feat(dlv): the genuine market bundle producer, and the vector regenerated from it

[cryptskii]

Amendment 2c-E §8.4's one-time operand replacement, and 5c-2 Step 2. Every fabricated market operand goes at once; none is invented anywhere in the tree any more.

The producer

dlv/market_producer.rs derives all of them from a real signed operation:

operand	how
operation_bytes	the caller's signed Operation::DlvSettle, canonically encoded. Refused unless it is a settle carrying a signature — an operation cannot be signed afterwards, because the signature is inside the bytes the chain tip hashes
trader_successor	relationship_chain_tip_v2 recomputed over exactly those bytes. There is no parameter through which a caller could supply it
trader_parent	the same embedded parent the tip was computed from, so 2c-B's second chain-tip equality holds by construction rather than by a check someone could forget
sigma_dsm	SPHINCS+ over the substrate signing digest — the same chain the economic substrate's own producer signs, so one accepted successor has one signature rather than two that can disagree

It deliberately does not reuse economic::successor_evidence, which signs that digest and then encodes protobuf. Registry §2.10 forbids protobuf bytes from being hashed as a CCB blob, and 2c-B records that the protobuf object violates it twice. The signing chain is shared; the encoding is not.

The deferred conjuncts now hold, and are tested

G4 the successor is the recomputed tip · G1/G2 the bytes decode under the frozen grammar and re-encode identically · G3 discriminator 26 and Unilateral.

They are not yet wired as production gates — that arrives with the live path.

Fixtures no longer invent

The conformance test's op_bytes_fixture (300 filler bytes) and sigma_fixture (a byte pattern) are deleted. Neither could ever have satisfied G1–G4, and a vector whose operands cannot satisfy the rules it exists to pin is pinning the wrong thing.

The two refusal vectors keep their single deliberate mutation and take every other operand from the producer.

The vector stays class-1. What changed is where its inputs come from, not where its expected bytes come from: the independent encoder still re-encodes separately from the production encoder, so agreement remains evidence rather than a tautology.

The regeneration

MARKET_B, MARKET_ADDR and MARKET_LEN regenerated once from genuine producer output. This is §8.4's one-time replacement, distinct from #829's schema-forced movement.

MARKET_LEN 51,091 → 101,186, and the reason is worth stating: operation_bytes is now a real settle preimage embedding the settler's own 49,856-byte signature, so a market bundle carries two signatures where the filler carried none. Still an order of magnitude under the node's 512 KiB ingress cap, which the closure test asserts directly.

The close vector is byte-identical — same digest, same address, same 50,330 length. That is the isolation signal worth having: nothing leaked outside the market arm.

Mutation controls

Restored from a byte copy and verified identical afterwards.

mutation	result
remove the unsigned-settle gate	an_unsigned_settle_is_refused red
compute the tip over empty bytes	both g4_the_successor_is_the_recomputed_chain_tip and a_different_operation_yields_a_different_successor red

The second is the one that matters: it shows the tip really is a function of the bytes.

Suites

Serial where the module needs it. dsm lib 1794/1794 · conformance 12/12 · producer 8/8 · ccb_conformance 11/11 · dlv_successor_conformance 5/5 · settle provenance 15/15. dsm_sdk binding occupancy 10/10 · settlement bind 7/7 · settlement resume 2/2 · vault state composition 22/22 · dlv_routes 37/37.

Dead code deleted in the same change: the in-module intent() helper and five now-unused imports, both stranded by the delegation.

make lint green; production safety checks green.

Scope

This does not lift the market emission refusal and does not touch the live route. Wiring the bind path is next, and realization stays unreachable until 2c-D.