[ranxi2001]

Scope and acceptance

One Draft PR for authorized source repairs F1–F4. Not ready to merge.

• F1 durable immutable usage staging, transactional debit/dedup/quote/usage receipt, recovery without model retries; checked auth cache invalidation. Exact-head remote regression and independent acceptance pending.
• F2 durable replayable platform-limit projections, Redis MISS/error handling, concurrent cache refill, exact reset cutoffs and ordinary/regional window handoff. Final independent and remote acceptance pending.
• F3 eight-place money, individually owned holds, mutually exclusive capture/release, exact read-only legacy committed receipt confirmation. Submit → database snapshot read-back → settlement and same-task capture/release competition regression sources now published; execution pending.
• F4 canonical customer debit/log/cache basis distinct from account cost; scale-free original float64 round-trip quotes with provenance version, canonical amount never re-rounded from stored quotes. Exact-head acceptance pending.

Published increment

Published head f3c7a89.
Parent reviewed diff f0e0247..f3c7a89 and git show f3c7a89, and executed git diff --check. Added actual native OpenAIGatewayHandler HTTP stage/execute failure test with handler completion synchronization; actual batch submit/database round-trip/settlement regression and capture/release competition; explicit mixed-writer admission/drain and rollback prerequisites. This is static source review, NOT a passing dynamic result.

All F1–F4 boxes remain unchecked until independent source acceptance and exact-head push AND PR CI results are verified. Local Go compilation/tests/build/lint/race, Docker and vue-tsc remain prohibited. Old-head checks do not validate this head.

Boundaries

Upstream results lost before durable staging remain unrecoverable. Recovery never replays a model request or invents zero-cost success. No automatic historical back-charge, unfreeze or ledger repair; unmatched high-precision legacy operations stay blocked. Old quote encoding version 0 may already have lost precision and is not retrospectively repaired. Migrations 302 onward avoid neighboring migration 301.

Mixed old/new financial writers are a release blocker. Admission stop and drain of old requests, usage/batch workers and already-popped flusher snapshots must be reviewed; all relevant nodes need the same verified financial protocol before new admission. Old binary rollback cannot ignore new projections and owned holds. The documentation neither executes drain nor authorizes historical reconciliation.

No production DB/SSH, paid model probes, secrets, payment/recharge changes, pricing-policy changes, merge, tag, release or deployment authorized. Revenue decline/loss remains unproven. v2.17.1 stays on hold.