feat(dlv): the authenticated frontier is a live quorum cell walk

[cryptskii]

The authenticated frontier: a live quorum cell walk

Work-order item 4, the last item in the sovereign-finance track that is not gated on a monetary-origin decision. The plan called this a conformance gap rather than a new mechanism, and that held up: the counting rule, the quorum-attributed cell read, and the owner-committed q all already existed. What was missing was that composition did not use them.

The defect

Vault composition folded forward off a prefix listing read from a single member. A set query's exhaustiveness is unfalsifiable and no signature repairs it, so a member that omitted a key produced an answer indistinguishable from a genuinely shorter chain — and the composer returned it as the vault's state. The type was honest about it in prose and nothing consumed the warning:

This is a valid PREFIX, not a proven frontier: the fold stops when the pointer listing it read is exhausted, and that listing came from a single member, so absence and omission are the same observation.

The inversion

The edge source is now the settlement-slot register cell, read live at the quorum the owner committed in V_n (field 15 — previously encoded at state.rs:328 and read by nothing) against the storage set V_n names, resolved through the local catalog and failing closed when it does not resolve. A write-once cell cannot express omission: q attributed members answering "nothing here" is a positive fact, not the absence of one.

empty at quorum   -> the chain ends here; THIS is the frontier
winner at quorum  -> validate the edge and fold, or fail closed
anything else     -> DLV_BINDING_EVIDENCE_UNAVAILABLE

Req 6.25 had zero occurrences in the tree before this.

CellObservation splits "q members agree the cell is empty" from "too few answered" — read_cell_quorum returned Ok(None) for both, which is the same omission defect one layer down. Counting is Req 15.8: only members echoing their own id count, only byte-identical values aggregate, divergence is a conflict.

Every former skip in the fold is now a refusal, and the success type carries the guarantee: a prefix cannot be constructed, so every existing caller gets frontier-or-fail without restructuring.

Your ruling, pinned

A quorum-established successor whose settlement evidence is missing is not a frontier. The network has already said this generation is consumed; reporting it as the end because a second artifact is absent would make the cell walk decorative. A claimant who wins a slot and never settles holds the vault at Incomplete — an accepted liveness cost, never permission to manufacture maximality. No clock, no age semantics. Depth saturation is Incomplete too, never "frontier at 64".

What the implementation surfaced

Close and settle contend for one slot per generation, so a close consumes this cell as well — a closed vault would otherwise have composed to "unavailable" forever. Its x is a public derivation anyone can recompute, so the x proves nothing; what a stranger cannot forge is that claim signed by the owner's P0–P6-proven authority key. A close folds to the determined terminal state (both reserves zero at parent+1) with no receipt to fetch, and a stranger claiming that x produces a refusal, never a vault that appears closed. close_slot_commitment moves to core — it was hand-inlined twice in one function under two names (x_close and close_commitment, the same derivation).

finish_prepared_close now binds the parent it consumes, not the frontier. A published close claim is a real edge, so re-composition legitimately reports parent+1; the parent's c_n comes from the walk's own folded_parent_bindings, the same pattern dlv.reconcile uses.

Two fixture-fidelity bugs the new controls found. A failing member was modelled as answering empty while still echoing its id, so it counted as an attributed "nothing here" — a fixture could manufacture a frontier out of silence, which is exactly the defect under repair. A failing member now does not answer, matching what the live reader gets from an unreachable node. And a member that serves reads while refusing writes was added, because once composing requires a readable fleet that is the only honest way to strand a close intent.

Three silent continues in the close-resume sweep now log why they retried.

Controls (each red-then-restored, each with a positive control)

• The omission mutation — treating a short quorum as a frontier turns a_short_quorum_on_the_cell_is_not_a_frontier and a_member_echoing_another_id_is_uncountable red; restored, both green.
• Member impersonation via a mismatched echo is uncountable; a divergent write-once cell fails closed.
• A claimed generation without its receipt fails closed (your ruling); a winner binding a different parent state; a stale hop binding; a receipt for another generation.
• a_close_refuses_when_the_frontier_cannot_be_read — nothing moves, no intent is recorded, and the same close succeeds once the fleet answers.
• a_contested_parent_refuses_the_close_and_moves_nothing re-cut: the refusal now comes from the frontier gate before anything is recorded, which is stronger than the abandoned intent it used to assert. The close's own contested-claim path is not dead — it still guards the compose→claim race.

Boards (exact CI commands, final tree, pinned 1.98.0)

• Workspace: cargo test --locked --workspace --exclude dsm_storage_node -- --nocapture --test-threads=1 — 3901 passed / 0 failed across 71 suites, exit 0
• Node (repo root): cargo test --locked -p dsm_storage_node --no-default-features --features local-dev,strict -- --nocapture — 270 passed / 0 failed, exit 0
• make lint (repo root) — exit 0; pinned repo-root cargo clippy --all-targets — exit 0
• bash ci/production_safety_checks.sh — exit 0

Scope

No portable maximality certificate: the statement is "during this read, no successor beyond c_n was established", and frontier stays inherently online. Threat model unchanged (crash-fault, n=3, q=2). No storage-node keys. This does not unblock live DLV routing — that remains blocked on an honest second-asset origin.