feat(ccb): the VaultStateV2 encoder, checked by an implementation that shares no code

[cryptskii]

Stacked on #689. Base is docs/rev15-release-policy-and-vault-state; merge that first.

Step 2+3+4 of the registry's ordering, in one PR because the encoder and its independent check are only meaningful together. Anchor V2 is the next PR, deliberately separate.

Scope: the closure, and nothing else

0x0001, 0x0002, 0x0004, 0x0005, 0x0007, 0x0009, 0x000A — exactly what c_n depends on.

TradeIntent, ReferenceWindow, B_M and M are not encoded despite being specified, because they are not in the closure. The five blocked routing/settlement classes get no placeholder encoders at all — that would be the encoder-defines-the-protocol failure the ordering exists to prevent, and it keeps 2b/2c free of churn here.

No decoder on the production side

CCB is not self-describing. A decoder written beside the encoder would share its assumptions and prove nothing, so parsing lives only in the independent implementation.

The independent check

tests/ccb_conformance.rs is an integration test, so the pub(crate) writers are unreachable by construction. It rebuilds every byte from the registry text in a different shape — explicit concatenation rather than a shared push buffer — so a transcription slip cannot be common to both.

It also parses CCB(V_n) back into fifteen fields, which is the only thing that demonstrates the bytes are uniquely readable.

The boundary that matters

Field 14 nests StorageSet in its frozen envelope-less layout; field 15 is a bare u32. If a generic "nested = envelope" helper ever wrapped S, the bytes would stay perfectly deterministic and stop being normative.

The parser asserts it consumes exactly its input with nothing trailing, that q reads as 4, and that splicing an envelope in front of S is detectable rather than silent.

Mutation-tested

Mutation	Result
wrap S in the generic envelope	4 of 7 red, including the boundary test written for it
skip the absent-optional marker	3 of 7 red
restored	7 green

Refuse, don't repair

Per Req 3.2 — an unordered or equal token pair is rejected rather than swapped, a duplicate set element rejected rather than collapsed, fee_bps ≥ 10_000 rejected. Silently repairing any of them maps two distinct logical inputs onto one byte string.

Vectors

Genesis, market successor, terminal close, plus a populated encumbrance set — the last so the nested element encoding and its §2.4 ordering are exercised rather than left at an empty set, which is where a second implementation is most likely to differ. Insertion order is proven not to survive into the bytes.

storage_set_id is checked unchanged when reached through this module, since every deployed vault's anchor already commits one.

Local gate

• cargo fmt --all -- --check clean
• cargo clippy --all-targets -- -D warnings clean
• cargo test -p dsm --lib — 1644 passed, 0 failed
• cargo test -p dsm --test ccb_conformance — 7 passed, 0 failed