fix(quota): fence settlement by exact GoalRef

[Duang777]

Goal And Delivered Outcome

• Outcome basis / optional anchor: Related to [Task][RFC]: Complete Goal lifetime fencing and governed orphan recovery #5206. This clean PR replaces fix(quota): fence settlement by exact GoalRef #5340 without rewriting or force-pushing its published history.
• Goal/source and gap: source-session quota accounting persisted only goal_id. After an alias was recreated, delayed work from Goal A could spend, replay, repair, void, or read settlement state as Goal B.
• Observable before -> after, with the validation row that proves it: quota ownership now uses the typed alias | exact_source owner. Exact-source writes require the current GoalRef under the run-index and Goal lifecycle locks, and settlement readback filters by owner before identity inference.
• Issue/task and intended base: Related to [Task][RFC]: Complete Goal lifetime fencing and governed orphan recovery #5206; based on main@f49b4a00870604d39fa4318da24d6dd35e72bb6e.

Clean replacement proof

• Replaced exact head: 71d009d8ff1c03197752b7dacbcf3fce3a666319 from fix(quota): fence settlement by exact GoalRef #5340.
• Replacement head: f2b154547671d0cb9230cb371ab99b49846a30eb.
• Both commits have tree a451f7a95aad8b29a918b8de56f607ee12ac60ff; the 78-file content is unchanged.
• The replacement range contains one authored commit with a valid Signed-off-by trailer.
• The exact-head maintainer review found the runtime fixes supported and blocked only the older manual merge cf8218d5f, which lacked DCO certification.
• The R1-R3 validation record and DCO diagnosis remain attached to fix(quota): fence settlement by exact GoalRef #5340.

Scope And Continuation

• Completed scope and remaining work: this change covers spend, exact-effect replay, prepared receipt repair, void target ownership, settlement identity inference, checkpoint commits, monitor and prior-Turn recovery, native-child receipts, and rolling-window accounting for source_session_v1.
• Slice boundary / successor: this qualifies only the quota_settlement inventory row. Unsupported providers and other unqualified M3 owners remain blocked. The RFC activation hold and execution_authority: false remain unchanged.

Validation

• Tested revision: f2b154547671d0cb9230cb371ab99b49846a30eb; its tree is identical to the previously tested exact head 71d009d8ff1c03197752b7dacbcf3fce3a666319.
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
static	passed	The old and replacement heads resolve to the same tree; the replacement contains one commit over the stated base, has a valid DCO trailer, and passes git diff --check.
unit	passed	On the identical tree: 118 focused Python CLI tests and 43 slot-accounting/inventory tests passed.
integration	passed	On the identical tree: 134 auxiliary-monitor/readback TypeScript tests passed, including mixed-owner readback and borrowed-admission paths.
static	passed	TypeScript typecheck, configured mypy over 19 roots, and CI-scope Ruff passed on the identical tree.
real_entrypoint	passed	Standard premerge selected 19 checks and all 19 passed on the identical tree.

• Coverage and gaps: the checks cover the R1 owner-filtering, R2 parsed-owner reuse, R3 multi-phase borrowed admission, CLI propagation, and inventory wording changed at the exact tree. Required GitHub CI will rerun on this replacement commit. PostgreSQL quota storage, unsupported providers, and source-profile activation remain outside this slice.

See validation disclosure guidance.

Frontend / Visual Evidence

• UI impact: none
• Before: N/A
• After: N/A
• States and viewports shown: N/A
• Source data: none
• Attention review: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable: Shared Goal Authority and cross-host coordination, M3 quota_settlement owner qualification.

Shared-authority RFC fixture impact

• Production-scale fixture schema: source-session quota records, events, index rows, receipts, and response payloads carry the exact GoalRef. Lock witnesses remain transport-only.
• Semantic dimensions changed, or reviewed no-impact rationale: covers same-alias Goal A to Goal B recreation, delayed stale reads and writes, exact replay and repair, exact void ownership, pre-inference readback isolation, checkpoint integration, and legacy parity.
• Provider conformance arms run: source-session file profile and non-source legacy path.
• Read-only legacy/file/PostgreSQL three-arm rehearsal (required for promotion, runtime-routing, or compatibility-projection changes): not applicable to this candidate qualification. PostgreSQL quota storage remains unqualified and source-profile activation remains disabled.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).

