[rbartoli]

This is steal (7) from the 2026-10-23 competitor check (internal note, Q3).

At the plan-window threshold where new agents are refused (AGENT_GUARD_LIMIT_DENY_PERCENT, 95%), ScheduleWakeup and CronCreate are now refused too. Each starts a turn later with nobody there, and that turn runs into the limit. The refusal names the window, its percentage and its reset, and goes through the denial ladder (rule schedule). It doesn't feed the agent fuse.

• A new core scheduleGate() in core/tools.ts reads plan readings from every session, through highestLimit. The adapter loads peers only for those two tools, so other tool calls don't read the store.
• /agent-guard allow and allow agents lift it, like the agent rules.
• Other tools run as before.

This pairs with #47, which runs fired scheduled prompts through the prompt gate.

Test plan

• New tests: from 95%, ScheduleWakeup and CronCreate are refused with the reason and journaled as schedule, while Read runs; below 95% a wakeup runs; allow agents lifts the hold
• claude plugin test . on 2.1.310: 105 pass. With the code stashed, the refusal test fails.
• claude plugin validate . --strict and tsc are clean
• CI is green