#749 Select both live goal sources through the shared client

Goal status and retained continuation count arrive through independent filesystem follows. Pairing them without a causal acknowledgement could show a stale count beside a newer blocked reason; comparing content hashes also failed when identical blocked text was published again. Raw GOAL.md replacement additionally left an obsolete protected descriptor that could terminate the query.

The combined ClientViews rendering now matches the exact filesystem write publication. Blocked counts remain pending until that publication is acknowledged, then show the exact retained count. Raw replacements invalidate old metadata atomically; readable goals remain observable when an unindexed writer leaves an obsolete descriptor.

Decisions

• Reuse the ordinary filesystem writer's operation identity from protected metadata, carried in the existing file query value and optional request-head goal_revision field. Read goal bytes and metadata from the same pinned generation. Unrelated volume writes preserve the goal publication; repeated identical indexed writes have distinct publications. No new store, tool or GOAL.md format.
• Raw FilesystemHost::apply replacements/removals clear the corresponding old content index in the same transaction, including identical-byte replacement. The indexed content writer keeps its existing atomic body/metadata publication path. A stale descriptor from another unindexed writer yields unknown publication; cancellation and work-budget failures still propagate. FileDescriptor::verify retains its original rejection behavior through the shared charged comparison.
• Continuations retain their count and observed publication together. Terminal blocked observations acknowledge their publication without consuming another continuation or calling the model. Legacy or unindexed metadata keeps blocked counts pending when causal consistency cannot be established.
• select_goal_view binds the GOAL.md and request-head live queries in ClientViews, ClientSession and HarnessClient. Both snapshots validate before installation. Either required follow ending returns ResetRequired.
• Interleaving properties enumerate every source-order-preserving merge and check every rendered prefix, including blocked(0), resume, identical blocked(1), exact final counts and unrelated publications. Removing the gate, matching by hash, and always hiding counts are failing controls.
• A shrinking filesystem property covers put_content followed by raw replacement, same-byte writes, replay, return to old text, fresh snapshots and live follows. A preserved-old-metadata control violates the unknown-publication oracle. A stale-descriptor case proves snapshots and follows stay readable.
• Nine stock-tool scenarios assert ordinary files/frames, status, reason, exact final count, model calls and cold replay. A real metadata-only rewrite test checks distinct indexed publications and convergence. Six portable cases remain available without native-execution; three mounted cases require it. Existing record/segment round-trip properties and cargo-fuzz corpus cover optional publication metadata.
• Main's #760 fixture repair, #766 bounded dispatch futures and #758 redundant-read removal are merged. Preserve the Files::len adapter used by this PR's views and publication: None in the newly merged FileValue test literal.

Sweep operation attribution after #758

• Preserve main's text coverage exactly: 2,665 ready reads, 84 blocking pairs, 42 task pairs and 13 native pairs. This scenario has no goal, so #749 adds zero operations.
• The effect/goal scenario adds exactly one conditional request-head publication at the continuation cap: continue_goal -> block_goal -> record_goal_revision -> write_turn -> put_content for inputs/current.json. The cap's GOAL.md write already exists on main. Recording the observed publication in normal continuation heads reuses their existing writes.
• That extra terminal acknowledgement retains the operation/root/count and uses a stable goal-observed retry key plus the current journal generation. Its ordinary indexed write performs the operation-key lookup, atomic body/descriptor/upload-receipt publication, generation pin and pinned-content verification. It accounts for all remaining delta: +4 blocking submitted/completed pairs, +2 task submitted/completed pairs, +1 native submitted/completed pair, and +51 ready reads. Effect/goal totals: 218 blocking pairs, 109 task pairs, 35 native pairs and 7,002 ready reads (main: 214/107/34/6,951).
• Model dispatch remains 3 and tool dispatch remains 1. No continuation allowance is consumed by the acknowledgement. The extra 14 cancellation boundaries bring the sweep from main's 998 to 1,012 cuts (text 280, effect/goal 732).
• Keep #758's elimination of repeated lineage loads and duplicate projection refreshes. Goal query projection and raw-replacement metadata invalidation add no controlled sweep I/O: the sweep has no UI follow, fixture setup precedes recording, and indexed content publication does not use the raw invalidation path.

Validation

Signed merge head: 1dfbb3838e2cfdc558ecb1c12229a59138dec531; merges origin/main at 05c5e29e2.

• Linux via bs.ps1, canonical native features filesystem-local,native-execution,test-support,tui: 19 library goal tests passed in 2.30 s. Includes exact convergence, all interleaving controls, ordinary frame/file scenarios and identical indexed-write following.
• Focused replacement tests passed, then reused the built file-query binary: all 21 tests passed in 0.57 s, including signed authority, bounded work, fresh snapshot/live follow replacement property, same-byte/return-to-old cases and preserved-metadata control. The property accepts only successful no-op replay or the SDK's exact NoPendingMutations result, then checks the successful cut remains visible; actual replacements must succeed.
• Linux at signed merge head via bs.ps1: cargo test -p acyclic-harness --locked --features filesystem-local,native-execution,test-support,tui --lib local::admission::poll_sweep: 10 passed in 6.32 s, including all 1,012 cancellation cuts and missing-hook/missing-cut/broken-recovery controls. One build/run, with exact coverage assertions for text 2,665 and effect/goal 7,002 ready reads. The operation attribution above explains the entire delta from main.
• Windows at signed merge head via lb.ps1: cargo check -p acyclic-harness --lib --tests --features filesystem-local,native-execution,test-support,tui passed in 2m 38s (one run).
• Changed callers, source/test bounds, LF and git diff --check pass. Formatted new and modified source; the newly merged compact test literal retains its existing style.

Build/run logs: /home/var/log/buildbox/2026-10-16T203658186Z-749591.log (library), 2026-10-16T204301112Z-763439.log (replacement target), 2026-10-16T204507972Z-765083.log (complete file-query binary), 2026-10-16T204507984Z-765092.log (admission binary). No CI wait.

Merge-head sweep log: /home/var/log/buildbox/2026-10-16T205723973Z-778737.log.