[LIghtJUNction]

Motivation

• Prevent unbounded persistent writes from achievement.start that could be exploited by temporary-token holders to exhaust database storage.
• Ensure achievement.start respects the global emergency accept_writes pause so capacity-sensitive behavior is consistent with other writes.

Description

• In src/msg/plugins/achievements.py the achievement.start handler now rejects requests when the subject already has the grant (achievement_already_granted) or an unexpired active ceremony (achievement_ceremony_active), deletes stale ceremony rows for the subject, and then allocates a single new ceremony row.
• In src/msg/core/executor.py the achievement.start operation was added to the capacity_writes set so it is blocked when runtime_config.accept_writes is False.
• Added regression tests in tests/test_achievements.py to cover duplicate-start rejection, expired-ceremony replacement, and honoring the capacity pause for achievement.start.

Testing

• Ran static checks and syntax verification with uv run --no-project --python /root/.pyenv/versions/3.14.4/bin/python -m compileall -q src/msg tests/test_achievements.py, which succeeded.
• Ran linting with uv run --no-project --python /root/.pyenv/versions/3.14.4/bin/python --with 'ruff>=0.14' ruff check src/msg/plugins/achievements.py tests/test_achievements.py, which succeeded.
• Ran git diff --check to validate whitespace and formatting changes, which reported no issues.
• Attempted to run the full pytest suite via uv run ... pytest -q tests/test_achievements.py but test execution was blocked during fixture setup because the environment is missing PostgreSQL tooling (initdb), so the integration tests could not complete in this environment.

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:46:35.236839Z	97f250f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

已被合并的 #142（merge commit edf0d55）取代，关闭。这些分支基于集成前的树，直接合并会与主线上的安全修复冲突或重复。