SoFi rig fixes (S16, S19, wallet records), ERA two decimals (S18), storage liveness and no clock

[cryptskii]

The 2026-10-01 phone-rig fixes from all three sessions, in one PR at the owner's direction. It replaces CORE's #1087 and STORAGE's #1088, both merged into this branch:

• SOFI: SoFi Amendments S16 and S19, a walk blocker found while building S16, and the wallet's records of SoFi (§§1–4).
• CORE (was feat(core): ERA has two decimals (SoFi Amendment S18); storage requests time out #1087): ERA has two decimals, SoFi Amendment S18 (§5).
• STORAGE (was fix(storage): a silent set-mate cannot hold the mirror sync; no node source reads a clock; five route-chain rows re-verified #1088): a silent set-mate can no longer hold the mirror sync, and no node source reads a clock (§6).

1. SoFi Amendment S16: a vault is found by its tokens, and its setup is the first step of the first trade through it

Rig finding. sofi.findRoute searched only the vaults the trader had already set up with, so the rig's first trade (9FF through 8XK's vault) went through only because 9FF set up by hand.

The token index.

• Creating a vault now indexes its genesis preimage under vault_token_locator(t) for each of its two tokens.
• TAG_DSM_SOFI_VAULT_TOKEN_LOCATOR is new; the tag count tripwire goes from 351 to 352.
• Verifier::vaults_of_token keeps a candidate only when vault_genesis accepts it and the accepted market pairs the token. Junk bytes, a forged genesis, and a real vault of another pair are passed over.
• A candidate the reads cannot decide makes the discovery partial, never Invalid.

Path search.

• findRoute reads the input and output tokens' indexes, not the trader's relationships, and needs no setup.
• SofiFindRouteResponse.search says whether the search saw every vault. A partial search with no route is an error in the app, never "no route".
• This replaces §6.31's behaviour, where an unestablished vault made the whole search an error.

Setup.

• set_up_with admits the setup transaction for any vault on the route that the trader has no setup with: one per vault, in hop order.
• It runs only after the route is priced at the walked heads, so a route that cannot be built admits nothing.
• The owner's first Close does the same. Later trades reuse the setup.
• sofi.setup is no longer a route (envelope field 121 reserved).

sofi.vaults (new route, envelope field 126). Lists the vaults the device created, from the VaultCreation leaves of its validated root, each walked to its head: reserves, fee, generation and status. Storage → DLVs shows them above the dBTC vaults.

2. Beta blocker: another trader's conditional parent stalled every walk

The bug.

• A vault walk that met another trader's exercise whose P names its trader's earlier SoFi position as parent answered ParentUnresolved and stopped.
• So after any trader traded twice through a vault, every other device's walk of that vault stalled. The owner saw stale reserves, and the next trader's attempt went stale.
• The rig didn't hit it because 9FF traded once.

The fix.

• The walk now resolves that parent through peer_root_at. It's a new entry point in economic/peer_lineage.rs, written to CORE's spec and reviewed by CORE.
• It walks the trader's lineage from the walker's frontier, with the position itself resolved by S15's PeerPositionResolver, as an interior conditional position.
• The parent counts only as the position and fulfillment P names (parent_named).

Two related changes.

• Resolving a position bounds each vault's chain at the parent its leg names (chain_until). Unbounded, it walked into the very exercise whose parent it was resolving, and the stack overflowed.
• Verified roots are kept per reads context, so k exercises by one trader don't each re-walk its lineage.

Known cost, recorded in CONFORMANCE §6.53. A walker without a frontier for a trader walks that trader's lineage from activation, with a 512-step budget. A trader with more than about 500 positions is Incomplete for such walkers. Whether a walk should record frontiers is an owner question.

3. SoFi Amendment S19: a route chains or splits

Owner ruling (2026-10-01): "It should be no different. It just happens to be the same token," and "It should work either way."

Core rule.

• A Swap route's hops either chain, or all trade the intent's one pair through distinct vaults, with inputs and outputs summing to the intent in checked arithmetic.
• validate_swap decides the shape against the intent; a split that doesn't sum is Invalid::SplitDoesNotSum.
• route_endpoints is the one rule the producer states the intent by.

Producer.

• The search weighs each pair of direct vaults as a split, beside single hops and chains, and proposes the route that gives the most.
• The split share is searched over the inputs both legs price.
• The trade plans the same split again at the heads it walks.

4. The wallet's records of SoFi (rig rulings; display caches, not requirements)

• History. Token creation, vault creation, setup, and a realized trade, route or close each write a history row naming every token moved with its signed amount (TransactionInfo.moves, types 7–11). The wallet renders each line.
• Balances. On every such event the projection of each moved token is rebuilt from the head, keeping any lock. A realized trade shows in balance.list at once, not after a restart.
• Amounts. SoFi request amounts are text in token units (*_entered), parsed by parse_display_amount_to_base_units against each token's committed decimals. Reported amounts carry *_display. sofi.trade and sofi.route name the output token, and the route must give it.

5. ERA has two decimals: SoFi Amendment S18 (CORE, was #1087)

Owner ruling (2026-10-01): ERA is divisible to hundredths. The fee model is unchanged: the fee comes out of the input and the trader pays it.

