fix(quota): fence settlement by exact GoalRef

[Duang777]

Goal and delivered outcome

• Task anchor: Related to [Task][RFC]: Complete Goal lifetime fencing and governed orphan recovery #5206. [Task]: Semantic vocabulary convergence follow-ups after RFC PR #4433 / 语义词表收敛后续任务 #4447 tracks the broader carrier convergence and is not the acceptance source for this change.
• Problem: source-session quota accounting persisted only goal_id. A delayed Goal A request could spend, replay, repair, void, or read settlement state after the same alias had been recreated as Goal B.
• Result: the CLI and Turn paths capture the exact GoalRef. Python holds the run-index lock followed by the Goal lifecycle guard and hands both witnesses to the TypeScript accounting owner. TypeScript claims both witnesses, verifies require_current, and retains the owner fence through readback, receipt, artifact, and index operations.
• Current base and head: a7e6b826a -> 70c74576b.

Scope and continuation

• This change covers spend, exact-effect replay, prepared receipt repair, void target ownership, settlement identity inference, checkpoint commits, monitor and prior-Turn recovery, native-child receipts, and rolling-window accounting for source_session_v1.
• Readback now filters events and runs by the typed alias | exact_source owner before identity inference. Alias requests cannot consume exact rows. Exact requests verify the current source GoalRef under the same two-lock admission used by writes.
• Non-source requests retain legacy behavior and omit GoalRef fields.
• This qualifies only the quota_settlement inventory row. Unsupported providers and every other unqualified M3 owner remain blocked. The RFC activation hold and execution_authority: false remain unchanged.

Validation

• Behavior-suite revision: a23624c967785ffb7b3cee39c2052db08c0399ef
• Final DCO and merge-gate revision: 70c74576b38cd85bccff6418aae5169c1c57ca5e
• Run state: finished
• Input classes: synthetic

Check kind	Result	Evidence or limitation
unit	passed	npm run test:control-plane: 3,587 tests, 3,557 passed, 30 optional PostgreSQL tests skipped, 0 failed.
integration	passed	quota_settlement_readback.test.ts: 88 passed. Durable cases cover alias plus exact A, B inference with only A, delayed A after B publication using a distinct Turn ID, and legacy alias plus legacy rows.
integration	passed	Combined Python behavior suite: 279 passed. This includes 199 settlement compatibility cases, 34 exact checkpoint/native-child/external-delivery cases, 36 spend/void/rolling-window cases, and 10 inventory/census cases. The three former shard failures also pass on current main.
static	passed	At final head 70c74576b, TypeScript control-plane typecheck, the 260-site project-registry I/O manifest check, and 10 inventory/census tests passed. Ruff, docs governance, and git diff --check also passed for the feature diff.
premerge	passed	At final head 70c74576b, diff-driven standard premerge ran 5 direct checks and all 19 selected risk, smoke, and public-boundary checks.
repository_hygiene	baseline failure	The existing tests/test_contract_scan_missing_roots.py:46 private-IP fixture fails unchanged on the main baseline. This PR does not modify that file.

The three previously failing shard assertions pass on current main. This change does not qualify PostgreSQL quota storage or any external provider path.

See validation disclosure guidance.

Frontend / visual evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of change

• Bug fix
• New feature
• Breaking change
• Refactoring with no functional changes
• Documentation update
• Test update

LoopX area

• Control plane: goals, todos, quota, scheduler, registry, runtime
• Benchmark boundary: adapters, runners, verifiers, scoring, evidence
• Capability or extension: native-child receipt projection
• Public docs or presentation surface: RFC and inventory
• Build, packaging, installer, or CI
• Host or runtime integration

Technical direction

• Acceptance reference: Shared Goal Authority and cross-host coordination, M3 quota_settlement owner qualification.

Shared-authority RFC fixture impact

• Source-session quota records, events, index rows, receipts, and response payloads carry the exact GoalRef. Lock witnesses remain transport-only and never persist.
• Covered dimensions include same-alias Goal A to Goal B recreation, delayed stale reads and writes, exact replay and repair, exact void ownership, pre-inference readback isolation, checkpoint integration, and legacy parity.
• Provider coverage includes the source-session file profile and the non-source legacy path. PostgreSQL quota storage is outside this owner and remains unqualified.

