docs(sofi): three operator docs still say the trade settles, and it does not

[cryptskii]

The problem

Three operator-facing documents describe market settlement as working:

• sofi-two-device-playbook.md tells an operator to execute the routed unlock, and says the status then reads "Trade settled. Reserves refreshed."
• sofi-lp-walkthrough.md says "the unlock proceeds".
• cross-device-sofi-test.md lists "dlv.unlockRouted works for a non-owner trader" as a proven capability, adding "The unlock itself proceeds for any caller."

None of that is true on main. The trader's routed settlement is deliberately fail-closed:

dlv.unlockRouted: market settlement is deployment-blocked until 5c-2 Step 2 — a canonical market bundle needs the bundled trader successor evidence, which this device cannot produce before it advances; vault … was NOT bound and nothing moved

Anyone following the playbook hits that refusal at the settle step, and nothing in these documents lets them tell a deliberate deployment block from a broken build or their own misconfiguration.

The treatment

A status banner per document, not a rewrite. Same discipline the 5c-2 plan got: the bodies record what was validated when they were written, and rewriting them would destroy that record. Every step before the settle is still correct, so the runbook stays usable right up to the trade.

Each banner states precisely:

• What is refused — only the market settle, and only after every eligibility gate has passed, with nothing stored, fenced, bound, signed or advanced. The trader's balances do not move and the vault generation stays free.
• What still works — vault creation and funding, routing advertisement, discovery, quoting, and the owner close path, which is live and unaffected. I verified the close path carries no such refusal.
• That no setting lifts it. Without this the failure reads as configuration, and someone will go looking for a flag that does not exist.
• Why — the ordering problem: a canonical market bundle must carry the trader's prepared successor and its 0x0031 evidence, and today the trader binds before it advances, so no signed successor exists to name. Nothing may be fabricated in its place.

Verification

Markdown only. Neither make lint (cargo fmt, clippy, frontend eslint) nor ci/production_safety_checks.sh reads markdown, so neither gate's result can change; CI runs both regardless. The refusal text and the close path's absence of one were both read from origin/main, not from the working tree.