• Policy. Decimals 2. The supply is 8,000,000,000,000 base units (80,000,000,000.00 ERA).
• Commitment. New commitment NNG176RZ6ACTWCDPRNYHXZK2DCZ72SPA9Q6XWGRGQ9JGKZYTESG0, a clean cut. The ERA reserve id hashes the commitment, so the new ERA has its own reserve chain and the nodes need no wipe.
• Unchanged in whole ERA. The faucet pays 10,000 base units (100.00 ERA) and the creation fee is 1,000 (10.00 ERA).
• One conversion. The SDK's parse_display_amount_to_base_units and format_base_units_for_display convert amounts. The SoFi routes use them too (§4), so MR-SOFI-0349 is Met here.
• Storage-member HTTP client (SDK). A member has 10 s to accept a connection and 30 s to answer a request. On the rig, a position write sat with no member answering and no error. A member that never answers is now a member that did not answer, which every flow already handles. It is a transport bound: no validity or ordering decision reads it.
• Tests. Funding is stated through economic_fixtures::whole_era(n). The vertical_validation trace token_manager_balance_replay (feat(core): ERA has two decimals (SoFi Amendment S18); storage requests time out #1087's red CI) is fixed.

6. Storage: a silent set-mate cannot hold the mirror sync; no node source reads a clock (STORAGE, was #1088)

The liveness bug (CONFORMANCE §6.54).

• The node's set client had no connect or request bound, and mirror_sync holds a node-wide one-at-a-time lock. A set-mate that accepted a connection and never answered held that sync, and every later one, open indefinitely.
• The fix:
  • set_client gets a 5 s connect bound and a 10 s request bound. A fetch that times out fails like an unreachable set-mate (502, lock released) and stores and orders nothing.
  • MAX_SYNC_CYCLES drops from 1024 to 128, so one sync stays inside the SDK's 30 s bound.
  • route_seats::read_cell asks every seat at once.
• Test: a_set_mate_that_never_answers_fails_the_sync_and_frees_it. With the timeouts removed it goes red.

MR-STOR-0008, Partial → Met.

• dsm_storage_node::no_clock_reads parses every node source with syn and refuses Instant, SystemTime, UNIX_EPOCH, chrono and tokio::time.
• Mutation controls, each red: a grouped-import tokio::time sleep in the spool, and Instant::now() in db/pg.rs.
• ci/no_clock_and_no_json.sh loses two node exemptions.

Records only. MR-STOR-0131, 0133, 0138 and 0094 re-verified Met; 0134 stays Partial.

Tests (release, on the shipped Postgres node backend)

At the combined head 83b6f61 (all three branches merged):

• Node suites. dsm_sdk node_e2e, sender_admission, realized_records and sofi_flow: 35 passed, 0 failed.
• Core. dsm lib, the sofi::, economic::, core::token, core::state_machine and common::domain_tags tests: 335 passed, 0 failed.
• Validation traces. dsm_vertical_validation: 28 passed, 0 failed (token_manager_balance_replay fixed; feat(core): ERA has two decimals (SoFi Amendment S18); storage requests time out #1087 was 27/1).
• Storage. dsm_storage_node no_clock_reads: 2 passed, 0 failed.
• Frontend. jest 52 suites, 303 tests, all passing; tsc clean.
• Static checks. make lint exit 0. real_code_guard clean. ci/conformance_evidence.py: 805 rows, 0 failures.

Before the merge, on the SoFi branch alone: the whole dsm crate, lib and integration, 1,616 passed and 0 failed. CORE's and STORAGE's boards are in their sections above.

New SoFi tests.

• Node: discovery_passes_over_what_is_not_a_vault_of_the_token; a_route_search_that_cannot_see_its_vaults_says_so (renamed); every_sofi_route_reaches_its_producer (no manual setups, sofi.vaults, the owner's walk past B's second trade); a_realized_trade_shows_in_balances_and_history_at_once; one_order_fills_through_two_vaults_of_the_same_pair.
• Core: a_route_chains_or_splits_and_its_endpoints_follow; a_split_whose_legs_sum_to_the_intent_is_not_refuted_by_its_shape; a_split_that_does_not_sum_to_the_intent_is_invalid; only_the_position_and_fulfillment_p_names_resolve_its_parent; a_frontier_recorded_at_the_position_is_its_root_and_nothing_is_read; the_activation_root_names_no_parent.

Mutation controls (each restored byte for byte, each with a named test red):

• discovery without the market check;
• trade without set_up_with;
• no projection rebuilt on realize;
• peer resolution with an unbounded chain (stack overflow);
• no split candidate;
• a partial discovery reported complete;
• parent_named accepting any fulfillment, or skipping the position;
• peer_root_at standing below the position;
• no route read as a split;
• unchecked split sums.

Records

• MASTER. MR-SOFI-0350–0359 added beside CORE's MR-SOFI-0349; MR-SOFI-0255 updated (the routes); §1 re-pinned to the merged SoFi specification; 928 canonical requirements.
• CONFORMANCE. §6.53 (SoFi) and §6.54 (STORAGE's, renumbered), plus rows for each new requirement and updates to 0255, 0256 and MR-DSM-0219. MR-SOFI-0349 is Met. Totals regenerated.
• Other files. VERIFICATION_MATRIX rows, INTENT_MANIFEST rows. INTENT_PINS will be repinned from this PR's Code map.

After merge

• Rig phones need a wipe and re-provision. ERA's identity changed, so nothing under the old commitment carries over.
• Then the three-phone run:
  • Phone A creates token RIGT with a deep ERA/RIGT vault and sends RIGT to phone B.
  • B opens a second ERA/RIGT vault.
  • Phone C, set up with nothing, swaps an amount that fills best split across both.
• Frontend fixtures that still describe ERA as decimals: 0 (practice mode, some jest mocks) are queued for the frontend sweep.

Coordination

• CORE reviewed the SOFI edits in its area: economic/peer_lineage.rs (peer_root_at, chain_through), core/bridge.rs (the response list) and the domain-tag count.
• feat(core): ERA has two decimals (SoFi Amendment S18); storage requests time out #1087 and fix(storage): a silent set-mate cannot hold the mirror sync; no node source reads a clock; five route-chain rows re-verified #1088 are closed as included here. One repin of INTENT_PINS from this PR's Code map covers all three.