feat(2c-D): PR B — construct and publish TA_B from the economic post-state

[cryptskii]

PR B of the owner's three-change producer/cutover decomposition.

PR A (#852)  bundle-aware settle write set; 0x0032 becomes mandatory
             -> the acceptance leaf is guaranteed to EXIST
PR B (here)  construct and publish TA_B from the resulting post-state
             -> TA_B is guaranteed to be CONSTRUCTIBLE and REACHABLE
PR C         the realization / fence-release cutover
             -> live realization is ALLOWED to consume it

Before this, TraderAcceptance::new had no caller outside its own tests. 2c-D §7 was constructible in the verifier and unreachable in the live settle path — a verifier with no subject.

The path comes from the finished tree, and that distinction is testable

TA_B proves the acceptance leaf's inclusion under R_T^+, so its path is the one that holds in the final post-state. A mutation's own captured siblings are not that path: the write set captures mutation i's siblings with mutations 0..i applied, and the leaf's key is a hash, so nothing places it last.

the_leafs_own_captured_siblings_are_not_the_path_under_the_final_root pins it — and it had to choose an operation id to do so. Written the obvious way, the fixture's acceptance sorted last, the two paths agreed, and the test passed while proving nothing. It now picks an id that keys the acceptance before the debit.

Mutation control, executed: replace tree.siblings(&key) with the mutation's own captured siblings. That named test goes red, and all eight §7 round-trip tests go red with it. Restored from a byte copy; re-verified green.

Identities are consumed, never chosen

b and economic_operation_id arrive inside the emitted leaf, lifted out of the witness — there is no parameter through which a caller could supply either. Both the tree and the witness are pinned to the validated root before anything is read out of either, so one transition's leaf can never be paired with another's proof.

Nothing is realized

No CompleteValidity::from_market_witness, no fence release, no realized frontier, no receipt publication, no BundleAcceptanceWitness.

a_settled_market_publishes_a_trader_acceptance_and_realizes_nothing asserts publication and non-realization together, over the live route. A test that only proved publication would not notice a premature release; one that only proved nothing released would have passed before the producer existed.

The stale comment at the settle call site — "no bundle-acceptance witness exists to construct" — is corrected in the same change. The artifact now exists; the witness still does not.

Dependent sweep

Every market settle now publishes one additional immutable artifact. immutable_keys_in_fleet is namespace-scoped to vault-state/anchor-presentation, so artifact-count assertions are unaffected; the durability gate runs before the post-admit push. The 16 settle-dependent dlv_routes tests were enumerated by call site and run individually. The crash-resume path replays the frozen witness onto the validated pre-tree, so it produces the identical content-addressed object.

No locator is returned from the admission outcome: ta_B is the object's inner address under its namespace, and a Def 14.2 receipt binds ta_B — a second copy threaded through would be one more place to disagree. PR C adds a fetch path with the code that reads it.

Files

dsm/src/economic/acceptance_produce.rs	the producer + 8 unit controls
dsm/tests/trader_acceptance_producer.rs	produced TA_B meets §7, 8 tests
economic_admission_flow.rs	published from the one snapshot
dlv_routes.rs	the live-route control
amendment 2c-D §6	the producer-adoption record

Verification

economic::acceptance_produce            8/8
trader_acceptance_producer              8/8
bundle_acceptance_write_set            12/12
economic_write_set                     23/23
trader_acceptance_conformance            5/5
bundle_acceptance_leaf_conformance       7/7
sdk::economic_admission_flow             1/1
dlv_routes settle-dependent set        16/16
make lint                              exit 0
ci/production_safety_checks.sh         exit 0