feat(economic): the DLV market-leg token-policy conjunct — enforced at three layers

[cryptskii]

The token-policy conjunct SoFi places on every market successor and every
release (Def 4.1, Req 4.4, Req 4.6, 6.25, 21.10/21.14) — enforced. Before
this, zero DLV value operations consulted the token policy of any asset they
moved, at any layer: a non-transferable token was fully blocked on online
Transfer yet funded, traded, folded and drained through markets freely, and
dlv.create accepted any 32 random bytes as a funding leg.

The model (owner-frozen, 2026-08-30)

Token anchors are PUBLIC identifiers — the CoinGecko model. Discovery is
external, adoption is open: anyone holding the anchor may root to the token,
and rooting is the precondition of interacting with it at all. Consequently:

• Policy bytes come from your OWN rooting, never from a counterparty. A
  verifier holding a V_n-authenticated commit IS a holder of the anchor, so
  fetching the bytes from the authoritative content-addressed path and
  re-hashing them against the commit is legitimate rooting — the resolver
  locates, it never authorizes. No evidence bundle grows a policy field.
• allowlist_device_ids is issuance-recipient-scoped (who may be minted
  to — 0x0029's rule) and has NO market meaning. An allowlisted-issuance
  asset trades freely once issued.
• transferable is the one movement-relevant commitment a policy
  carries, and a market successor moves control between parties — so a
  non-transferable asset is not a market leg, in any role. Admitting it would
  bypass the committed mint/burn-only restriction through the market door.
• ERA and dBTC are pre-rooted on every device by construction — the sole
  exceptions, never consulting any store.

Three layers, one matrix

check_market_leg_permitted + market_leg_commits (one leg extraction for
all four DLV ops) live in core; every layer runs the same decision:

1. The economic verifier (advance_validated): a new central conjunct
   verifies every DLV successor's legs through the new
   ProvenanceResolver::anchored_policy_bytes — re-hash to the committed
   leg, parse, matrix. Central rather than per-arm, so fund and close are
   foreign-verifiable too, despite their SameTransitionMove credits
   carrying no evidence channel — the rooting model made the PR5-deferred
   carriage question disappear. Unrooted ⇒ Incomplete (root, then retry);
   wrong bytes ⇒ refused.
2. The advance funnel (execute_on_relationship_inner): the DLV twin of
   enforce_policy_for_operation, from local rooting — covering EVERY
   caller, not just routes (the mint-gate lesson).
3. The routes (dlv.create / dlv.unlockRouted / dlv.reconcile /
   dlv.close): fetch-and-root pre-flights — the only layer allowed to touch
   the network. A trader may root a pair for the first time at settle;
   dlv.create now refuses a leg that is not a real, rooted asset at all.

Tests

• The conjunct driven through the FULL validation stack with a real DlvFund
  witness: rooted transferable leg validates; ERA+dBTC pair validates with an
  EMPTY anchor store (builtins never consult the resolver); non-transferable
  refused by name; unrooted fails closed as Incomplete; bytes that do not
  re-hash refused.
• Route level: unrooted leg refused by name (the closed hole), rooted
  non-transferable refused by name, rooted transferable passes the policy
  gate (positive control pinned to the balance check).
• Funnel level: a DIRECT DlvCreateFundedV2 advance — no route — refused by
  name.
• Mutation controls, each red-then-restored: the lineage conjunct neutralized
  ⇒ reserve encumbrance of a non-transferable asset VALIDATES (red); the
  funnel gate neutralized ⇒ the same asset sails to the balance check (red).
• The shared funded-vault fixture now roots REAL transferable policies and
  derives its pair from their commits — its old arbitrary byte-pair was
  exactly the hole this closes, and 20 tests fired on it as designed. One
  wire-shape test kept fixed byte patterns (its naive tag scan reads raw
  bytes a real hash can legitimately contain).

Notes

• The settle/reconcile/close route gates share the single pre-flight helper
  proven at create; their dedicated route-level drives arrive with the
  PR6 e2e fixtures. The funnel covers those operations for every caller
  meanwhile.
• The 0x0026/0x0027 outer-vs-inner addressing defect remains assigned to the
  PR5/PR6 producer cuts (this cut did not touch those evidence sections).
• Policy checks stay inside Req 4.3's predicate budget: hashing, parsing a
  bounded blob, boolean composition.

Verification (exact gate commands, pinned 1.98.0)

workspace  --release   3934 passed / 0 failed across 72 suites, exit 0
node       --release   270 passed / 0 failed, exit 0
make lint              exit 0
production safety      exit 0