[ScriptedAlchemy]

Scope — Refs #4447

This is the source-identical, nonforce successor to #4811, not a second accounting implementation. Keep #4447 open: durable per-response replay/idempotency, reset/restart/disconnect and complete fault-stage acceptance remain outstanding.

Confirmed CI repairs

The preceding exact-head CI 42625612229 at aa3a706d505b22ce62cf40efe0383c23e523a7f8 has two independent blockers:

1. Clippy job 129216845646 rejects the unused tracedecay_runtime_core::db::engine::Executor as _ import in the ledger regression. Commit d0f314b, safely appended to the original branch, removes it and moves the used ToolTokenAccounting import to module scope. The exact one-file patch is +1/-3; production statements and all test assertions are unchanged.
2. Repository gates job 129188466805 rejects the immutable 74-character header of aa3a706 under the existing 72-character rule. A later commit cannot repair that history. Rather than force-push, rewrite peers, or weaken commitlint, this replacement has a single conforming commit on the same intended prerequisite base.

Exact source preservation

• New commit: 0ebb86a6a717c80833150093c5548aeadf210901.
• Same prerequisite parent: 0bdd2a376dea87086bf6ea9c8e4e57ff5d4b88ce (fix(sessions): serve live projection during historical ingest #4831).
• Entire repository tree: 042b48cab2d5fe17d3d5f97866f551b3938bd40d, exactly the tree of fix(accounting): credit monitor only after durable token commit #4811 at d0f314b.
• Exactly five original accounting source/test files differ from that base: monitor ring, CLI monitor fixture, ledger, request analytics, and freshness regression callers (+401/-29). No source, tests, contributor edits or prerequisite content were discarded.
• Original fix(accounting): credit monitor only after durable token commit #4811 branch, commits, reviews and evidence remain intact. Close that PR unmerged after verifying this replacement and rechecking its head; continue issue coverage here only.

Existing production behavior and regressions retained

Only committed project-store token savings may credit the live monitor, savings history or analytics. Refused/dropped commits retain raw activity without positive savings. The response commit receipt settles before the optional profile projection, so a blocked profile writer cannot conceal a committed project credit. Monitor filesystem refusals are returned and logged rather than silently dropped.

Real registered-store regressions cover a successful 7-token credit, forced checked-u64 overflow without phantom monitor/history/analytics credit, a held independent profile writer with an already-settled canonical receipt, restart/shutdown counters, and occupied monitor paths preserving foreign data. Assertions and deadlines are unchanged by this replacement.

Verification and merge hold

The preceding aa3a706 run passed Linux fleet, Dashboard and Windows build/typecheck, but failed Clippy and commitlint; native macOS was skipped. These are predecessor results, not a passing result for this new commit. Current-head hosted Bazel tests, Clippy, formatter and commit gates must execute and be inspected. Local Bazel/native macOS are unavailable; no Cargo or unexecuted test pass is claimed.

This PR still targets the existing #4831 prerequisite. Do not merge it into that feature branch or bypass the prerequisite: land prerequisites through their own reviews, retarget to master, inspect the resulting diff and revalidate normally. No merge/auto-merge or issue closure on the evidence above.

Protected #4776/#4797 and release #4763 are untouched. No workflow, protection, release, tag, production, infrastructure, credential or automation-schedule changes.

---

[changeset-bot]

⚠️ No Changeset found

Latest commit: cf2bd55

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[ScriptedAlchemy]

Exact-head CI repair — 2026-11-09. CI 42702961402 on 0ebb86a executed Repository gates: all 8 selected script tests passed but //crates/tracedecay:rustfmt_check_2024 failed on exactly two formatting hunks (ledger.rs:900 and requests.rs:1057); downstream Feature gates was red because Repository gates was red. Clippy and Dashboard both passed on that old head; Linux fleet was still in progress; macOS skipped. Do not apply those results to the new head.

Committed and pushed cf2bd55587d via exact expected-old-head force=false. Independent GitHub diff verification shows exactly two files, two rustfmt-prescribed whitespace-only transformations (+4/-1 each), no source semantics or test assertions altered. PR and remote branch independently verified at the same new SHA. New-head Rustfmt/Bazel/CI are not yet verified passing. Preserve #4831 prerequisite and all existing merge/review/acceptance holds; #4447 remains open.