Boundary checklist

• The diff, PR body, comments, and attachments contain no private state, credentials, raw traces, verifier output, internal links, or local machine paths.
• I did not duplicate maintainer-owned benchmark work.
• I kept the change scoped to [Task][RFC]: Complete Goal lifetime fencing and governed orphan recovery #5206.
• UI impact is none.
• Every authored commit includes a DCO Signed-off-by trailer.

[Duang777]

CI attribution update for head 377952efe:

• The direct, TypeScript, Windows, Stage 2C, PostgreSQL, DCO, and packaging checks passed.
• Shard 3 failed test_new_independent_twin_cannot_hide_behind_generated_pair plus one test_live_decision_adds_only_existing_required_read_channel parameter.
• Shard 4 failed the other parameter of test_live_decision_adds_only_existing_required_read_channel.
• pytest and merge-gate only propagate those shard failures.

I replayed all three tests in an isolated worktree at current origin/main@996bcc027; the same three assertions fail there. The two commits added after this PR opened do not touch these tests or their owners. I am keeping the quota branch unchanged while checking for an existing baseline repair, so unrelated baseline work does not enter this PR.

[Duang777]

Baseline dependency follow-up:

• Existing draft PR perf(authority): copy journal JSON without repeated primitive allocation #5251 contains signed test-only commit 106b923a57c60d411dba9276c37d1f927e0023bc, which updates the two stale CI guards behind this PR's three failures.
• I applied only that commit to an isolated origin/main@996bcc027 worktree and ran the affected tests. Result: 3 passed in 6.74s.
• The quota branch remains unchanged. I will sync it once the baseline repair reaches main, avoiding unrelated test changes in this PR.

Reference: #5251

[Duang777]

The verified baseline repair is now isolated in #5344. It preserves the original author, contains only the two test files from 106b923a5, and passes the full affected files (38 passed) plus Ruff. I will sync this quota branch after #5344 reaches main.

[cocolord]

评审提交：377952efe6311b5eefecf32a80316e17f773e2fe。这是 policy-11 whole-PR、exact-head 评审。我检查了全部 26 个文件，沿着 CLI／Turn → Python admission → TypeScript owner → spend／void transaction → receipt／index → settlement readback／rolling window 走完正负路径，并独立运行了 focused tests、静态检查、base/head 失败归因和两个 readback 反例。写侧设计明显正向，但 readback 仍有可复现的跨实例缺口，因此不能 approve。

动机

这个改动解决的是明确且高价值的问题：同一个 goal_id 被重建后，旧 Goal A 的延迟 quota spend、replay、repair、void 或 settlement 证据不能落到新 Goal B。PR 给出的 before/after 可观察收益是成立的——写侧现在会在当前 GoalRef 和双锁 witness 不匹配时先拒绝，再把 B 的 GoalRef 写入 record、quota event、index row、transaction receipt 和响应；rolling-window 也按实例隔离。这里不是“为了抽象而抽象”，而是修复 append-only accounting 可能跨生命周期归属的 correctness boundary。

不过当前实现只完整关闭了 mutation/replay/void，未关闭 readback 和 inferred recovery。PR 正文与 RFC 宣称 quota_settlement 已 exact-owned／M3-qualified，比可执行行为更强；这个差距本身就是 blocker。另请把 Related to #4447 改为真正承载 Goal-instance／quota-owner 验收的 issue，或明确解释依赖关系：#4447 是 semantic vocabulary convergence tracker，不能单独作为这 1,981 行机制与 M3 qualification 的收益/验收来源。

