fix(dlv): the owner proves the settlement from the state it owns before it signs or folds

[cryptskii]

Summary

Settlement blocker one: the owner proves the exact transition from the state it owns before it signs or folds a settlement. Cut from merged main (dbd1a56e, #760); no dependency on the source-map branch.

authoritative parent vault state (the head's own vault-state leaf at parent_sequence)
        ↓
committed pair + committed fee            (must reproduce that leaf over the reserves consumed)
        ↓
authoritative reserve_in / reserve_out    (by ASSET IDENTITY: the leaf of the asset the trader paid)
        ↓
canonical constant_product_output(input)  (the one implementation; no duplicate math)
        ↓
must equal the proposed output, exactly
        ↓
signed parent_binding == commitment of the parent state these leaves hold
        ↓
only then may the owner sign (route) / fold (core)

What was wrong

dlv.reconcile copied input_amount/output_amount from the trader's receipt into the signed DlvOwnerApplyV2 and the core ApplySettlement arm moved the leaves by checked add/sub. The receipt witnesses what the trader committed, not what the owner's reserves pay. Composition re-simulates the route-commit hop on the way to the frontier (vault_state_composition.rs) and the 0x0026 verifier re-simulates the trader's settle (provenance.rs), but nothing on the owner's side ever ran the curve on the amounts the fold actually moved — and advance never read the signed parent_binding (every reference was a test literal). A receipt above the curve folded.

The cut

layer	change
core ApplySettlement arm (advance) — the security boundary, sufficient alone	(1) the head's own vault-state leaf at parent_sequence must equal compute_vault_smt_value(parent, reserves_digest(pair, fee, cur_a, cur_b)) — the fee and reserves the curve runs on are the committed ones; no leaf ⇒ refused, never synthesised. (2) parent_binding (signed) must be vault_state_commitment(parent_state), and that state's vault, generation, both reserves, pair, fee and owner must equal the leaves — the head holds no V_n, so CCB(V_n) rides the mutation as unsigned bytes tied by the signature. (3) reserve_in is the leaf of the asset the trader paid; constant_product_output(input, reserve_in, reserve_out, fee) must equal the proposed output exactly. Typed refusal each; nothing moves.
VaultReserveMutation::ApplySettlement	gains parent_state: Vec<u8>
dlv.reconcile — pre-sign mirror, early refusal, not authority	pair, fee, reserves and parent_binding come from the verified composition (which now retains each folded parent's state, so reconciling N generations back names the exact state that trade consumed); the SQLite-record fee read is deleted; same orientation rule, same canonical function, exact equality — refused before sign_operation_sphincs
composition	folded_parent_bindings: Vec<(u64, c_n)> → folded_parents: Vec<FoldedParent { generation, c_n, state }>
DeviceState::parent_vault_state_for_tests	#[cfg(any(test, feature = "testing"))] — describes the parent state the head itself holds, so fixtures name the real state they consume

CPTA enforcement is untouched at its three layers (route pre-flight, advance funnel, economic verifier). Not in this PR: R_econ admission for settle/owner-apply, ReleasePolicy semantics, close/apply redesign.

Dependent sweep — a finding, not a footnote

Every owner-apply fixture in the tree folded an off-curve literal: 100 for 90 on 10 000/5 000 (curve: 49); 1 000 for 970 (curve: 453); 100 for 60 on 500/400 (curve: 7); 100 for 60 on 100/100 (curve: 9); a foreign receipt claiming 500 where the curve pays 453 — and the consumed-generation route test reconciled that receipt as its winner. Each is re-rooted through the canonical function, with the known values pinned beside the derivation. That the whole suite was green on those numbers is the measure of the gap.

Proof

check	result
core: one unit above OR below the curve refused, root unchanged; exact output advances	green
core: priced by the input asset's own reserve (b → a); the a → b price refused for that direction	green
core: a fee the leaf never committed refused by the head's own commitment, before the curve	green
core: a parent_binding that is not the supplied bytes' commitment refused; one committing a well-formed state the leaves do not hold refused; the real one advances	green
route: a receipt one unit off the curve refused before signing (route-named refusal), root, both leaves and consume-once row untouched; the curve-priced receipt folds and consumes the generation	green
mutation, per arm (core leaf check, core binding check, core curve check, route pre-sign check)	each arm disabled by an inverse edit that keeps the gate called and discards its verdict: core curve equality → the above/below test red; core leaf check → the fee test red; core binding-equals-commitment → the parent-binding test red (case a); core state-equals-leaves → the parent-binding test red (case b); route pre-sign → the route test red on the route-named message, the fold caught by core instead. Restoration shasum -c OK each time; green after
re-rooted suites: core device_state, dlv_owner_apply_preservation, dlv_value_op_signing, vault_rehydration, funded_creation_tests	green
boards	workspace 74 binaries, 3956 passed / 0 failed / 17 ignored (dsm lib 1686/0, dsm_sdk lib 1811/0/7 ignored), exit 0; node 11 binaries, 276/0, exit 0; root make lint exit 0; ci/production_safety_checks.sh PASS (pinned 1.98.0, incl. TLA+); scripts/ci_scan.sh PASS — all on tree stamp 9788e485d2c7, identical before and after every run and after the mutation cycles