[shoedog]

Phase 1 of cost and quota governance (H1-2), lane G-A2.1. This adds the accounting contract and the single capture boundary. Production wiring of the decorator onto every dispatch path is lane G-A2.2.

Why one decorator: the first attempt (G-A) captured usage at each call site. Two reviews each found new uncovered paths: smoke, compatibility, MCP continuations, implement setup, compaction and preflight. That design was open-class, so the owner approved a redesign around one capture boundary.

What it adds

• Durable lifecycle:
  • an immutable attempt start is persisted before provider dispatch;
  • usage is persisted before it is forwarded, and completion before the terminal result is exposed;
  • duplicate completion is harmless;
  • interruption or failed completion persistence leaves durable pending accounting.
• The accounting backend decorator is the only usage capture point. Context-free prompt calls refuse instead of dispatching unaccounted. Lifecycle, capability, diagnostic and custody hooks are forwarded unchanged.
• The per-turn accounting envelope: execution/run-attempt identity, a distinct concrete-turn attempt ID, and the frozen effective model/effort/mode.
• Storage reuses G-A's summary contract and merge rules:
  • repeated snapshots never double-charge;
  • context occupancy never becomes consumed tokens;
  • missing or invalid cost is unknown, never zero.
• Store safety: the accounting database and SQLite sidecars are checked through retained directory-descriptor identity snapshots, and SQLite owns every open and close. Opening and closing a side descriptor would drop the process's POSIX fcntl locks and admit a conflicting writer. A multiprocess regression covers this.

Review: gpt-6.1-sol implemented; gpt-6-astra reviewed. Round history:

Round	Result
1	REJECT: interrupted turns were finalized as settled
2	REJECT: POSIX lock dropped by the identity check
3	Fix applied; APPROVE

Verify (macOS, touched crates bridge-core, bridge-store): fmt, clippy -D warnings and validate --repo-hygiene ok; 1,989 passed / 0 failed. The lock regression fails on the round-2 commit. Not covered locally: the rest of the workspace (CI is the full gate). No production activation, so there is no behavior change for existing runs.

🤖 Generated with Claude Code

https://claude.ai/code/session_017izEynabPeSUBT573AtvaZ

[shoedog]

Fixed the Windows job: UsageAllocationV1's identity fields are read only by the Unix descriptor checks, so on Windows they tripped -D dead-code. Added #[cfg_attr(not(unix), allow(dead_code))] on the struct. A local cross-check for Windows could not build the C dependencies (ring, libsqlite3-sys), so CI is the verification.