddingTop: 10, borderTop: '1px solid var(--rule)' }}>
+              <p className="sans dim" style={{ margin: '0 0 6px', fontSize: '0.78rem' }}>
+                Per-run caps. Blank is uncapped — the run still counts what it spends, nothing bounds
+                it. Where another enabled action spends the same thing, the tightest cap is the one a
+                run gets.
+              </p>
+              <div style={{ display: 'flex', gap: 10, flexWrap: 'wrap', alignItems: 'flex-end' }}>
+                {action.dimensions.map((dimension) => (
+                  <label key={dimension} className="sans" style={{ fontSize: '0.8rem' }}>
+                    <span className="dim" style={{ display: 'block', marginBottom: 2 }}>{dimension}</span>
+                    <input
+                      type="number"
+                      min="0"
+                      step="1"
+                      style={{ width: 110 }}
+                      value={capValue(action, dimension)}
+                      disabled={busy === action.id}
+                      onChange={(e) =>
+                        setDrafts((d) => ({ ...d, [`${action.id}:${dimension}`]: e.target.value }))
+                      }
+                    />
+                  </label>
+                ))}
+                <button
+                  type="button"
+                  className="btn"
+                  disabled={busy === action.id || !dirty(action)}
+                  onClick={() => save(action)}
+                >
+                  Save caps
+                </button>
+              </div>
+            </div>
+          )}
+        </div>
+      ))}
+    </div>
+  )
+}

client/src/routes/admin/views/EventEditor.jsx

@@ -59,6 +59,10 @@ export default function EventEditor() {
   const [problems, setProblems] = useState([])
   const [notice, setNotice] = useState(null)
   const [busy, setBusy] = useState(false)
+  // The dry run's answer (Phase 6). Cleared on every save and every publish,
+  // because a report is a statement about a spec and both of those change it —
+  // a stale green report beside an edited plan is worse than no report.
+  const [report, setReport] = useState(null)
 
   const isAdmin = user?.role === 'admin'
   // Reads here are staff-wide (§K), so a moderator reaches this screen legitimately
@@ -171,6 +175,9 @@ export default function EventEditor() {
     setBusy(true)
     setProblems([])
     setNotice(null)
+    // A report describes a spec, and saving changes it. A green report left
+    // standing beside an edited plan is worse than no report at all.
+    setReport(null)
     const built = payloadFromForm(form)
     if (!built.ok) {
       setProblems(built.errors)
@@ -200,6 +207,7 @@ export default function EventEditor() {
     setBusy(true)
     setProblems([])
     setNotice(null)
+    setReport(null)
     try {
       const result = await api.admin.publishEvent(id)
       setEvent(result.event)
@@ -218,6 +226,34 @@ export default function EventEditor() {
     }
   }
 
+  /**
+   * The dry run (Phase 6).
+   *
+   * `admin, editor` — it dispatches nothing. What it verifies follows the
+   * definition's state, and the server says which: a `ready` definition is
+   * checked against its PUBLISHED version, because that is the only thing that
+   * ever actually runs and it is that pass §K's gate is about; a draft is checked
+   * against the working spec the author is still holding.
+   *
+   * Findings arrive with a 200 — the request succeeded, the plan has problems —
+   * so they are rendered rather than thrown into the error box.
+   */
+  const verify = async () => {
+    setBusy(true)
+    setProblems([])
+    setNotice(null)
+    setReport(null)
+    try {
+      const result = await api.admin.verifyEvent(id)
+      setReport(result)
+      if (result.recorded) setEvent(await api.admin.getEvent(id).then((r) => r.event))
+    } catch (err) {
+      setProblems(err.body?.errors || [err.message])
+    } finally {
+      setBusy(false)
+    }
+  }
+
   const start = async () => {
     setBusy(true)
     setProblems([])
@@ -260,6 +296,14 @@ export default function EventEditor() {
               {isNew ? 'Create draft' : 'Save'}
             </button>
           )}
+          {/* The dry run is admin+editor, deliberately wider than publish: an
+              author should be able to find out what their event would cost
+              before asking an admin to commit the deployment to it. */}
+          {!isNew && mayAuthor && (
+            <button type="button" className="pill" style={{ fontSize: '0.74rem' }} disabled={busy || archived} onClick={verify}>
+              Dry run
+            </button>
+          )}
           {/* Publish and start are admin ONLY (§N2) and not the same gate as the
               live controls: publishing commits a definition a schedule will later
               start unattended. */}
@@ -291,6 +335,86 @@ export default function EventEditor() {
         </p>
       )}
 