[Duang777]

CI attribution for exact head f2b154547671d0cb9230cb371ab99b49846a30eb after run 36809727068 completed:

• typescript-core (1/3) failed only content_digest_single_owner.test.ts because control_plane/work_items/task_lease_workspace.ts:26 still contains the duplicate /^[a-f0-9]{64}$/u matcher. fix(control-plane): reuse canonical lease digest matcher #5377 fixes this current-main defect.
• test-shard (1) failed two current-main cases: the source usage notice still expects version 4 instead of 5, fixed by test(usage): align source disclosure notice version #5379; the runtime source-churn request returned runtime_exited_before_ready instead of packaged_runtime_source_unstable, fixed by fix(runtime): reject stale batched source fingerprints #5367.
• test-shard (4) failed two more runtime snapshot cases: the old implementation did not rescan after a snapshotted file disappeared and reported ready during persistent source churn. fix(runtime): reject stale batched source fingerprints #5367 fixes both.
• checks, pytest, and merge-gate failed only because those direct jobs failed. typescript-coverage and sonar were skipped as downstream jobs.

No #5389-owned failure was found. A detached integration of exact heads #5377, #5379, #5375, and #5367 on the same base passed the focused Python suite (35 tests) and digest-owner TypeScript suite (17 tests). After those baseline fixes reach main, #5389 can be synced normally and rerun. No merge action was taken.

[Duang777]

Exact-head update for f5f04c30a43c5917f554910b3db427ec451421c4:

• Synced with main@638d0e39cff09948df1816a4a5c5ccce70262c57 through a conflict-free merge commit with Signed-off-by; no history was rewritten.
• The prior current-main failures are now repaired on main by fix(runtime): reject stale batched source fingerprints #5367, fix(control-plane): reuse canonical lease digest matcher #5377, test(usage): align source disclosure notice version #5379, and fix(control-plane): remove duplicate lease digest import #5391.
• Focused validation passed: 116 Python tests and 201 TypeScript tests.
• Control-plane TypeScript typecheck, Ruff, and git diff --check passed.

Fresh CI is running on this exact head. @cocolord @huangruiteng please re-review when available. No merge action was taken.

[Duang777]

Exact-head update for a931649233afe6c9d976ad87d0dbc22913492675:

• Synced through signed-off, conflict-free merge commits with current main@3ad3269af4d2cfae2085693823dcfcda522f9a2b; no history was rewritten.
• Focused validation after fix(operations): allow admitted prepare with a registered source audience #5378 passed: 133 Python tests with 2 skips, 213 TypeScript tests, control-plane TypeScript typecheck, Ruff, and git diff --check.
• After test(host): publish process markers atomically #5365 entered main, the affected Host/Codex CLI suite passed again: 65 passed, 2 skipped.

Exact-head CI run 36825859844 completed with 21 successful jobs, 2 optional skips, and 2 related failures. Every direct Python and TypeScript test job passed. The pytest coverage aggregate failed because test_cli_inspects_disjoint_index_and_worktree_values left a temporary /tmp/.../loopx/a.py source path in coverage data after pytest removed the synthetic checkout; merge-gate then failed only as the aggregate result.

#5375 removes the inherited pytest-cov environment from that synthetic subprocess, and its exact-head CI run 36825867638 passed all 24 jobs with no failures. No #5389-owned fix is needed. After #5375 lands, this branch should sync current main and rerun CI. No merge action was taken.

[Duang777]

Exact-head update for b716a72360666f8e6913ffb62037bb89735ee76f on main@c7c98146f5e2c06e95fb744eda0feb6ef66e0514:

• Synced through a conflict-free, signed-off merge commit; no history was rewritten.
• The expanded Python verification passed: 370 tests, including quota action, effect-runtime, and Turn journal coverage from current main.
• 306 focused TypeScript tests, control-plane typecheck, targeted Ruff, and git diff --check passed.
• The untracked uv.lock was not modified or staged.

Fresh exact-head CI is starting. No merge action was taken.