Credit-Note Allocation Settlement Hardened to the Live Set

A correctness fix to credit-note allocation, applied before the allocation feature is exposed in the product.

When a credit note is allocated to an invoice, the system decides whether the invoice is now fully settled. That decision, and the allocated total recorded in the audit trail, now count only live allocations and exclude any that have been withdrawn. Previously a withdrawn allocation could still be counted, which could cause an invoice to miss its move to settled or record an overstated allocated total.

Why this matters

Withdrawing a credit-note allocation keeps the original record for audit rather than deleting it. The settlement calculation must look at the live allocations only, the same set the database conservation rule already uses. This change aligns the application-level settlement decision with that rule, so the two cannot diverge. The underlying conservation invariant is enforced at the database layer and was never at risk; this fix corrects the application-level calculation that sits on top of it.

The live set is now read through a dedicated database view, so the live-only rule is structural: future calculations cannot drift by overlooking it.

Proof anchors

Database layer:
  allocation conservation over the live set is enforced by a database trigger
  (AX-CN-003), unchanged by this release.

Application layer:
  the settlement recompute reads the live-allocation view (migration 114).

Tests:
  a service-level test drives allocation, withdrawal, then allocation, and asserts
  the invoice settles and the recorded allocated total reflects only live allocations.