改动思路

入口层在 quota spend-slot、void-slot 和 turn run-once 捕获 source-session 当前 GoalRef。quota_accounting_admission 按 run-index → source guard 顺序持锁并生成两个 cross-runtime witness；parseQuotaAccountingOwner 校验 GoalRef、profile、路径和 witness，withQuotaAccountingOwner claim 两把锁并调用既有 decideFirstPartyHostRuntime(require_current)。因此 stale A 在写入前失败，B 的 transaction owner 能覆盖 replay、prepared repair、void target 和最终 artifact commit。

accounting_artifact_transaction 把 GoalRef 纳入 request digest、receipt 校验、effect identity 冲突和所有持久 projection；goal_quota_with_spend_ledger 则让 current exact instance 只累计自己的行。这个方向复用了现有 first-party host 和 artifact transaction owner，机制成本虽大但与高严重度一致。问题出在 settlement_readback：它没有复用上述 owner，只接受一个 nullable goal_ref，且直到 identity 已解析后才在 findSpend 上做可选比较。

具体改动

阻塞问题

1. [P1] 请在 identity inference 之前把 settlement readback 纳入 current exact-owner fence。 findSpend 的 goalRef === null || ... 让 alias-only／未更新 caller 把任意 exact-source row 当作自己的；传入 GoalRef 时，也只比较持久行与请求值，不读取 registry、不 claim source guard、也不验证该 GoalRef 仍是 current。更早的 resolveIdentity／inferPersistedIdentity 完全看不到 GoalRef，会先从同 alias 的所有 run 中选 Turn。独立 exact-head 反例得到两个错误结果：一是无 GoalRef 请求直接返回 A 的 exact spend_run；二是当前 B 的 infer_turn_instance_id 请求在只有 A 记录时仍返回 found=true，并选中 A 的 Turn 后报告 spend_required。后者可让下游把 A 的 settlement tuple 带进一个由 B admission 合法通过、最终却 stamp 为 B 的新 spend。

最小修复应让 readback 使用与 spend/replay/void 相同的 typed alias/exact owner：source 请求在 guard 下验证 current GoalRef；alias 请求不能消费带 GoalRef 的记录；并在 resolveIdentity／inferPersistedIdentity 选择候选前应用 owner，而不是只过滤最终 spend row。请审计所有生产 read_heartbeat_settlement caller——当前 refresh-state、Todo completion、live decision、checkpoint、reward-memory、native-child 等多条路径仍未传 GoalRef。补四个 durable case：无 GoalRef + exact A、B inference + 仅 A、B 发布后 delayed A read、legacy alias + legacy row；前三者 fail closed／not found，最后一个保持原行为。完成前不要把 inventory 标为 m3_qualified。

关键代码讲解

• quota_accounting_admission 是 Python 锁顺序与 witness 生产者；source 必须有 exact GoalRef，legacy 保留原 index-lock 行为。
• withQuotaAccountingOwner 是 TypeScript 写侧 authority owner；它校验并 claim 两个 witness，在 require_current 通过后才执行 transaction，finally 中按逆序释放。
• commitQuotaAccountingArtifactTransaction 把 GoalRef 纳入 existing receipt、effect row、prepared repair 和四类 projection 的一致性检查，避免同 effect id 跨实例重放。
• evaluateQuotaSpendCommit／evaluateQuotaVoidCommit 在同一 owner 下完成 lookup、target validation 和 commit；legacy wire-shape tests 证明未携带 GoalRef 的记录不新增字段。
• readQuotaSettlementFromRequest 目前仅把 request.goal_ref 传给 findSpend；它没有 current authority，也没有在 identity/event 候选阶段做 owner 隔离，这是 whole-PR 中唯一但关键的断口。

对主干的风险

独立验证结果：提交内 130 个 TypeScript quota tests、36 个 Python spend／void／rolling-window tests、10 个 owner-inventory／registry-census tests全部通过；TypeScript typecheck、Ruff 和 git diff --check 通过。GitHub 红项是 test-shard (3)、test-shard (4)，聚合 pytest 和 merge-gate 随之失败；我在 immutable base 3ec049e138917a8cce4f84197ba196d26445b2b0 与 exact head 上重跑同三个 assertion，均为相同失败，因此不把它们归因于本 PR，也不把这点当作功能正确性的替代证据。

