Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md). Findings are hypotheses until reproduced on current main (WO-00).

Finding: Policy reads treasury from tenant vaults; DCP/Act loads an optional global file at startup, so a per-proposal treasury pass does not establish an aggregate reservation [R18]. Files: services/service-decision-control-plane/main.py, decision_meter.py; services/service-action-runner/main.py; services/service-policy-engine/main.py, pacing_veto.py. Fix: single per-tenant versioned constraint resolver used at admission, reservation, execution, settlement; currency, horizon, freshness bound to the action. Acceptance: test: policy-level treasury pass with no DCP reservation → execution refused; stale constraint version → refused. Depends on: WO-17.