+      {/* ── §K's gate, said where it can still be acted on ──
+          A published version that nobody has dry-run will not start on its
+          schedule. The alternative to saying so here is an operator finding out
+          on the Friday it did not run, so it is a banner rather than a log line —
+          and only for a definition that actually HAS a schedule to be held. */}
+      {!isNew && event?.state === 'ready' && !event?.currentVersionVerifiedAt && !archived && (
+        <div className="panel-flat" style={{ padding: '10px 14px', marginBottom: 14, borderLeft: '3px solid #d9c184' }}>
+          <p className="sans" style={{ margin: 0, fontSize: '0.84rem' }}>
+            <strong>This version has not been dry-run.</strong> Scheduled occurrences are held until it
+            is — an event that starts while nobody is watching gets one review, and this is it.
+            Starting it by hand is unaffected.
+          </p>
+        </div>
+      )}
+
+      {report && (
+        <div
+          className="panel-flat"
+          style={{
+            padding: '10px 14px',
+            marginBottom: 14,
+            borderLeft: `3px solid ${report.report.ok ? '#8fc79a' : '#d98b84'}`,
+          }}
+        >
+          <p className="sans" style={{ margin: '0 0 6px', fontSize: '0.84rem' }}>
+            <strong>
+              {report.report.ok ? 'Dry run passed' : 'Dry run found problems'}
+            </strong>{' '}
+            <span className="dim">
+              · {report.report.steps} step{report.report.steps === 1 ? '' : 's'} checked against{' '}
+              {/* Which spec was checked. The two answer different questions, and a
+                  report that did not say would be read as the other one. */}
+              {report.target === 'version' ? `published v${report.version}` : 'the working draft'}
+              {report.recorded && ' · recorded, so scheduled occurrences may now start'}
+            </span>
+          </p>
+
+          {report.report.findings.length > 0 && (
+            <ul className="sans" style={{ margin: '0 0 6px', paddingLeft: 18, fontSize: '0.82rem' }}>
+              {report.report.findings.map((f, i) => (
+                <li key={`${f.phase}-${f.seq}-${f.code}-${i}`} style={{ color: f.level === 'warning' ? '#d9c184' : undefined }}>
+                  {f.phase !== null && (
+                    <code className="dim" style={{ fontSize: '0.78rem' }}>
+                      {f.phase} · step {f.seq + 1}
+                      {f.actionId ? ` · ${f.actionId}` : ''}
+                    </code>
+                  )}
+                  {f.phase !== null && ' — '}
+                  {f.message}
+                </li>
+              ))}
+            </ul>
+          )}
+
+          {/* The whole-plan cost, which is the finding no other path can make: a
+              step that fits on its own and does not fit alongside its siblings. */}
+          {report.report.cost.length > 0 && (
+            <table className="sans" style={{ fontSize: '0.8rem', borderCollapse: 'collapse' }}>
+              <tbody>
+                {report.report.cost.map((c) => (
+                  <tr key={c.dimension} style={{ color: c.over ? '#d98b84' : undefined }}>
+                    <td style={{ paddingRight: 12 }}><code style={{ fontSize: '0.78rem' }}>{c.dimension}</code></td>
+                    <td style={{ paddingRight: 12 }}>{c.total}</td>
+                    <td className="dim">
+                      {c.cap === null ? 'no cap' : `of ${c.cap} per run${c.from ? ` (${c.from})` : ''}`}
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          )}
+
+          {report.report.findings.length === 0 && report.report.cost.length === 0 && (
+            <p className="sans dim" style={{ margin: 0, fontSize: '0.82rem' }}>
+              Nothing this event does costs a capped resource.
+            </p>
+          )}
+        </div>
+      )}
+
       {notice && <p className="sans" style={{ fontSize: '0.84rem', color: '#8fc79a' }}>{notice}</p>}
 
       {problems.length > 0 && (

client/src/routes/admin/views/EventRun.jsx

@@ -144,6 +144,10 @@ export default function EventRun() {
   const [steps, setSteps] = useState([])
   const [counts, setCounts] = useState({})
   const [gates, setGates] = useState([])
+  // The caps this run was given and what it has spent of them (Phase 6). Copied
+  // into the run when it was created, so this is what THIS run is allowed rather
+  // than what the switchboard says today.
+  const [budget, setBudget] = useState([])
   const [lines, setLines] = useState([])
   const [loading, setLoading] = useState(true)
   const [error, setError] = useState(null)
@@ -163,6 +167,7 @@ export default function EventRun() {
     setSteps(detail.steps || [])
     setCounts(detail.counts || {})
     setGates(detail.gates || [])
+    setBudget(detail.budget || [])
     setLines(log.log || [])
   }, [runId])
 
@@ -342,6 +347,59 @@ export default function EventRun() {
         </div>
       )}
 
