[ctfbruce]

Behaviour

Operator-issued usage allowances for the TEST payment method (#83) and a read-only earnings view for executor owners (#215, operator side), both disabled in every shipped configuration:

• Dispatcher schema 23 adds allowance_grants: immutable grants (actor, reason, idempotency key) per account; update and delete are refused by triggers. An account's allowance is the sum of its grants; consumed is the price of its TEST orders that have a settlement row, credit or refund alike (a failed run does not return its units); reserved is the price of the other orders of its paid TEST intents.
• With [allowance] enabled = true, an account's TEST intent is created by one guarded insert inside the existing intent transaction (granted - consumed - reserved >= price); a refusal is HTTP 429 allowance_exceeded naming the remaining and required units and writes no transaction, order or owner row. Before the check, expired unused intents of the account (no claimed order) are released Paid -> Expired; an expired intent cannot be submitted.
• Nothing is granted at sign-up; grants do not renew; the default grant is default_grant (30,000,000 units, the documented run arithmetic). Allowances are bookkeeping units, never money.
• Routes: GET /me/allowance (404 while disabled; scope account:read), POST /operator/accounts/{id}/allowance (operator session only: 201 new, 200 for a repeated key with the same body, 409 conflict otherwise, 404 unknown account or disabled), GET /operator/executors/{id}/earnings (owner only; payouts: "disabled" while chain payments are off; scope executors:read). GET /me reports whether allowances are enabled. API stays 1.15; OpenAPI, docs/api.md, wire types and the Go client are extended.

Proof

• Real SQLite: grants then intents within the allowance with reservations visible; over-limit refusal with no rows written; eight concurrent intents against one grant admit exactly five; credit and refund both move reserved to consumed; an admitted run with an unknown outcome stays reserved across a database reopen; an expired intent is released by the next intent, cannot be submitted and races an admission claim with one winner; grant idempotency and 409; operator-only, validation and unknown-account refusals; disabled mode answers 404 and leaves intents uncapped; the local-development caller is uncapped; earnings for an owned and a foreign executor; route access matrix, OpenAPI contract and error-code pair checks extended.
• On the composed tree (this branch): gofmt clean, generated files match the pinned generators, vet and build pass, and the payments, Sui, HTTP API, storage, schema and client packages pass under -race.

Upgrade

Dispatcher schema 23 is required: stop the dispatcher, back up the database and run the explicit upgrade before starting this build. The minimum is raised although a deployment with allowances disabled never reads the table: a configuration-dependent minimum would be a new mechanism.

Stacked on #375 (quotes and economics) and #374 (schema 22); both are merged into this branch, so the diff against main shows their commits until they merge.

Limits

• remaining is negative for an account that used TEST units before any grant; it is reported, not clamped.
• Expired intents are released when the same account creates its next intent; there is no background sweep.
• The Go client has no grant method (an operator action; the route answers 201 or 200).
• Totals are never wrapped or clamped: an account whose grants or orders sum beyond a signed 64-bit integer, or whose remaining allowance cannot be computed without overflow, is answered 409 allowance_out_of_range on the allowance, grant and intent routes (nothing recorded, nothing reserved); an operator reconciles that history.

GitHub issues #83 and #215.

Candidate CI

Run 37292512236 on 768063f: 16 of 16 lanes and required succeeded on attempt 2; attempt 1 failed only in the local lane on TestInstalledRecovery/terminated (the read-only storage inspection after a forced stop, a known failure of that lane on code this branch does not touch). The branch then took the quotes branch's correction by merge (bfafb78): run 37302493328, 16 of 16 lanes and required succeeded. Correction f48d364 (typed range refusal instead of wrapped arithmetic): run 37307311805, 16 of 16 lanes and required succeeded. The branch then took the quotes branch's composed head, which carries the payout branch and the corrected adapter, with its two test fixtures adapted to the constructor that reports a configuration error (8d15c1e): run 37310280152, 16 of 16 lanes and required succeeded.