aggregator(feed): isFleetFeed never checks charges — one malformed row crashes /quota, a non-array object silently empties the charges strip #2445

Problem

isFleetFeed (pm-stack/aggregator/src/feed.ts:207-219) never validates the
optional charges section at all — it checks only version, generatedAt,
quota.pools being an array, and attention being an array. But the live
source serves feed.charges verbatim as the usage view's charge rows, and
the /quota renderer dereferences every row unguarded, so one malformed
row in a feed that passes the gate crashes the whole Usage & billing page.

Evidence (verified this run, main 5a34fa70)

• feed.ts:47-48: FleetFeed.charges?: ChargeRow[], where ChargeRow
  (model.ts:1169-1178) requires at: string, label: string,
  amountUsd: number, method: string, source: string.
• feed.ts:207-219: isFleetFeed contains no charges check of any
  kind — not array-ness, not entry shape.
• sources/live.ts:808-815: in usage()'s feed branch (taken whenever
  feed.saas is non-empty), the section is passed through verbatim:
  charges: feed.charges ?? [] — no filter or per-entry guard, unlike the
  registry / projects / snapshots consumers in the same file, which
  validate or filter first.
• render.ts:1734-1746 (chargesStripHtml, called from renderQuota):
  rows are mapped with c.amountUsd.toFixed(2) and totalled with
  usage.charges.reduce((sum, c) => sum + c.amountUsd, 0) — a null row,
  a missing amountUsd, or a string amountUsd all throw; a non-array
  string charges throws on .map.
• server.ts:486-487: /quota awaits source.usage() and calls
  renderQuota(...) with no catch, so the throw becomes a 500 for the
  entire usage hub page — not just a missing charges strip.
  /api/quota.json (server.ts:656-665) does not crash, but serializes
  the malformed rows verbatim to API consumers. A non-array object
  charges is silently swallowed instead (length is undefined, so the
  strip renders "No charge evidence") — real charge rows vanish with no
  signal.

Laptop Bun probe (~/git/fleet/probe-2026-10-29-laneA-feedcharges/, real
feed.ts + render.ts from main 5a34fa70, md5-identical, Bun 1.4.2;
usage view assembled exactly as live.ts:811-815 assembles it):

Why it matters

charges is the hub's charge-evidence strip (§2.4): the collector emits
these rows from Plaid/Gmail receipt records, so a single drifted or
hand-edited feed row takes down /quota entirely instead of dropping
one row, and the JSON twin silently serves the garbage onward. This is
the same failure class as #2427 (attention entries), #2429 (quota pools)
and #2439 (chargesAttention) at the same gate — the fix should stay
consistent with whatever layer those pin. Note this issue is the
charges field specifically: #2439 covers the separate
chargesAttention field and its usage() flag map.

Acceptance criteria

• A feed passing isFleetFeed can no longer crash /quota: either the
  gate validates charges (array of entries with string
  at/label/method/source and finite number amountUsd), or the
  live source filters/defaults malformed entries before the view is
  built — the layer pinned consistently with the aggregator(feed): isFleetFeed never checks attention entries — one null entry crashes /attention + /today, entries without a string sessionId silently collapse into one #2427/aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429/aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439
  rulings.
• Malformed entries are dropped individually; well-formed entries in the
  same array still render, and the strip total sums only valid rows.
• A non-array charges degrades the same way (rows dropped, page
  renders), never throws and never silently masquerades as "no charge
  evidence" when valid rows were present.
• Regression tests cover: [null] entry, entry missing amountUsd,
  string amountUsd, non-array charges (string and object) — each
  rendering the valid remainder, never throwing; a well-formed feed
  unchanged, and the collector still accepts its own emitted feed.

Dedup

gh searches (open + closed) for charges isFleetFeed and feed charges validator returned no covering issue. Siblings at the same
gate: #2427 (attention), #2429 (quota pools), #2439 (chargesAttention —
distinct field, distinct consumer in usage()). #2130/#2194 cover
charges-match/charges-collect internals, not the feed gate, the live
usage() pass-through, or the /quota render.