revert: restore the settlement-version quote gate (re-apply #23)

[grumbach]

Linear issue

V2-975 — https://linear.app/autonominetwork/issue/V2-975/refuse-to-quote-clients-that-cannot-settle-correctly-instead-of

What this is

Re-applies #23 by reverting d56ef1b. #23 was pulled from the 2026-08-18 train
in #24 so the settlement-version set could land whole, rather than shipping the
wire vocabulary ahead of the node and client code that uses it. That was the
right call for that train. This puts it back for the next one.

Nothing landed between the #23 merge (af6a435) and the revert (d56ef1b), so
this is a clean re-application with no rebase: the resulting tree is
byte-identical to af6a435.

Why now

ant-node#204 and ant-client#171 both carry the same single remaining merge
blocker: they pin ant-protocol through a personal fork branch and need to
repin to a published registry release. That release cannot exist while the
protocol change is off main, and the two PRs cannot merge without it, so the
set is deadlocked until this lands.

Opened to unblock the release manager: this side is ready whenever the train is.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Same tier and same content as #23. This crate supplies the vocabulary and
enforces nothing, but the vocabulary is the wire contract.

Compatibility

• Wire: additive, no cutover. Two ChunkMessageBody variants and one ProtocolError variant are appended; every existing discriminant keeps its value and CHUNK_PROTOCOL_ID stays autonomi.ant.chunk.v1. A peer built against 2.3.x decodes current traffic unchanged and rejects the new variants as an unknown discriminant rather than misreading a variant it knows. Consequence to plan for: a client sending V2 gets no answer from a node on 2.3.x, so nodes must be upgraded before clients start sending V2. ant-client#171 handles the mixed fleet with a per-peer fallback.
• Storage: none. No stored-data format is touched.
• API: additive only. New public items are CURRENT_SETTLEMENT_VERSION, MIN_SUPPORTED_SETTLEMENT_VERSION, settlement_version_is_supported, client_update_required_message, ChunkQuoteRequestV2, MerkleCandidateQuoteRequestV2 and the two enum variants. Nothing is renamed, removed or retyped, and both enums were already #[non_exhaustive].

Semver impact

• breaking
• feature
• fix

No version bump is taken here; the release train owns that.

Test evidence

Run on this branch:

• cargo test --lib — 87 passed, 0 failed
• cargo test --lib chunk — 25 passed, 0 failed
• cargo clippy --all-targets --all-features -- -D warnings — clean
• cargo fmt --all — clean
• cargo doc --no-deps with RUSTDOCFLAGS="--deny=warnings" — clean
• Tree verified byte-identical to af6a435, the reviewed and approved feat(chunk): declare a settlement version on quote requests #23 merge

The discriminant regression test from #23 comes back with it:
appending_v2_variants_leaves_existing_discriminants_untouched pins the wire
byte for every existing variant (PutRequest 0, GetRequest 2, QuoteRequest
4, MerkleCandidateQuoteRequest 6, new variants 8 and 9), which is what the
incremental-rollout design rests on: postcard assigns discriminants by
declaration order, so inserting a variant anywhere but the end would make every
older peer silently misread every message from a newer one.

New dependency

none

ADR

ADR-0010: Settlement version and pre-payment compatibility (Proposed), carried on the ant-node branch:

https://github.com/grumbach/ant-node/blob/settlement-version-quote-gate/docs/adr/ADR-0010-settlement-version-and-pre-payment-compatibility.md

Note: ant-node#204 and ant-client#171 both cite this ADR at a
WithAutonomi/ant-node URL, which 404s — the branch only exists on the fork.
Worth correcting on those two PRs.

Mitigation / rollback

Revert this PR. It is a pure re-application of a known-good tree, and #24 already
demonstrated that dropping it returns main to the exact v2.3.2 tree with no
downstream fallout, because nothing on main consumes the new variants yet.
Until a node build ships that answers V2, the added vocabulary is inert.

Note for the reviewer

#23 was approved by @dirvine at head e979016 before it was merged. This branch
restores exactly that tree, so the prior review still applies to the content.

[grumbach]

CI note: Security Audit is red, but it is inherited from main, not introduced here.

The advisory is RUSTSEC-2026-0258 (h2 unbounded empty DATA frames, published 2026-08-17). main and this branch both resolve h2 0.4.15, and the h2 entry in Cargo.lock is untouched by this PR:

main   : h2 0.4.15
this PR: h2 0.4.15

Every other check is green: Clippy, Format, Documentation, Publish dry-run, Tests on ubuntu/macOS/no-default-features, plus linear-link and pr-template.

ant-node cleared the same advisory in WithAutonomi/ant-node#209 with a two-line Cargo.lock bump to h2 0.4.16. ant-protocol has not had that bump yet, so it will stay red here until it does. Happy to open the equivalent one-line PR for this repo if that is useful — I have deliberately kept it out of this one so the diff stays a pure re-application of #23 and the tree stays byte-identical to af6a435.

[dirvine]

APPROVE — reviewed exact head f2bf6e42547ef06bf6ab46acbc4941a5d3a1014d.

No material blockers found. The V2 request/refusal vocabulary is additive, existing postcard discriminants are pinned by regression tests, and the compatibility directions remain distinct. Local verification: formatting and all 87 library tests passed.

The Security Audit failure is inherited from main (h2, RUSTSEC-2026-0258), not introduced here. Release version bumps are intentionally left to the release owner.