fix(economic): refuse issuance at the accepting layer until 0x0029 exists

[cryptskii]

Refuse issuance at the accepting layer until 0x0029 exists

Frozen-path step 1. 0x0030 is not parameterized, 0x0029 is not started, and CreateToken is not redesigned — only the missing chokepoint refusal your "confirm there is no alternate accepting path" instruction surfaced.

The defect, and why the plan's note about it was wrong

token.mint credited arbitrary non-builtin assets into the device head with no admission. The 3.5b plan recorded that as "purely local self-strand". Two facts that postdate the note falsify it:

• dlv.create funds vaults from head.balance(), not R_econ (dlv_routes.rs:598-613) — so minted units become vault reserves in a market no verifier can accept.
• activate() refuses a device whose balance map is non-empty (economic_admission_flow.rs:118-124) — so holding them is a one-way door: the identity can never enter the economic model at all.

R_econ was never inflated: a trader settling against such a vault needs the owner's root Validated, which a minting owner can never have. The guarantee held. What failed was the product — a parallel unadmittable market plus a permanent lockout, reachable from a live route (app_router_impl.rs:3447).

The fence, and the second instance of the same shape

A route guard binds one caller; a write-set rule binds only paths that build a write set. DeviceState::advance is the one layer that sees every caller, present and future. Positive Mint now refuses there for every asset, keeping the two reasons distinct — a builtin's issuance is not self-authorizable at all, while a user asset's is authorizable in principle and simply has no predicate yet.

CreateToken { initial_supply > 0 } had exactly the same gap, and I would not have looked without your instruction to confirm it. validate_conservation explicitly permits the issuance leg (device_state.rs:614-628) and nothing in advance refused it; both existing refusals — the route guard at token_routes.rs:1583 and CreateTokenInitialSupplyRequiresIssuancePredicate at write_set.rs:397 — sit outside the chokepoint. No production caller can reach it, since the single constructor passes only the ERA fee debit, which is precisely why it was free to close now rather than after some future caller closed it in the wrong direction.

Both refusals stay narrow: a zero-amount mint creates nothing and is not claimed; zero-supply token creation remains an ordinary fee spend.

The token.mint route body is deleted, not left unreachable — it signed a self-authorization with the caller's own device key, the shape that must change completely once issuance carries 0x0029 evidence. token.burn still uses the shared helpers, so nothing is orphaned.

Mutation controls (red-then-restored)

• no_asset_mints_from_air_and_the_two_refusals_stay_distinct — deleting the Mint block turns it red by actually crediting: the outcome carried balances: 1. It fails on the forbidden action, not on a message, so a gate moved somewhere useless would not keep it green.
• creating_a_token_with_initial_supply_is_refused_at_the_accepting_layer — deleting the CreateToken block turns it red by issuing 500 units of a brand-new asset from air.

Test integrity — the part the suite could not catch

An adversarial fixture audit (four independent search modalities, each with a refutation pass) found that the new gate silently broke two tests while the suite stayed green:

• advance_rejects_balance_overflow minted 1 into a u64::MAX balance and asserted is_err(). The new refusal preempts the delta loop's checked_add, so it stopped exercising overflow entirely — green, proving nothing.
• mint_of_an_unknown_token_fails_closed became vacuous: the route refuses before resolving the token, so an unknown ticker and a valid one take the identical path.

Both now assert on the reason (err.contains("overflow"); msg.contains("0x0029") for a known token), so a future upstream gate breaks them loudly instead of quietly inheriting them.

Eight core tests used a mint as a funding or credit vehicle: funding-only moved to with_balance_for_testing, value-bearing advances to burns, and the one whose subject genuinely is a credit moved to the production shape — a credit-direction Transfer with its Prepared admission attached.

What the sweep cleared, and one thing it did not

Cleared (stated so the claim is falsifiable): the dBTC tap — resolve_policy_commit_strict resolves "dBTC" to the builtin commit first, so the tap's mint is refused by name with no fallback credit, no direct head write, and no non-builtin wrapper path. Also dlv.claim/dlv.invalidate (conservation catch-all), the DSM_DEV_SEED path, token_sdk's mint, canonical_rebuild (fabricates admissions only for Transfer/FaucetClaim), and the cfg-quarantined balance installers.

Not fenced, deliberately: DlvSettle. It credits un-admitted and self-authorized — require_attached_dsm_admission still has only two call sites — but it is structurally different from issuance:

	Mint (fenced)	DlvSettle (deferred)
creates units from nothing	yes	no — must debit a different asset
can R_econ fund it	no — 0x0023 fails closed, 0x0029 unwritten	yes — the DlvSettle write set and the 0x0026 arm landed in PR3 (#743)

So it is a held cutover (step 5), not a missing predicate; fencing it now would break the trader settle path with no replacement. The residual is real and recorded: a trader settling today strands its own activation, which is a concrete reason step 5 must run on fresh identities.

Boards (exact CI commands, final tree, pinned 1.98.0)

• Workspace: cargo test --locked --workspace --exclude dsm_storage_node -- --nocapture --test-threads=1 — 3904 passed / 0 failed across 71 suites, exit 0
• Node (repo root): cargo test --locked -p dsm_storage_node --no-default-features --features local-dev,strict -- --nocapture — 270 passed / 0 failed, exit 0
• make lint (repo root) — exit 0; pinned repo-root cargo clippy --all-targets — exit 0
• bash ci/production_safety_checks.sh — exit 0

Next (step 2): implement 0x0029 behind the existing 0x0023 arm — the verifier reruns policy enforcement (no caller-supplied policy_passed), supply facts derive from canonical economic state, and authorization is never treated as backing.