integrate: deterministic clearing, bounty and task C acceptance increments

[LIghtJUNction]

Serial integration scope

Refs #71, #72, #76, #78, #79, #82, #83, #85. Supersedes only the still-useful #71/#72 slices of stale #103; it deliberately does not restore #103's older #73 implementation.

Base: main@45fe2382c63d21eef2f76d4f59141111f7d5713c (merged #118).
Head source tree: 35db37c100474efee0c4cc6eb2a0588639ae6597.
The publication workflow reconstructed a SHA-256-pinned patch from that exact base and refused to push unless git write-tree exactly matched this tree.

Preserved current-main invariants

• Keep fix: recovery evidence, persistent restore quarantine and root rotation integrity (#68–70) #112/Task A: custody challenge binding, Root rotation locking and pinned deny-only recovery replay #116 persistent recovery quarantine and deny-only replay; deleting the config marker does not reactivate a restored snapshot.
• Keep current v3 order/delivery/arbitration implementation and fix: prevent mailbox parsing from expanding delivery recipients #117 singleton SMTP recipient validation.
• Keep current order-escrow internal authority fence and worker attempt/deadline completion fences.
• No operation-version reinterpretation, CA expansion, production bypass, skip/xfail, test allowlist or timeout increase.

Integrated implementation

• [P1] 确定性清算、银行边界、报价兑换与 Entitlement #71: deterministic integer clearing, named immutable ledger legs, account-scoped money authorization, two-confirmation local bank funding, Registry-backed hosting capacity entitlement, pending settle/refund lifecycle.
• [P1] Bounty 预托管与官方 PoP 奖励闭环 #72: prefunded bounty escrow, current IdentityKey/nonce/TTL PoP binding, atomic paid claim + receipt + event + inbox, pause/top-up/close consistency.
• [P2] Resource/Organization/ShareGrant 授权来源与撤权矩阵 #76/[P2] 读取、搜索、Sync 与纯路径协议补齐 #78/工具实际资源限制、耗尽与终止验证 #82 partial: live read integrity, Following pagination and revocation, signed CLI/TUI read entry, disconnect/malformed-response cleanup and no read side effects.
• [P2] 内容/文件编辑与 Revision 完整契约 #79 partial: CR/LF/CRLF-safe text patch line boundaries without rewriting historical Revision/signature bytes.
• [P2] Registry/规则源/配置与第15章逐项验收矩阵 #83/[P2] 跨模块代码质量与测试债：拆分长路径、统一不变量 #85: read-only evidence helpers, doctor/selftest wiring and sdist inclusion.

Recovery conflict repair

Two #103 recovery tests previously attempted to activate a restore by deleting recovery-drill.json. They now assert exact writes_paused / recovery_quarantined externally and independently compare restored claim/challenge/result/message/ledger/purchase/entitlement facts byte-for-byte/row-for-row. No production quarantine bypass was added.

Local focused evidence

Disposable Python 3.13.5 / PostgreSQL 17.11 UTF-8:

• test_market_71.py: 3 passed
• test_market_72.py: 5 passed
• test_market_redemption.py: 7 passed
• test_market_contracts.py: 12 passed
• compileall / diff-check passed.

These are not substitutes for the exact-head target gate. Merge requires fresh Python 3.15 / PostgreSQL 16 / Valkey 9 four-shard core CI, exact JUnit node-ID completeness/disjointness, conformance and wheel/sdist on this PR head.

No deployment, production Root/PIN/key/funding/recovery/deletion, or external delivery is included.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T10:21:24.467069Z	9254a9e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

串行审查注意到本PR只在money/offers入口接入account_requirements，当前main的market/orders.py和plugins/orders.py、delivery私有读取仍有requirements为空的操作。已有#83 B评论报告过t_store范围子密钥可orders.fund支出账户；本会话将以当前0c6ca7c固定源在独立分支补实际签名/真实DB回归并处理最小接线，不改本分支、不覆盖B草稿。特别核对幂等缓存重放前当前scope、orders.buy@1/@2/@3、quote/fund和buyer-only交付读取；授权账户可用的阳性对照必须保留。当前9254a9的CI被新head取消，不能以其无JUnit的产物当通过；新的最终head仍需完整gate。

[LIghtJUNction]

账户范围缺口已在精确 head 0c6ca7c / 真实 PostgreSQL 15.19 + Python3.13.5 隔离环境复现：校正 fixture 后14项测试全部因意外status=ok失败，涵盖orders.buy@1/@2/@3、create/fund、私有order/payment/contract/delivery/part_get、显式验收/claim和同一钥收缩scope后的缓存重放。并非普通money范围测试失败。

最小生产修复仅3文件：plugins/orders.py、plugins/delivery.py默认复用已有account_requirements；market/arbitration.py显式保留公开最小dispute_summary的no_requirements。无新schema/短码/DDL/权限旁路或worker修改。14项已转为通过，正在补公开摘要阳性、四协议/HEAD/缓存与其余市场回归。独立分支fix/market-account-scope-20260928，未写本PR或B分支。

已读本head的全量CI36409372805和Recovery36409372727为success，但这些既有测试未覆盖上述漏洞；请勿仅凭当前绿灯直接合并，待本窄补丁组合验证。随后保持唯一串行合并。

[LIghtJUNction]

Account-scope replay fix appended at exact head 976454b6e7a8021b917a46f72a4390069c6fcea5.

Refs #71, #76, #81, #83, #85.

Changes are limited to:

• bind existing account_requirements to orders/delivery OperationSpecs so current account scope is checked before idempotent cached results are returned;
• keep orders.dispute_summary explicitly public/minimal;
• add 25 regressions covering listing-scoped signing keys/tokens, same-request replay, live ceiling contraction, HTTP/PathGET/GraphQL/MCP HTTP, and positive account-scoped reads;
• include root/test Python+JSON fixtures in sdist so legacy migration tests reproduce from a clean source package.

Before remote publication, the added regressions reproduced 19 failures / 6 passes on the prior #119 production code. The fixed source package then passed the selected 206 tests with zero failures/errors/skips; the main-compatible variant passed 160 selected market tests. Wheel/sdist build and package-content checks also passed locally on Python 3.15.0rc2/PostgreSQL 17.11.

The prior #119 head 0c6ca7cf had both target workflows green. Merge is held for fresh exact-head GitHub CI on 976454b6; no production actions or quarantine bypass.