fix(sofi): the exercise carries the trader's balances before the trade; a lineage known invalid is Invalid (SoFi Amendments S12, S13)

[cryptskii]

The defect

Once one device had traded through a vault, no other device could judge that trade (CONFORMANCE §6.39).

• TraderSideValid recomputes each balance the trade moves from the balance before it. T° states that balance only by the hash of its leaf.
• A verifier that was not the trader had no source for the value (Acquired::NoSource).
• So the owner's sofi.close of a traded vault never resolved, and no device could judge another trader's route.

The fix: SoFi Amendment S12 (owner ruling, 2026-09-29)

The exercise carries each such balance as a content-addressed TraderPreBalance (class 0x0061). The pre-E closure names it, so E commits it.

• A value counts only because it hashes to the leaf the core states.
• A balance the closure does not name is Invalid.
• A named object not yet in hand is waited for.
• Every verifier reads the trader's balances from these objects, the trader included.

Spec and requirements

• SoFi §17.5 Amendment S12, the class and tag tables, and §36.
• MASTER MR-SOFI-0338–0341 (MR-SOFI-0241 untouched); §1 re-pinned.
• CONFORMANCE §6.40 and §8; MR-SOFI-0255 is now Met.
• VERIFICATION_MATRIX rows with mutation controls, and intent manifest rows.

Core

• TraderPreBalance: a strict decoder and its own address namespace. closure_content_address gives the class its address.
• trader_pre_balances in validation: exactly one object per stated balance, each naming P's trader.
• A relationship's leaf before the trade is its base, proven by the fold, so realize_root reads only T° and E.
• Deleted: Evidence.trader_leaves, Missing::TraderLeaf, Acquired::NoSource, NotEstablished::RouteEvidenceHasNoSource, Verifier.local, and LocalLeaves::{trader_evidence, owns, pre}.

SDK

• The draft builds the objects from the trader's leaves, names them in canonical order, and publishes them. The exercise carries them.

Also found and fixed

• accepted_claim_at answered for any trader from this device's own admitted store, labelled with the other trader's identity. That is a fabricated claim, unreachable until foreign routes got past NoSource.
• It now uses the peer walk for another trader. The walk keeps the claim advance_validated accepted.

Evidence (local, release)

• dsm crate: 1,607 passed, 0 failed (cargo test --locked -p dsm --release).
• dsm_sdk SoFi, node end-to-end and peer suites: 23 passed, 0 failed, on the storage node over Postgres. Includes:
  • a_vault_traded_through_closes_for_its_owner, the §6.39 reproduction, now Realized with both reserves paid;
  • every_sofi_route_reaches_its_producer, all eight sofi.* routes through the router.
• make lint: exit 0.
• Core negative tests: 9. Each gate was mutation-tested, with a named test red for each. The first round found two redundant checks; both are deleted.
• Frozen wire vector: checked against the independent encoder.
• Review gate: satisfied (round 2).

Still to do in this PR

• Pins. The code map's evidence pins for the touched closures are stale until they are repinned from this commit's CI map and board log. The new rows (MR-SOFI-0338–0341) get pinned then too. The PR stays a draft until then.

SoFi Amendment S13: a lineage known invalid (owner ruling, 2026-09-29; second commit)

Once other traders' routes could be judged, one hole remained. A trader whose lineage validation finds Invalid never yields an accepted claim, and under Amendment S9 its setup was "not evaluated". Its trade would hold a vault key forever.

The ruling:

• history not established yet: wait;
• history valid: evaluate the setup as before;
• history established invalid: the setup is Invalid, so the route is Invalid.
• No accepted claim is synthesized: the negative fact is the lineage verdict itself.

What changed:

• Spec and requirements: SoFi Amendment S13, beside S9. MR-SOFI-0331 rewritten, MR-SOFI-0342 added, the spec re-pinned.
• Reader: SofiReads::accepted_claim_at returns the walk's result in its own class.
• Core: setup_lineage reads that class. Invalid and Quarantined become the verdict. Quarantined is a divergent register cell, the same reading the existing vault-owner check uses. Incomplete and Unresolved wait.
• Setup check: setup_valid refuses a setup on a lineage known invalid (Invalid::SetupLineageIsInvalid). A verdict about another trader or position establishes nothing.
• Tests: three Core tests; four mutations, each turning a named test red.
• Local runs: dsm 1,610 passed, 0 failed; dsm_sdk SoFi and node end-to-end 23 passed, 0 failed; make lint 0. Review gate satisfied (round 4).

Open (CONFORMANCE §6.40)

• P15-9, unchanged: the peer walk refuses a resolved SoFi position. A trader whose setup follows its own earlier SoFi trade has no setup claim another verifier can accept. This is a separate evidence and replay problem, not part of S13.