docs(dlv): the trader fence's own prose contradicted Ruling V3, and it misled a reader

[cryptskii]

What

dsm/src/dlv/trader_fence.rs carried prose that contradicts a frozen ruling merged in #801.

The module said acceptance through ordinary DSM bilateral advancement was "the only thing that consumes a committed fence", and that Class K "releases it only when that exact successor is accepted".

2c-C4 Ruling V3 says the opposite:

The terminal fence event fires only on a verdict that certifies. Its name must not tempt anyone to move release beside the advance outcome.

Recorded consequence: because a market verdict cannot certify until 2c-D (Ruling R1), market fence release is unreachable until 2c-D. That is the intended state, not an oversight.

§7's gate table agrees: fence release requires may_certify().

Why it matters

The prose did exactly what V3 warned against. Working the 5c-2 Step 2 ordering from source, I derived a sequence in which the ordinary advance released the fence, and traced that reading back to this banner. An adversarial re-read against the frozen amendment caught it before any of it was implemented.

This is the same defect class as the 2c-C2 peer_lineage.rs comment that certified an absence: normative prose in a core module asserting something the frozen document denies.

No behaviour change

The pure transition is already correct. V3 governs who may emit SuccessorAccepted, not what next_state does once the event exists. Only the prose conflating the precondition with the trigger is rewritten. No transition, no test and no signature is touched.

Acceptance is now stated as necessary but not sufficient: the precondition is the accepted successor, the gate is C3Verdict::may_certify, and market release is unreachable until 2c-D.

Also: the wiring status was misleading

The banner read as though the advancement gate were live. It is not:

• permits_successor has zero production callers; its only call sites are its own unit tests.
• Its SDK wrapper active_verdict likewise has zero non-test callers.
• The bilateral advance path consults no fence at all.
• The only live reader of the table is the composition overlay, which merely reports occupancy and is explicitly not fail-closed.

Wiring the gate is 5c-2 Step 5, after admission routing and TA_B. The banner now says so, and tells the reader not to mistake the frozen predicate for a live gate.

Verification

• cargo test --locked -p dsm trader_fence — 7 tests, all pass.
• make lint at repo root on pinned 1.98.0 — passed.
• bash ci/production_safety_checks.sh — all checks passed, including TLA+.