fix: cap automatic playout refreshes

tests/Web/playout-safety.test.cjs

@@ -158,6 +158,83 @@ test("A database refresh fault clears only after TAKE OUT resets refresh state",
   assert.equal(safety.shouldClearRefreshError(unrelated, false), false);
 });
 
+test("Refresh budget status requires a closed nonnegative maximum and native drain proof", () => {
+  assert.deepEqual(safety.normalizeRefreshBudget({}), {
+    completed: 0,
+    maximum: null,
+    limitReached: false
+  });
+  assert.deepEqual(safety.normalizeRefreshBudget({
+    refreshCompletedCount: 1,
+    refreshMaximumCount: 1,
+    refreshLimitReached: false
+  }), {
+    completed: 1,
+    maximum: 1,
+    limitReached: false
+  });
+  assert.deepEqual(safety.normalizeRefreshBudget({
+    refreshCompletedCount: 1,
+    refreshMaximumCount: 1,
+    refreshLimitReached: true,
+    refreshActive: false,
+    playCompletionPending: false,
+    refreshFaulted: false
+  }), {
+    completed: 1,
+    maximum: 1,
+    limitReached: true
+  });
+  assert.deepEqual(safety.normalizeRefreshBudget({
+    refreshCompletedCount: 2,
+    refreshMaximumCount: -1,
+    refreshLimitReached: true
+  }), {
+    completed: 2,
+    maximum: null,
+    limitReached: false
+  });
+  for (const contradiction of [
+    { refreshActive: true },
+    { playCompletionPending: true },
+    { refreshFaulted: true }
+  ]) {
+    assert.equal(safety.normalizeRefreshBudget({
+      refreshCompletedCount: 1,
+      refreshMaximumCount: 1,
+      refreshLimitReached: true,
+      ...contradiction
+    }).limitReached, false);
+  }
+  assert.equal(safety.normalizeRefreshBudget({
+    refreshCompletedCount: Number.MAX_SAFE_INTEGER,
+    refreshMaximumCount: 1000001,
+    refreshLimitReached: true
+  }).maximum, null);
+});
+
+test("Refresh budget labels distinguish active, callback-drained capped, fault and default states", () => {
+  assert.equal(safety.formatRefreshBudgetState({}), "STOPPED");
+  assert.equal(safety.formatRefreshBudgetState({
+    refreshActive: true,
+    refreshCompletedCount: 0,
+    refreshMaximumCount: 1
+  }, "18:00:00"), "ACTIVE · 0/1 · 18:00:00");
+  assert.equal(safety.formatRefreshBudgetState({
+    refreshCompletedCount: 1,
+    refreshMaximumCount: 1,
+    refreshLimitReached: true,
+    refreshActive: false,
+    playCompletionPending: false,
+    refreshFaulted: false
+  }), "CAPPED · 1/1");
+  assert.equal(safety.formatRefreshBudgetState({
+    refreshFaulted: true,
+    refreshCompletedCount: 1,
+    refreshMaximumCount: 1
+  }), "FAULT");
+});
+
 test("Database health snapshots accept only a strictly increasing native sequence", () => {
   assert.equal(safety.isNewerDatabaseStatusSequence(0, 1), true);
   assert.equal(safety.isNewerDatabaseStatusSequence(7, 8), true);