Settle candidates only through verified atomic binding-plus-receipt commits

[bigboateng]

Summary

• An immutable candidate now becomes accepted state only when verification succeeds and the exact objective binding plus its receipt commit atomically; staged, rejected, stale, unverified, interrupted, or unreceipted candidates never do.
• Generic receipts move to schema version 4 with explicit objective lineage — the prior accepted binding, the requested candidate binding, and the resulting accepted binding — so a verifier can prove the exact accepted delta from the receipt alone. Receipt validation rejects legacy schema versions and any synthesized unrequested binding. No compatibility reader is added (alpha policy).
• A second domain-neutral conformance fixture (revisioned register) stores immutable content-addressed candidates outside control state; its accepted-value reader reconstructs only from the durable binding, the exact immutable content, and exactly one matching committed receipt, and fails closed on hidden content, fingerprint mismatch, missing receipts, or receipt substitution.
• Reusable settlement laws cover staging/resolve read-only behavior, verified initial acceptance, verification rejection, freshness drift across all five identities, candidate substitution, atomic commit failure with recovery, racing candidates settling at most once, same-instance and cross-instance replay, restart reconstruction, and fail-closed reading.
• White-box counterexamples prove the laws are falsifiable: they reject a mutable candidate store, a latest-staged reader, a torn state-receipt commit, a blind compare-and-swap commit, and a restart that resets durable state.
• The existing 18 shared behavioral laws continue to run against both registered backends with zero skips; existing effectful transition semantics are unchanged.

Boundary conformance

Boundary: the crossing where an immutable staged candidate becomes durable accepted state.
Control law: acceptance is only the exact committed objective binding plus one matching receipt with provable prior/requested/result lineage; every failure before the final atomic commit leaves the prior accepted binding authoritative, and accepted-state readers fail closed on damaged evidence.
Tests: positive, rejection, stale-state (five identities), substitution/bypass, commit-failure, replay, concurrency, and restart/reconstruction paths, each inspecting accepted binding, candidate identity, committed receipts, effect counts, and recovery state.

Release note

Adds release-notes/2026-08-23-trusted-settlement.md.

Verification

• python3 .github/scripts/run_go_tests.py — 642/642 across ten shards
• GOWORK=off go test [-race] -count=1 ./kernel/... ./conformance/behavior plus repeated -race runs of the concurrent-settlement law
• GOWORK=off go test -count=1 ./delivery/... ./internal/softwaredelivery/engine/... ./flow/standard/... ./controlprogram/... ./internal/softwaredelivery/effects/... ./internal/softwaredelivery/surfaces/...
• go build ./..., go vet ./... from boatstack/
• python3 -m unittest discover -s .github/tests -p 'test_*.py' — 69 tests
• python3 .github/scripts/release_notes.py validate|preflight — PASS
• git diff --check — clean