真正的主干风险是 silent scope escape：readback 不报 conflict，而是给出看似正常的 found／settled／spend_required。这会影响 quota 自身，也会影响消费 readback 的恢复、Todo、checkpoint 与 live-decision 路径。现有 submitted readback test 只覆盖“显式 A 匹配、显式 B 不匹配”，所以 130/130 仍无法捕捉 null-owner 和 pre-inference 两个反例。

代码量方面，26 文件共 +1,981/-176，其中约 980 行 production、946 行 tests；对高风险跨语言持久化 race 来说，测试占比和机制总体可接受。最高价值的收敛不是再加新层，而是让 readback 复用已经引入的 QuotaAccountingOwner，避免写侧 typed union、读侧 nullable wildcard 两套权威。domain wording 保持 Goal／Turn／quota 中性；没有把 advisory 当 obligation，但 RFC／inventory 的“qualified”是机器与 rollout 声明，必须等负路径真实通过。

语义与 CI 对齐

写侧的 alias | exact_source union、goal_instance_conflict 与 require_current 一致；readback 的 JsonObject | null 则把“legacy owner”与“未提供过滤条件”混为一类。CI 和 inventory tests 只验证声明结构与现有 positive cases，无法证明 scope 完整。应先把 readback 的状态规则对齐，再保留 exact_goal_ref_enforced／m3_qualified 声明。

我的整体评价

结论是 REQUEST_CHANGES。这项需求本身有清晰收益，写侧实现和大部分验证也值得保留；若只看 stale write、replay、repair、void 与 rolling-window，我会认为方向明显正向。当前不能 approve 的原因不是泛泛要求更多测试，而是核心承诺中的 readback/inference 有两个可复现反例，并且 inventory 已提前宣称 whole owner qualified。

请先让 readback 共享 current exact-owner 边界，补齐上述四个正反例，并修正或解释实际 task anchor。修复后重跑 130 TS quota、36 Python quota、owner inventory/census、typecheck、Ruff，以及这两个 reviewer counterexample；若 exact head 不再跨实例且 legacy parity 保持，我愿意重新审查。本次 review 不修改 PR，也不授权 merge。

English verdict: REQUEST_CHANGES on exact head 377952efe6311b5eefecf32a80316e17f773e2fe. The exact GoalRef write/replay/repair/void fence is a valuable and mostly well-tested improvement, and the current CI shard failures reproduce unchanged on the exact base. However, settlement readback still treats a missing GoalRef as a wildcard and applies GoalRef only after identity inference, so an unscoped caller can consume an exact A row and Goal B can infer Goal A's persisted Turn. Reuse the typed current-owner boundary for readback, add the negative cases, and keep quota_settlement unqualified until they pass.

[cocolord]

[P1] goalRef === null currently matches every spend row, including exact-source rows. Because resolveIdentity / inferPersistedIdentity run before this filter and the request carries no source-authority proof, an alias-only caller can consume Goal A state and current Goal B can select Goal A’s persisted Turn identity. Please reuse a typed alias/exact quota owner for readback, validate current source authority before inference, filter every identity/event candidate by that owner, and audit production callers that still omit GoalRef. Add durable cases for alias + exact A, B inference + only A, delayed A after B publication, and legacy alias + legacy row before retaining the m3_qualified claim.

[Duang777]

Addressed in ec7f51aaf on top of origin/main@0644abaaa.

• settlement_readback now decodes the same typed alias | exact_source owner used by spend, replay, repair, and void.
• It filters every event and run candidate before resolveIdentity and inferPersistedIdentity. Alias requests accept only legacy rows with no GoalRef.
• Exact reads claim both admission witnesses and verify require_current; nested checkpoint, refresh-state, native-child, monitor, and prior-Turn recovery paths use borrowed or already-adopted admission without releasing the enclosing transaction.
• I audited all 19 production read_heartbeat_settlement calls. Every source-aware call now carries both registry_path and goal_ref; already-locked callers also carry source_admission.
• The durable counterexamples now prove: alias plus exact A fails closed with receipt_missing and no spend row; current B plus only A returns found=false; delayed A with a distinct Turn ID cannot replace current B inference; legacy alias plus legacy rows still settles.
• The exact checkpoint test replaces A with B after context capture and confirms that A cannot append a checkpoint.

