[congvc-bot-x99]

Status: OPEN/draft. Base main 03404c0cfcbff3730ad29a25d85906be8c59cd77. Head 524363e27cf28fb4bdaa24d56f0497fa0a875427, tree d6d050ce553e655fbe12aaf21adcd51e278cf54b. The head merges current main into the branch and adds no code. The receipt diff is unchanged: 3 files.

Change:

• Cause: Observe clamps every deadline to the 50 ms Budget. The test helper observeRealBudget passed a 5 s Input.Deadline, and the clamp discarded it. A cold reserve on a real database can then take longer than 50 ms and sheds the observation as budget_exceeded. This hits the create observation (receipt_budget_test.go:169) and the edit observation (:178).
• Fix: an unexported Observer.observationBudget field replaces Budget when set. Production code never sets it, so the default stays the 50 ms Budget (CHE-946 clamp preserved). The helper sets it to its existing 5 s realBudgetBound.
• No assertion is weakened and no test is quarantined.

Evidence:

• Test-first: commit f1b6494ea83189e633ff0f804e692d908e45708f adds only receipt_budget_slow_reserve_test.go. TestObserveRealBudgetHelperToleratesReserveSlowerThanBudget fails with shed budget_exceeded, 20 of 20 runs, against the parent. Fix commit 3eed799ddc63fc7995e6a3441202ec2a194727d7 leaves that test unchanged and it passes. TestObserveProductionBudgetStillShedsSlowReserve guards the clamp and passes before and after. Before the fix, main failed 30 of 40 on the edit test.
• Race run at head 524363e27cf28fb4bdaa24d56f0497fa0a875427 on X99 (task-owned loopback PostgreSQL 17, migrated): go test -race -count=40 -v ./internal/governance/receipt/... exit 0. 840 top-level PASS, 0 FAIL. TestObserve_EditAfterSettledCreateIsAdmittedAgainstRealBudgetService passed 40 of 40. TestObserveRealBudgetHelperToleratesReserveSlowerThanBudget passed 40 of 40.
• Independent review: x99-codex-luna (OpenAI/Codex), comment 01a15dac-6908-75e1-a371-4b822e2b40d0, manual code-scope P0/P1 PASS at the earlier head 9388aa0cbf92a7f61401065993ef8204dca5c3a5. No P0 or P1. Exact-pair OCR failed, so ocr_status=NOT-RUN with the manual fallback in comment 01a15dcf-0d88-77f7-943f-6e416a3da9fc. The head since then adds only a main merge.
• Full-suite make test of 21 Oct 2026 (head 9388aa0cbf92a7f61401065993ef8204dca5c3a5, exit=1) is unrelated to the receipt package. The receipt package passed in that run. Failing packages: cmd/multica and internal/daemon/execenv (agent-runtime environment variables and a missing task /tmp directory), internal/service (timeout under host load 28 to 46), plus downstream [build failed] packages from missing Go $WORK artifacts. An earlier run also hit internal/realtime TestMembershipBurstDoesNotRejectValidWriters, which fails on pure main under load. Not waived.

Changelog: none

Closes CHE-1578