docs(usage): document usage monitor & gate across CLAUDE.md files

Add a dedicated Usage Monitor & Gate section to Worker CLAUDE.md, wire
UsagePillViewModel/UsageMonitorModalViewModel and the new IWorkerClient
usage surface into Ui CLAUDE.md, and record open verification points
for the pill/modal visual pass and the real gate E2E in docs/open.md.
Data CLAUDE.md already covered the new entity columns and migration.

src/ClaudeDo.Worker/CLAUDE.md

@@ -60,6 +60,25 @@ Interfaces (e.g. `IQueueWaker`, `IPrimeClock`, `ITaskStateService`) live in an `
 - Each stdout line is streamed to the UI via `IPrimeBroadcaster.PrepLineAsync` AND written to `DailyPrepPrompt.LogPath()` = `<appdata>/logs/daily-prep.log` (truncated at the start of each run → last run only). `PrepStarted`/`PrepFinished` events bracket the run.
 - Agentic behaviour: Claude calls `get_daily_prep_candidates`, picks an effort-aware subset capped at `DailyPrepMaxTasks`, and marks them via `set_my_day` (which broadcasts `TaskUpdated` so the UI updates live).
 
+## Usage Monitor & Gate
+
+Source: `GET https://api.anthropic.com/api/oauth/usage`, an **undocumented** Anthropic API,
+authenticated with the Bearer access token Claude Code itself keeps fresh at
+`~/.claude/.credentials.json` — ClaudeDo reads that token but never refreshes it and never
+logs it. `UsageMonitorService` polls on `usage_poll_interval_seconds` (default 60s, one poll
+at startup too) and broadcasts `HubBroadcaster.UsageUpdated` after every tick.
+
+The gate (`IUsageGate`, thresholds `usage_gate_five_hour_pct`/`usage_gate_seven_day_pct`)
+pauses **only** the queue's slot-fill loop (new tasks don't start) once `five_hour >=
+usage_gate_five_hour_pct` or `seven_day >= usage_gate_seven_day_pct`; already-running runs,
+and `RunNow`/`ContinueTask`/interactive ConPTY/planning sessions/daily-prep all bypass the
+queue and are unaffected. **Fail-open**: no snapshot yet, a failed last poll, or an
+app-settings read error all resolve to not-blocked, so an outage of the (undocumented, can
+change without notice) usage endpoint never blocks work. There's no persistent pause state —
+recovery is just the queue's 30s backstop timer re-evaluating the gate on its own once usage
+drops back under the threshold. See `Usage/` in the folder layout above for the component
+breakdown.
+
 ## Status Model
 
 `TaskEntity` carries three orthogonal fields. Lifecycle, planning hierarchy, and chain blocking are no longer conflated.