feat(storage): a member holds a generic binding record and exchanges it conditionally, blind to settlement

[cryptskii]

PR 1 of the QuorumBind restoration (owner decision 2026-09-05: keep Rev-15's architecture, do not amend the spec to bless the one-shot register). This is the Class N half only — the application-blind storage primitive the Class K driver (PR 2) will run against. The settlement-slot register is untouched here; it is deleted in PR 5 when the settle paths switch (§22 #2, #12).

What this adds

SoFi Rev 15 §15.5 / Def 6.20, as written.

• GenericBindingRecordV1 = (schema, round=(counter, proposer_id), tx_id, keyset_digest, value_digest, value_addr, status). Rounds order lexicographically — counter first, proposer_id second — and the struct's field order is what makes the derived Ord that order.
• CompareExchangeManyRequestV1/ResponseV1 with the four outcomes APPLIED / EXPECTATION_MISMATCH / UNAVAILABLE / INVALID_STORAGE_ENCODING, resulting_digest, member_id, and — new to the write side — register_incarnation.
• ReadBindingRequestV1/ResponseV1 returning cells (absence is the member's assertion), the set digest, member_id, register_incarnation.
• Endpoints POST /api/v2/storage/binding/cas (device auth — a registered device is writing; no claimant check, there is no claimant in a generic record) and POST /api/v2/storage/binding/read (public).

What the node inspects, and only that (Req 15.7): schema, round ordering, the exact expected digest of the prior record set, key-set equality. It never decodes the value at value_addr, never checks a storage set, never knows a vault, a trade, or q. There is no foreign-set check here on purpose — that was §22 #12's violation in the register, and its job moves to Class K's authenticated-identity count (Req 15.8) in PR 4.

One decision for both backends. db::binding::decide_compare_exchange is pure and shared; Postgres and SQLite supply only I/O around it (lock, read, decide, write all-or-none, durable commit). Order of checks, each fail-closed: byte-identical replay on every key re-acks (a crashed proposer converges by retrying); the exact prior set digest must match; the replacement's round must be strictly greater than every round held — a matching digest proves the caller saw the state, and a round that doesn't supersede it still must not overwrite it (an equal round with different bytes is a proposer reusing a round for a second value).

Absences are in the digest. record_set_digest hashes key ‖ 0x00 for an absent cell and key ‖ 0x01 ‖ record_digest for a held one, so "nothing held" has a defined digest a first writer exchanges from, and a member that lost a row produces a different set digest rather than a coincidentally matching one.

Every answer names the member twice. The identity echo layer stamps the configured node id; both endpoints stamp x-dsm-register-incarnation and carry both in the body. A write acknowledgement can now be attributed on (member_id, register_incarnation) — the gap gate D found in MemberClaimOutcome — once PR 4 teaches the client to require it. AppState gains configured_member_id (the raw [node] id the catalog names) beside the canonical StorageNodeId, because those are different facts and the proto must carry the one a quorum counts.

Atomicity and concurrency. Postgres: one durable transaction (begin_durable_write), a transaction-scoped advisory lock per key in the caller's strictly-ascending key order (absent keys can't be row-locked; ordered locks can't deadlock), upsert all keys or none. SQLite: the single serialised connection.

Tests

• Core (dsm::storage::binding_record, 5): lexicographic round order; canonical round-trip with padded/mis-width/dead-schema refusals; key-set validity; set digests name absences; a request binds its own key set.
• Decision (db::binding, 3): first writer from the empty digest and stale expectation refused; round never moves backwards, equal round with other bytes refused, higher proposer id at the same counter applies; identical replay re-acks regardless of expectation, but identical on some keys is partial state, not a replay.
• Properties on both backends (db::binding_properties, 5): all-or-none; 16 concurrent exchanges from one expectation → exactly one APPLIED, every loser told the winner's digest; rounds monotonic across the store; {A,B} vs {B,C} serialise on B; a record set survives reopening the store.
• Endpoint (3): CAS from empty / replay / stale / lower-round / supersede with both identity halves in body and header; the three storage-domain refusals are INVALID_STORAGE_ENCODING and write nothing; a node with no established incarnation answers 503 on both operations.
• CI: the Postgres job's count floor rises 13 → 18 and its filter includes db::binding_properties.

Mutation controls

Each restored on an identical tree stamp (git diff | shasum before/after).

mutation	named test red
expectation check can never refuse (compiling variant — the first if false attempt was a no-op because strict made the unused variable a compile error; redone)	a_first_writer_exchanges_from_the_empty_digest_and_a_stale_expectation_is_refused, an_exchange_applies_to_every_key_or_to_none
round rule disabled	a_round_never_moves_backwards
all-or-none broken on Postgres (apply only the first key)	an_exchange_applies_to_every_key_or_to_none (on Postgres)
incarnation stamp dropped from the CAS body	cas_applies_from_empty_re_acks_identical_and_refuses_stale_or_lower_round
key-set equality check disabled (core)	storage_domain_refusals_are_invalid_storage_encoding_and_write_nothing

One finding caught by the Postgres board itself, not by review: the advisory-lock parameter used hashtext($1::text), which tokio-postgres infers as text and cannot serialise a &[u8] into — every Postgres property failed while SQLite passed. Fixed by computing the lock id in Rust as an i64 from the key's leading eight bytes.

A second gap the gates closed, not review: the SQLite read_held row was typed
Option<(Vec<u8>, Vec<u8>, i64, Vec<u8>)>, which clippy::type_complexity rejects
under the node's #![deny(warnings)]. make lint runs clippy with default
features (strict,postgres), so the local-dev SQLite path never compiled there and
the lint passed. ci/production_safety_checks.sh runs clippy --workspace --all-features,
which woke that path and failed the gate. Factored into a type BindingRow alias; both
make lint and the --all-features safety gate are now exit 0. This is the
"enabling a previously-unenabled feature is a build-graph change" rule catching a lint,
not a bug.

Verification (Rust 1.98.0)

• root make lint — exit 0
• workspace board — 3989 passed, 0 failed (74 suites)
• node board (SQLite) — 299 passed, 0 failed (12 suites)
• node board (Postgres 14) — 269 passed, 0 failed (12 suites); the register-properties-executed floor of ≥ 18 is met
• ci_scan, no_clock_and_no_json, codegen_enforce, guard_protos, check_forbidden_symbols, production_safety_checks (incl. TLA+) — all exit 0

Not in this PR (by design)

Rounds are enforced here and driven in PR 2: no Class K driver, no safe-value recovery, no ABORTED/CONFLICT_FINAL, no fence, no durable INDETERMINATE, no client-side (member, incarnation) attribution on write acks (PR 4), and the settlement-slot register still exists (removed in PR 5). proposer_id is taken to be the Class K device id — stated as an assumption, override if you intend otherwise. The economic-root and faucet-ticket claim endpoints also parse claims at the node; §22 #12's wording reaches them, but they are separate registers and out of this program unless you say so.