id(currency_poc): FileIntentStore listing ignores canonical file names — duplicate copies reconcile twice, and a misnamed record is invisible to prepare()'s identity guard #4578

Summary

FileIntentStore (pkgs/id/src/currency_poc/intent.rs) has two inconsistent notions of where an intent record lives:

• get(conversion_id) reads only the canonical path path_for(id) = {id:032x}.json (intent.rs:175-177, 199-209).
• unresolved() ignores file names entirely: it scans every *.json entry in the directory and returns whatever parses as an IntentRecord (intent.rs:211-256).

Nothing ties a listed record to its canonical file name, and nothing deduplicates by conversion_id. Two verified consequences:

1. Duplicate listing / duplicate reconciliation. Every copy of a record file in the same directory (an operator backup copy, a copy under another name) is listed again. Recovery then reconciles the same conversion once per copy and emits duplicate (conversion_id, outcome) pairs.
2. A misnamed-only record is invisible to the identity guard. A record that exists only under a non-canonical name (older naming scheme, operator rename) is seen by unresolved() but get(id) returns None for it. ConversionExecutor::prepare's identity guard — "a conversion ID is the identity of ONE conversion: never replace its persisted intent" (executor.rs:238-258) — is built on get(), so it happily persists a second, conflicting intent for the same conversion. The store then holds two records for one conversion with different legs, and unresolved() returns both.

This is the identity counterpart of #4125 (closed): that fix made the listing skip unparseable entries; parseable-but-misnamed or duplicated entries still pass through unchecked. It is also adjacent to #4133 (closed), which made reconcile distrust the leg vector; the record-identity layer has the same trust problem one level up.

Evidence (verified this run, main 874ca86)

Laptop probe ~/git/fleet/probe-2026-11-02-laneB-intentname/ — verbatim copies of currency_poc/{intent,ledger,recovery}.rs from origin/main (md5 intent d276f6cc, ledger 093c818d, recovery 8d40cf83, all matching the sandbox clone at 874ca86); cargo test 2/2 pass:

• PROBE1: put record for conversion 7, then copy its file to backup.json and 999.json in the same directory → unresolved() returns 3 records for conversion 7; reconcile(.., Abandon) returns 3 outcomes [(7, Abandoned), (7, Abandoned), (7, Abandoned)].
• PROBE2: write a Recorded record for conversion 9 only as intent-9.json → get(9) returns None while unresolved() returns [9]; after put of a conflicting record for conversion 9 (different leg ID), unresolved() returns 2 records for conversion 9.

Why it matters

The intent store is the write-ahead recovery surface for conversions: its whole contract is one durable record per conversion that the scanner can trust. Duplicate listings make recovery reports (and any consumer counting outcomes) double-count a conversion, and repeated puts from duplicate entries rewrite the canonical file once per copy. The misnamed case is worse: it silently defeats prepare()'s never-replace guard, the exact mechanism that prevents a retry from erasing/conflicting with the recovery record of an earlier, possibly-posted submission — two divergent leg sets for one conversion ID is precisely the state the recovery scanner cannot reconcile safely.

Acceptance criteria

• FileIntentStore::unresolved() returns at most one record per conversion_id.
• A parseable record whose file name is not the canonical {conversion_id:032x}.json for the conversion_id it carries is handled explicitly: either it is reported through unreadable_entries() (the id(currency_poc): one corrupt or foreign .json file in the FileIntentStore directory aborts recovery for every pending conversion #4125 skip-and-report channel, with a reason naming the mismatch) and not listed, or the store's identity contract is changed so get() and unresolved() agree — with the chosen semantics documented on the IntentStore trait.
• Regression tests: (a) duplicate copies of one record file in the directory list/reconcile once; (b) a misnamed-only record cannot coexist with a conflicting put for the same conversion — after the fix, prepare()'s guard sees every record the scanner sees.
• Existing currency_poc tests stay green, including the id(currency_poc): one corrupt or foreign .json file in the FileIntentStore directory aborts recovery for every pending conversion #4125 unreadable-entry tests.