aggregator(feed): isFleetFeed never checks payg — one malformed line crashes usage() and /quota #2450

Problem

isFleetFeed (pm-stack/aggregator/src/feed.ts:207-219) never validates
the optional payg section at all — it checks only version,
generatedAt, quota.pools being an array, and attention being an
array. But the live source serves feed.payg verbatim as the usage
view's PAYG lines, and both the attention-flag builder and the /quota
renderer dereference every line unguarded, so one malformed line in a
feed that passes the gate crashes the whole Usage & billing page —
inside usage() itself, before rendering even starts.

Evidence (verified this run, main 5a34fa70)

• feed.ts:44: FleetFeed.payg?: PaygLine[] (shape at model.ts:1154-1167:
  string id/label/note, numeric-or-null accruedUsd/unbilledUsd,
  optional estimate { low, high, period }).
• feed.ts:207-219: isFleetFeed contains no payg check of any
  kind — not array-ness, not entry shape.
• sources/live.ts:808-815: in usage()'s feed branch (taken whenever
  feed.saas is non-empty), the section is passed through verbatim:
  payg: feed.payg ?? [] — no filter or per-entry guard.
• sources/live.ts:832: usage() then calls
  buildAttentionFlags(feed.quota, partial) while building its return
  value; derive.ts:852-862 dereferences line.unbilledUsd /
  line.estimate.low|high per line — a null line throws here, inside
  usage(), so every route that awaits usage() fails.
• render.ts:1684-1700: paygCardHtml maps lines with
  l.accruedUsd.toFixed(2) / l.estimate.low.toFixed(2) etc. — a
  string accruedUsd or a null line throws in the render too.
• server.ts:486-487 (/quota), :492 (/quota/service/:id),
  :656-665 (/api/quota.json): all await source.usage() with no
  catch, so the throw becomes a 500 for the whole hub page and both
  JSON twins — not just a missing PAYG card.

Laptop Bun probe (~/git/fleet/probe-2026-10-29-laneA-feedpayg/, real
feed.ts + derive.ts + render.ts from main 5a34fa70,
md5-identical, Bun 1.4.2; usage view assembled exactly as
live.ts:811-815 assembles it, flags built exactly as live.ts:832):

Why it matters

payg is the hub's PAYG dollars card (§1.2) — the metered-spill lines
the fleet's spend discipline reads. The collector emits these lines
from the quota records, so a single drifted or hand-edited feed line
takes down /quota, /quota/service/:id and /api/quota.json
entirely instead of dropping one line. This is the same failure class
as #2427 (attention entries), #2429 (quota pools), #2439
(chargesAttention), #2445 (charges) and #2446 (subscriptions) at the
same gate — the fix should stay consistent with whatever layer those
pin. This issue is the payg field specifically, with its own
consumers (buildAttentionFlags + paygCardHtml).

Acceptance criteria

• A feed passing isFleetFeed can no longer crash usage() or
  /quota: either the gate validates payg (array of lines with
  string id/label/note, numeric-or-null accruedUsd/
  unbilledUsd, and a well-formed estimate when present), or the
  live source filters/defaults malformed lines before the view is
  built — the layer pinned consistently with the
  aggregator(feed): isFleetFeed never checks attention entries — one null entry crashes /attention + /today, entries without a string sessionId silently collapse into one #2427/aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429/aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439/aggregator(feed): isFleetFeed never checks charges — one malformed row crashes /quota, a non-array object silently empties the charges strip #2445/aggregator(feed): isFleetFeed never checks subscriptions — one null row crashes /quota #2446 rulings.
• Malformed lines are dropped individually; well-formed lines in the
  same array still render and still contribute attention flags.
• Regression tests cover: [null] line, non-array payg (string and
  object), string accruedUsd, [valid, null] mixed — each rendering
  the valid remainder, never throwing; a well-formed feed unchanged,
  and the collector still accepts its own emitted feed.

Dedup

gh searches (open + closed) for payg, isFleetFeed and saas feed
returned no covering issue for the feed payg gate. #1119 is a
contract-test request for the /api/quota.json saas/payg schema —
related, but it does not track this verified crash at the feed gate.
Siblings at the same gate: #2427 (attention), #2429 (quota pools),
#2439 (chargesAttention), #2445 (charges), #2446 (subscriptions) —
each a distinct field and consumer.