Complete autonomous recovery controls

internal/router/router_test.go

@@ -184,7 +184,9 @@ func TestQuotaWindowsAreIndependent(t *testing.T) {
 	}
 
 	// Case 2: only a 5h limit configured. The same 6h-old receipt is outside
-	// the 5h window and must not count.
+	// the 5h window and must not count; a fresh zero receipt proves the native
+	// usage source is known for this window.
+	report(now, 0)
 	fiveHourOnly := QuotaAvailability{Store: s, Limits: map[string]QuotaWindowLimits{"h1": {FiveHour: 100}}, Now: func() time.Time { return now }}
 	if !fiveHourOnly.Available(registry.Herdr{ID: "h1"}) {
 		t.Fatal("receipt outside the 5h window incorrectly counted against it")
@@ -198,4 +200,8 @@ func TestQuotaWindowsAreIndependent(t *testing.T) {
 	if both.Available(registry.Herdr{ID: "h1"}) {
 		t.Fatal("5h window should be exhausted at 90/100 (>=80%) regardless of weekly headroom")
 	}
+	unknown := QuotaAvailability{Store: s, Limits: map[string]QuotaWindowLimits{"unknown": {FiveHour: 100}}, Now: func() time.Time { return now }}
+	if unknown.Available(registry.Herdr{ID: "unknown"}) {
+		t.Fatal("bounded harness without a native usage receipt must fail closed")
+	}
 }