Validation at this head: full TypeScript 3,587 total, 3,557 passed, 30 optional PostgreSQL skipped; focused readback 88 passed; Python settlement compatibility 199 passed; exact checkpoint/native-child/external-delivery 34 passed; spend/void/rolling-window 36 passed; inventory/census 10 passed; typecheck, Ruff, docs governance, and the 260-site manifest check passed.

The PR body now uses #5206 as the task anchor. The only selected premerge failure reproduces unchanged on clean origin/main@0644abaaa (interaction-contract-state-machine-smoke.py), as does the separate repository-hygiene fixture finding.

[Duang777]

#5344 also picked up the separate signed test-only fix e4e754982 after its first CI run reproduced the existing Host marker partial-write race. The Host process test passes on Node 22 and passed 10 consecutive reruns locally. The quota branch remains unchanged.

[mergify]

Hi @Duang777, the DCO Sign-off check did not pass. Please inspect
its details first: checkout, fetch, timeout or infrastructure errors
need their own recovery, not a rewrite of otherwise signed commits.

If the log confirms a missing Signed-off-by trailer, amend the
affected commit with git commit --amend -s; for multiple commits,
use an interactive rebase against the current base from the correct
base-repository remote and sign off each affected commit. Push the
rewritten PR branch with git push --force-with-lease origin HEAD.

[Duang777]

Exact-head update: merged origin/main@21f89e4ad into the branch. The main update included the required-read smoke correction and the auxiliary-monitor replan guard. Both compose cleanly with this PR's GoalRef CLI propagation. Current head is a23624c96.

Exact-head validation now passes: full TypeScript 3,587 total, 3,557 passed, and 30 optional PostgreSQL skipped; combined Python target suite 279 passed; TypeScript typecheck; Ruff; docs governance; 260-site manifest check; and diff-driven standard premerge with 5 direct checks plus 19 of 19 selected checks.

The separate repository-hygiene private_ip fixture remains an unchanged main baseline finding. #5344 remains the dependency for the unrelated shard assertions identified earlier. Re-review is requested from cocolord and huangruiteng.

[mergify]

Hi @Duang777, the DCO Sign-off check did not pass. Please inspect
its details first: checkout, fetch, timeout or infrastructure errors
need their own recovery, not a rewrite of otherwise signed commits.

If the log confirms a missing Signed-off-by trailer, amend the
affected commit with git commit --amend -s; for multiple commits,
use an interactive rebase against the current base from the correct
base-repository remote and sign off each affected commit. Push the
rewritten PR branch with git push --force-with-lease origin HEAD.

[Duang777]

DCO history correction completed with the approved --force-with-lease update.

The PR now contains one authored contribution commit, 2d82f938e, with a valid Signed-off-by trailer. GitHub then updated the branch to current main with verified merge commit 70c74576b; its committer is web-flow, verification is valid, and its parents are the signed contribution plus origin/main@a7e6b826a.

Final-head local gates pass: TypeScript typecheck, the 260-site manifest check, 10 inventory/census tests, and standard premerge with 5 direct checks plus 19 of 19 selected checks. The three previous shard assertions now pass on current main, so #5344 is no longer a dependency for this PR.

[Duang777]

CI follow-up for head 7026e4638:

• kernel-static-checks exposed a real dependency-boundary regression from this PR. loopx/control_plane/quota/effect_program.py is one of the 19 strict mypy roots; importing source_session_registry_state from it expanded the checked import graph and surfaced 4,248 unrelated baseline errors.
• The fix moves the pure GoalRef validation into goal_instance_identity.py. source_session_registry_state keeps its existing exports, while the settlement-plan root imports only the lightweight identity module.
• Local verification now passes with mypy (Success: no issues found in 19 source files), Ruff, git diff --check, and 124 focused Python tests.
• The prior Windows failure was a one-off runtime-termination race in an unchanged test. The exact parent a7e6b826a passed the same Windows job, including that lifecycle step. This push will rerun it on the new head.

The commit is signed off and was pushed without rewriting history.