[TK-005] Replace global pair closure with typed obligations, stable identity, and validated rolls #5

Priority: P0
Labels: domain-model, identity, correctness, release-blocker, table-kit
Confidence: 100%

Evidence

One blank inbound closes all cue/check-in pairs for a seat; one relay closes all rolls. Stable Discord author identity is discarded. Will/William substring matching is ambiguous; duplicate aliases are accepted; unknown speakers become new seats. “14 damage” and “3 hit points back” are consumed as rolls; natural 99 is accepted; unattributed failure repeats forever.

Scope / specification

Model every cue/check-in/roll/narration/delivery as one immutable obligation with explicit opener, expected actor/audience, type, correlation/source IDs, lifecycle, deadline/pause, and resolution evidence. Identity resolution prioritizes source-native principal ID mapped by host; aliases are exact normalized fallback and ambiguity is an error. Roll result carries roll ID, source, die/range/total, and confidence/provenance.

Acceptance criteria

• One inbound/result can close only explicitly correlated obligations.
• Empty content never acknowledges without a source event type that defines it.
• Duplicate/ambiguous aliases/IDs rejected; unknown principal remains unknown, not auto-enrolled.
• Bot/transport identity comes from source-native ID and is_bot/role.
• Typed dice-bot/VTT result preferred; prose roll inference remains advisory and cannot auto-close high-authority obligations.
• Natural ranges and system rules are validated by upstream engine/source when asserted.
• Attribution failures are idempotently recorded once and repairable.
• A relay with total=null appends neither an act containing ? nor a roll resolution.
• Every native message—including unattributed, rejected, or quarantined relays—is durably recorded/deduplicated before routing and surfaced to the operator.
• Host-generated obligation IDs are globally collision-resistant and unique; duplicate IDs fail instead of overwriting state.
• Each obligation kind has explicit allowed transition/outcome enums; orphan close/resolve events are rejected with typed diagnostics.

Required tests: concurrent obligations, blank message, cross-seat event, Will/William, Unicode/case alias, duplicate IDs, unknown/bot, damage/healing phrases, implausible roll, relay without total, duplicate/reordered result.

Dependencies: one-to-one matching, null-total refusal, pre-routing dedupe, and ambiguity rejection land immediately; host identity/event migration depends on PORT-002/PORT-003.