fix(pointer): serve the record round 1 bound, however many updates follow

[grumbach]

Two paid updates to a pointer between the two rounds of a storage audit made an honest holder fail round 2 with DigestMismatch, a confirmed failure that feeds the trust penalty. ADR-0016 accepted that case. This PR closes it, and records the change in a new ADR-0019 rather than editing ADR-0016.

Round 1 reports, for each pointer leaf, a nonced root over the record the node holds. Round 2 has to serve the bytes that reproduce it. The node kept only the record the last update replaced, so after two updates neither the record held nor the one kept was the one round 1 read.

Now:

• the single-use round-1 session keeps the root round 1 reported for each pointer it proved, capped across all live sessions at 65,536 roots (4 MiB of payload). A round 1 whose roots would not fit is answered Transient instead of proved, which puts it in the auditor's timeout lane with no trust penalty, and no live session ever gives its roots up;
• the pointer store keeps every record an update replaces, not only the last one, for ten minutes instead of five, which outlasts a round 1 over the largest subtree an auditor waits for plus the session its round 2 must arrive within, with the default configuration. It keeps the replaced record before the new one becomes visible, evicts to the unchanged 2,048-record cap only once an update has succeeded, and drops records past the ten minutes at each prune pass even when no update comes;
• round 2 serves the one record, held or replaced, whose root matches;
• when it cannot, because the record aged out or was evicted, round 2 is rejected as Transient. That is the auditor's timeout lane: no trust penalty, but the auditor forgets the holder's standing as a proven holder for the whole pinned commitment until it passes again. A node that no longer holds the pointer is reported absent, a confirmed failure as before, whatever replaced records it still keeps in memory.

The auditor, the wire format and the subtree-audit protocol id are unchanged.

Linear issue

Closes V2-1363

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Compatibility

• Wire: none. A round-2 pointer item now carries exactly one record, which every auditor accepts; the cap stays two.
• Storage: none. Replaced records and round-1 roots live in memory only, as before.
• API: additive. PointerStore::superseded still returns the newest replaced record, and superseded_all returns every one kept, newest first. handle_subtree_slice_challenge_with_pointers keeps its signature and serves pointers as before, the record held and the newest one replaced, except that a pointer no longer held is now absent; the engine uses the new handle_subtree_slice_challenge_with_pointer_bindings. PointerStore::drop_expired_superseded is new. PointerBindings and pointer_bindings are new.

Semver impact

• breaking
• feature
• fix

Test evidence

• Rebased on 2026-10-02 onto main at 56b5770 (0.21.0, with main's Rust 1.99 lint updates), with no conflicts: the eight reviewed commits are unchanged. One commit is added. Rust 1.99's new pedantic assert_is_empty lint flagged one assertion in a test this PR adds, which failed CI's clippy job on that main, so the assertion now prints the value on failure, as main did for its own tests. At head 3a36d2c, locally on macOS with Rust 1.99.0: cargo test --lib --features test-utils 1,241 passed; cargo test --lib --no-default-features 1,196 passed; pointer_convergence 15; the e2e pointer and subtree-audit tests, 18, passed over QUIC; poc_commitment_audit_attacks 19 and poc_audit_handler_live 16; cargo clippy --all-targets --all-features -- -D warnings, cargo fmt --check, cargo doc with -D warnings and scripts/adr-governance.py against main all clean. The full CI matrix runs on this head. feat(pointer): keep the first final state, and look before taking one #239 merges this head, and its combined run is listed there.
• Reproduced first on main at 4f78154: several_updates_between_the_rounds_do_not_fail_an_honest_holder (three paid updates between the rounds, judged by the auditor's own verify_slice_response) returned Fail(DigestMismatch). It passes with this change, and asserts round 2 serves exactly the record round 1 read.
• Over the wire: round_two_serves_the_record_round_one_read_across_several_updates (e2e) sends round 1 and round 2 by hand over QUIC to a live node's engine, with three updates to every opened pointer in between. It passes with this change and fails when the engine stops handing round 1's roots to the session, which I checked by making that one-line mutation and running it.
• New unit tests: a bound record no longer held is Transient while the pointer is held and KeyAbsent once it is not; a missing root is Transient, updated or not; round 1 binds exactly its pointer leaves; a session over the roots budget is refused and no opened session loses its roots or its place, even with the session cap full; the store evicts the globally oldest replaced record, and a record kept for an update that then fails costs no other record; retention outlasts the slowest audit, computed from the default config and the largest legal subtree; the earlier entry point still serves an unchanged pointer, and across one update the record held then the one it replaced, and passes the auditor; a pointer lost after an update is absent through either entry point, however many replaced records remain; expired replaced records go without another update. Each of these new tests fails when its fix is reverted, which I checked.
• Before the rebase, every test step CI runs, locally on macOS at bee7859: cargo test --lib --features test-utils 1,241 passed; e2e 111 passed, 3 ignored as on main; migration_reclaims_disk 2 (run alone: it measures free space on the whole filesystem, and failed once when another build was writing to the same disk), migration_crash_safety 5, migration_shared_volume 5, storage_scale 2, webrtc_direct_devnet 3, poc_commitment_audit_attacks 19, poc_audit_handler_live 16, poc_bootstrap_stall 3, poc_shutdown_lmdb_drain 1, and pointer_convergence 15, all passing.
• cargo clippy --all-targets --all-features -- -D warnings, cargo fmt --check, cargo doc with --deny=warnings, and scripts/adr-governance.py pass.
• Dev testnet: not run. That gate is the release manager's call.

New dependency

none

ADR

https://github.com/grumbach/ant-node/blob/fix/pointer-audit-retention/docs/adr/ADR-0019-pointer-audits-serve-the-record-round-one-bound.md

Mitigation / rollback

Revert. Nothing is persisted, so a node running the previous code simply serves pointers as ADR-0016 describes again.

[dirvine]

Review: approve

Reviewed exact head bee7859ada404fe152e57e3d7975b21286a20a94.

No introduced blocking defect found in the parent review, independent code-review seat, or independent OpenRouter GLM-5.2 seat. Checked round-1 bindings, multiple replacements, lost-pointer versus unavailable-root classification, expiry, failed-rename rollback, and memory/session budgets against ADR-0019.

Evidence: locally executed cargo test --locked --lib pointer --features test-utils: 85 passed, 0 failed. The first cold-build attempt timed out; the completed rerun is the result quoted here. Independently inspected Linux CI logs: 111 e2e passed (3 ignored), 19 audit attack PoCs passed, 16 live audit-handler tests passed. All reported CI checks are green.

Panel qualification: GLM returned APPROVE-WITH-CONCERNS for style/maintenance observations, not correctness blockers; these do not warrant a change request. Memory pressure can deliberately turn an audit into Transient rather than penalising an honest holder, as the ADR documents.

Integration caveat: #238 and #240 merge cleanly at Git level, but I have not run the combined tree or a deployed testnet. Re-run combined audit/repair coverage before rollout. This code review is not production-rollout or ADR-acceptance sign-off.