Replace full-chunk audit responses with BLAKE3 verified slices

Cargo.toml

@@ -111,6 +111,7 @@ page_size = "0.6"
 
 # Protocol serialization
 postcard = { version = "1.1.3", features = ["use-std"] }
+bao = "0.13.1"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"

src/replication/commitment_state.rs

@@ -3,8 +3,9 @@
 //! Phase 2b of the v12 storage-bound audit design. Builds, signs, and
 //! caches a [`StorageCommitment`] over the responder's currently-stored
 //! key set; serves audit lookups by `expected_commitment_hash`; retains
-//! the previous commitment across one rotation so an audit pinned to it
-//! does not false-fail at the rotation boundary (v5/v12 §4 retention).
+//! recently-gossiped commitments for a bounded TTL window (with a slot
+//! backstop) so an audit pinned to a still-answerable commitment does not
+//! false-fail across rotations.
 //!
 //! Rotation strategy:
 //!
@@ -341,7 +342,7 @@ pub(crate) const GOSSIP_ANSWERABILITY_TTL: Duration = Duration::from_secs(3 * 36
 /// be slightly early. Adding this margin on reload guarantees an honest node
 /// never *under*-retains across a restart (it may over-retain by the margin,
 /// which is harmless — it only makes the responder answer a little longer, and a
-/// data-deleter still fails the round-2 byte challenge). Sized well above the
+/// data-deleter still fails the round-2 slice challenge). Sized well above the
 /// persist interval + gossip cadence, far below the TTL.
 const RESTART_STAMP_GRACE: Duration = Duration::from_secs(5 * 60);
 
@@ -588,11 +589,11 @@ impl ResponderCommitmentState {
 
     /// Whether `key` is committed under any retained slot (the current
     /// commitment plus any still-in-window gossiped ones) — i.e. whether a peer
-    /// could still pin a recently gossiped root and demand this key's bytes in a
-    /// round-2 byte challenge.
+    /// could still pin a recently gossiped root and open this key's blocks in a
+    /// round-2 slice challenge.
     ///
     /// This is the SAME predicate the round-2 responder uses to decide a key is
-    /// "committed" (`handle_subtree_byte_challenge` calls `built.proof_for(key)`
+    /// "committed" (`handle_subtree_slice_challenge` calls `built.proof_for(key)`
     /// on the pinned slot, which is committed iff `contains_key`), folded over
     /// every retained slot. The pruner consults it before deleting an
     /// out-of-range key, so "the pruner will not delete it" and "the responder