+      {/* ── What this run is allowed, and what it has spent ──
+          A meter rather than a sentence: a cap is two numbers and a name, and
+          unlike a gate it needs no grammar rendered to be read. It is shown for
+          every run that has a budget at all, finished ones included — "how much
+          did last night's invasion actually spawn" is the same question asked
+          the morning after. */}
+      {budget.length > 0 && (
+        <div className="panel-flat" style={{ padding: 14, marginBottom: 14 }}>
+          <h3 className="sans" style={{ margin: '0 0 6px', fontSize: '0.92rem' }}>Caps</h3>
+          <table className="sans" style={{ fontSize: '0.82rem', borderCollapse: 'collapse', width: '100%' }}>
+            <tbody>
+              {budget.map((b) => {
+                const spent = b.cap === null ? 0 : Math.min(b.consumed / b.cap, 1)
+                const full = b.cap !== null && b.consumed >= b.cap
+                return (
+                  <tr key={b.dimension}>
+                    <td style={{ padding: '3px 12px 3px 0', whiteSpace: 'nowrap' }}>
+                      <code style={{ fontSize: '0.78rem' }}>{b.dimension}</code>
+                    </td>
+                    <td style={{ padding: '3px 12px 3px 0', whiteSpace: 'nowrap', color: full ? '#d9c184' : undefined }}>
+                      {b.cap === null ? `${b.consumed} spent` : `${b.consumed} of ${b.cap}`}
+                    </td>
+                    <td style={{ width: '100%', padding: '3px 0' }}>
+                      {b.cap === null ? (
+                        <span className="dim" style={{ fontSize: '0.78rem' }}>no cap</span>
+                      ) : (
+                        <span style={{ display: 'block', height: 6, background: 'var(--rule)', borderRadius: 3 }}>
+                          <span
+                            style={{
+                              display: 'block',
+                              height: 6,
+                              width: `${Math.round(spent * 100)}%`,
+                              background: full ? '#d9c184' : '#8fc79a',
+                              borderRadius: 3,
+                            }}
+                          />
+                        </span>
+                      )}
+                    </td>
+                    {/* Which switch set the number, so an operator can trace a cap
+                        back to a thing they can change rather than wondering
+                        where 30 came from. */}
+                    <td className="dim" style={{ padding: '3px 0 3px 12px', whiteSpace: 'nowrap', fontSize: '0.78rem' }}>
+                      {b.from || ''}
+                    </td>
+                  </tr>
+                )
+              })}
+            </tbody>
+          </table>
+        </div>
+      )}
+
       {/* ── Waiting on a person ── */}
       {parked.length > 0 && (
         <div className="panel-flat" style={{ padding: 14, marginBottom: 14, borderLeft: '3px solid #d9c184' }}>

client/test/eventAuthoring.test.js

@@ -11,6 +11,7 @@ import {
   blankStep,
   blankPhase,
   describeLogLine,
+  logKindWord,
   runStatusWord,
   describeSchedule,
   scheduleFormFrom,
@@ -557,3 +558,47 @@ test('the log renders Phase 5\'s three kinds, including the near miss', () => {
     /loot advanced on its deadline after 600s/,
   )
 })
+
+test("the log renders Phase 6's three kinds, and a refusal does not read as a failure", () => {
+  // The distinction the whole kind exists for. An operator scanning a stopped run
+  // has to be able to see that nothing is broken — the deployment simply does not
+  // permit what the author asked for — and the answer differs by cause: a switch
+  // for "not enabled", a number for "over the cap".
+  assert.match(
+    describeLogLine({
+      kind: 'step.refused',
+      detail: { action: 'uo.creature.spawn', error: 'asks for 12 of "uo.creatures"; 28 of 30 is already spent this run' },
+    }),
+    /uo\.creature\.spawn refused: asks for 12 of "uo\.creatures"; 28 of 30 is already spent this run/,
+  )
+  assert.match(
+    describeLogLine({
+      kind: 'step.refused',
+      detail: { action: 'uo.creature.spawn', error: '"Spawn creatures" is not enabled on this deployment' },
+    }),
+    /refused: "Spawn creatures" is not enabled/,
+  )
+  assert.equal(logKindWord('step.refused'), 'Refused')
+
+  // The caps a run was seeded with, and which switch set each — so a number on
+  // the meter can be traced back to something an operator can change.
+  assert.match(
+    describeLogLine({
+      kind: 'run.budget',
+      detail: { dimensions: [{ dimension: 'uo.creatures', cap: 30, from: 'uo.creature.spawn' }] },
+    }),
+    /uo\.creatures capped at 30 \(uo\.creature\.spawn\)/,
+  )
+  assert.match(
+    describeLogLine({ kind: 'run.budget', detail: { dimensions: [{ dimension: 'uo.gate.minutes', cap: null, from: null }] } }),
+    /uo\.gate\.minutes capped at nothing/,
+  )
+  // A run with no capped dimension at all still gets a sentence rather than an
+  // empty line, because an empty log entry reads as a bug.
+  assert.match(describeLogLine({ kind: 'run.budget', detail: { dimensions: [] } }), /no caps apply to this run/)
+
+  assert.match(
+    describeLogLine({ kind: 'version.verified', detail: { versionId: 4, version: 2, by: 1 } }),
+    /Version 2 passed its dry run — scheduled occurrences may start/,
+  )
+})