feat(economic): the DlvOwnerApplyV2 write set and the 0x0027 settlement-payment arm — 3.6 PR4

[cryptskii]

3.6 PR4 — the DlvOwnerApplyV2 write set and the 0x0027 settlement-payment arm

Fourth PR of the 3.6 series: the owner's apply now has its complete economic story — the reserve-only write set, and the provenance arm sourcing the input-reserve credit from the trader's ALREADY-ADMITTED settlement payment. With this, all four DLV value operations have foreign-verifiable write sets; PR5/PR6 wire the routes through admission.

The DlvOwnerApplyV2 write set

SemanticWriteSet::DlvOwnerApply: reserve[input] gains input_amount, reserve[output] loses output_amount, both advancing parent → parent+1; no balance movement (the fee accrues inside the reserves as LP yield). Builder rules mirror the device-state ApplySettlement arm exactly: the output leg must EXIST at the consumed parent generation and cover the payout; the input leg may be first-time or must share the parent generation; a zero output reserve stays PRESENT. Non-reuse is the reserve-sequence Merkle CAS — after the first apply, the pre-state at parent no longer exists in the owner's validated lineage — so there is no consumed-source leaf and requires_consumed_source_record is unchanged. CreditSourceFacts::DlvSettlementPayment { trader_genesis, trader_devid, trader_economic_position, payment_evidence_addr } — every other coordinate is read from the operation.

The evidence bundle (SettlementPaymentEvidenceV1, transport proto — no CCB class)

The trader's settlement-receipt leaf plus its 256-sibling inclusion witness. Strict decode (canonical re-encode equality, exact arity/widths); the receipt state decodes through the validating constructor, which re-derives receipt_id from (vault, x) and enforces the sequence/amount/asset rules before the arm sees it.

The 0x0027 arm (verify_credit_source), conjunctive

1. ctx.verified_operation (derived inside advance_validated, never caller-supplied) must be the DlvOwnerApplyV2; descriptor coordinates (vault, receipt_id, parent) equal the operation's.
2. The TRADER's economic root Validated at the descriptor's untrusted locator position — the walk derives it; the locator only locates.
3. Evidence bytes re-hash to the descriptor's address; strict-decode.
4. The receipt states THIS apply's exact settlement, field for field: x == pending_pointer_x, both sequences, both assets, both amounts.
5. The receipt leaf proven INCLUDED under the trader's validated root at the trader's own leaf key.
6. FundedCredit { source_id = H(vault ‖ receipt_id), input asset, input amount } — the common tail then enforces exact equality against the funded input-reserve credit.

Registry (from PR1's schema-2 burn): 0x0027 carries trader_economic_position — untrusted locator, never authority. New domain tags: the 0x0027 SourceId and the evidence namespace.

Tests (economic_dlv_owner_apply_provenance.rs, 8)

• a_real_owner_apply_funds_from_the_traders_admitted_payment — the honest path, write set built by the REAL builder over a real reserve pre-state.
• a_second_apply_of_the_same_receipt_is_refused_by_the_reserve_cas (MC-APPLY-1) — the same apply against the post-state pre-map fails its own generation precondition at build.
• a_trader_root_lacking_the_receipt_is_refused (MC-APPLY-2, arm-mutation-verified: neutralizing the inclusion equality turns it red).
• Field-by-field op↔receipt cross-checks (MC-APPLY-3/6: amounts, x, receipt id — arm-mutation-verified: neutralizing the receipt-equality conjunct turns them red).
• a_witness_moving_balances_is_not_an_apply (MC-APPLY-4); a_non_unit_generation_step_is_refused_at_derivation (MC-APPLY-5); tampered evidence bytes refused by address; an unresolvable trader lineage fails closed as Incomplete (an outage is never an attack).
• The write-set deferred-honestly tripwire fired on schedule and is re-cut: the_dlv_value_write_sets_demand_their_facts — both heavy ops now demand their facts; nothing is deferred.

Boards (exact CI commands, final tree, pinned 1.98.0)

• Workspace: cargo test --locked --workspace --exclude dsm_storage_node -- --nocapture --test-threads=1 — 3896 passed / 0 failed across 71 suites (dsm lib 1675/0, dsm_sdk lib 1792/0 + 7 ignored), exit 0
• Node (repo root): cargo test --locked -p dsm_storage_node --no-default-features --features local-dev,strict -- --nocapture — 270 passed / 0 failed, exit 0
• make lint (repo root) — exit 0; pinned repo-root cargo clippy --all-targets — exit 0
• bash ci/production_safety_checks.sh — exit 0

Next (PR5): feat/dlv-create-close-admission-cutover — the create/close routes wired through AdmissionPlan, then PR6 (settle/apply cutover with the pre-slot/post-slot split and the q-durable foreign closure), then the live 2-of-3 frontier walk completes the sovereign-finance track (per the 2026-08-29 scope ruling).