fix(economic): an observer derives one of four answers about a slot cell, and an error is never emptiness

[cryptskii]

Summary

Hardening the reader that turns member responses into an authoritative observation, before the settlement-slot register is promoted from market coordination to economic authority.

Given the vault's birth-committed storage set S, an observer derives exactly one of:

    Claimed(C)        a quorum returned byte-identical contents
    EmptyAtQuorum     a quorum EXPLICITLY reported no row — true of the moment it was read
    Conflict          contradictory non-empty claims, no quorum winner
    Unavailable       the read establishes nothing

What the gate review found

The write-once primitive is sound: one writer, insert-if-absent with same-transaction read-back on both backends, no update or delete path, durable before the acknowledgement, nothing replicates the claim table, no rollback path in code, and disjoint quorums impossible at an honest quorum. The defects were all in the reader.

#	defect	severity
1	any non-200 counted as "no value", and the node-id echo is an outermost layer present on 5xx — so a quorum of members with a failing database manufactured EmptyAtQuorum, the terminal condition of a forward walk	high
2	the committed quorum was checked only for non-zero and not-larger-than-the-set, so a signed 1-of-3 was accepted — two disjoint claims each reach quorum	high
3	the winner was chosen with find over a HashMap before the conflict check, so the choice depended on iteration order and the divergence went unreported	high (with 2)
4	the provenance read resolved the cell against the verifier's configured fleet, not the vault's committed set; the composer never checked the winner's set at all	medium

The repairs

1. Member read semantics. Only an explicit 404 from a correctly attributed member is an absence. Transport failure, timeout, 5xx, an unreadable body, a missing or wrong node id, and a member this client cannot locate are all Unavailable. Attribution is folded in at the read, so an unattributed response is never counted in either direction.
2. Canonical quorum. q must be the strict majority of the committed set, exactly — derived, never chosen — checked as soon as V_n is decoded, before anything downstream relies on it.
3. Deterministic observation. The tally completes before anything is selected. Two values at quorum is a Conflict, not a race. A minority disagreement beside a strict-majority winner still resolves, because write-once rows mean the loser can never gain a majority.
4. Authority-set consistency. The set is resolved by re-deriving its id from the member ids a catalog entry lists and requiring that to reproduce the signed id; configuration says where to reach a member and can never substitute a set. The composer now also refuses a winner claimed under a different set.

Proof

Every case you named, plus the mutation controls:

case	result
3 members, all reads fail → Unavailable, never EmptyAtQuorum	green
3 members, 2 explicit not-found + 1 unavailable → EmptyAtQuorum	green
3 members, committed q=1 → refused as noncanonical, before the cell is read	green
A,A,B → Claimed(A)	green
A,B,unavailable → Conflict	green
A,empty,unavailable → Unavailable	green
claim from a different storage_set_id → refused	green
a mis-echoed or failing member is never counted as an absence	green
a foreign set does not resolve from the catalog	green
mutation, one per repair plus the transport classification	each reddens only its own named test; restored checksum-verified
boards	workspace 74 binaries, 3978 passed / 0 failed / 17 ignored (dsm lib 1699/0, dsm_sdk lib 1816/0/7 ignored), exit 0; node 11 binaries, 276/0, exit 0; root make lint exit 0; ci/production_safety_checks.sh PASS (pinned 1.98.0, incl. TLA+); scripts/ci_scan.sh PASS — all on tree stamp a5b264255c88

One honest note on the mutation work: the transport arm was green on the first attempt, because no test reached that branch — a gap in the test rather than a passing gate. The test was extended to cover a failing member and the cycle rerun, which then reddened.

A scope note you should see

beta_storage_profile::is_conformant_commitment is removed. It was the uncalled verifier-side rule this change replaces, and its test is re-rooted onto the canonical one; the two agree at the deployed three-member cardinality. The module's constants stay — one is used by the root-register profile.

The "wrong local fleet, correct birth set" case is covered by the catalog re-derivation test rather than end to end, because in beta the configured fleet and every vault's birth set are byte-identical, so the two are not behaviourally distinguishable today. Stated rather than claimed as more than it is.

Test-name reconciliation

+11 / −2. The two removals are replacements, each with a named successor covering the same proposition at the layer the property now lives: a_committed_q_is_checked_against_the_profile_not_recomputed → the_profile_threshold_is_the_canonical_quorum_for_the_deployed_fleet, and an_unattributed_read_row_is_uncountable → a_mis_echoed_or_failing_member_is_never_counted_as_an_absence, which now also covers an outage.

The storage-node conformance suite is the dependent this change owed a sweep, and it caught it: that test pins the fake fleet to real node behaviour, and it now asserts against a real node that an unreachable member reads Unavailable and never an absence.

Not in this PR

The vault-lineage verifier, the depth bound, and griefing. Per the locked order, the adversarial gate review is rerun from scratch against the merged tree, and the lineage work starts only if it comes back clean.