fix(wallet): adopt the published phase contract and split the two empty-set states

[MichaelTaylor3d]

Fix-forward for dig_ecosystem#2609. Both gates have returned — see "Gate record" at the bottom.

Scope, stated plainly: this is a PARTIAL fix, and it does not close dig_ecosystem#2666.
It removes the {phase: synced, watched_addresses: 0} lie from the post-restart path, which is
the most commonly reached one. It does not remove it from every path — a REFUSED writer
(session_may_write == false) skips the empty-set arm and still reaches Synced beside a
measured zero watched set. #2666 stays OPEN after this merges, banded MVP. Do not read this PR
as "the node can no longer report synced while watching nothing."

Why this exists

v0.113.0 was merged from 1c40fc9 — the exact commit the pre-merge security gate FAILED — and released. It emits a phase token the published contract never declared.

WalletSyncPhase at dnci 0.10.0 is a closed three-variant Deserialize enum: no serde(other), no non_exhaustive. An unknown token therefore fails the entire WalletSyncStatusResult parse, not one field. A consumer pinned to 0.10 loses its sync read completely against a 0.113.0 node — strictly worse than the bug it replaced. 0.111.0 says something wrong; 0.113.0 says nothing.

The stable feed still serves 0.111.0 (verified against the live manifest), so auto-updating installs are unaffected. Nothing should promote 0.113.0.

What changed

dnci pin	0.10 → 0.11 (published, with an Unrecognized fallback so this class cannot recur)
no_addresses_to_watch	deleted — it never existed in the contract
new tokens	no_wallet_enrolled, wallet_not_unlocked
new fact	PuzzleHashSource::any_wallet()
version	0.114.0

The two states are not one state

The second gating finding. WalletCustody::custodied_public_keys() is empty by design for an ENROLLED wallet in four reachable cases — an adopted legacy seed, a manifest predating the stored-public-keys field, a self-healed manifest, and an entry whose key fails to decode — and nothing back-fills it while locked, which is the state after every restart.

So watched == Some(0) alone cannot tell nothing to do from something to do that is not being done:

• !any_wallet() → no_wallet_enrolled — the honest all-clear; a consumer MAY present it as settled.
• any_wallet() → wallet_not_unlocked — the user's coins are NOT being followed; a consumer MUST NOT render it as settled or present a balance under it as complete.

any_wallet() reads custody's manifest, deliberately not the derivable key set — the key set is exactly the thing that is empty in the case being detected.

The gate that was missing, and now exists

dig-node referenced WalletSyncPhasenowhere. The only coupling to the contract was a hand-typed token list in tests/server.rs, and the 0.113.0 diff widened it from three tokens to four — so CI agreed with the bug and went green.

Two guards replace it:

1. That assertion now derives from WalletSyncPhase::ALL.
2. every_phase_the_node_can_emit_is_declared_by_the_published_contract — compares SyncPhase::ALL against the contract's ALL. No server, no fixture, so it holds for phases nothing can reach. Subset, not equality: a consumer may be ahead of a node, but a node MUST NOT emit an undeclared token.
3. as_wire_matches_the_serialized_token_for_every_phase pins as_wire to serde, so the conformance test cannot be checking a fiction.

Verification

Mutation-verified, not just green:

• Collapsing the two empty-set states back into one all-clear → 2 tests red (an_enrolled_wallet_with_no_derivable_addresses_is_not_an_all_clear, a_locked_wallet_reaches_wallet_not_unlocked_through_the_supervisor).
• watched == Some(0) → unwrap_or(0) == 0 → red (carried forward from the earlier round).

cargo test -p dig-wallet --lib sync_supervisor: 34 passed, 0 failed. Every #2568 quorum test still green.

Real-machine before/after is posted as a comment.

Not fixed here, deliberately

rpc.rs:3633-3645 still computes SyncLifecycle from initial_sync_complete alone — the same defect on the /ws wire. Filed as #2628 rather than folded in, because two different SyncLifecycle enums exist (dig-wallet/src/sage/events.rs:57 with Syncing/Synced/Disconnected, and the published dig-events-protocol/src/sync.rs:11 with Idle/Syncing/Synced). Extending the wrong closed enum is precisely how this incident happened; that decision deserves its own unit of work. #2609 stays open until both surfaces are honest.

What remains open after this merges

dig_ecosystem#2666 — a refused writer still reports synced while watching nothing. Banded MVP,
stays open. Arm 2 requires session_may_write, so a refused writer falls through to Synced with a
measured zero watched set, through the PeerTrust::Discovered door. Probed directly:

set_trust(false) set_watched(0, enrolled=true) initial_sync_complete=true
=> phase=Synced watched=Some(0) peers=1

This is pre-existing, not introduced here, and this PR strictly shrinks the set of states that can
tell that lie. Reachability is real and needs no attacker: a fresh node was measured sitting
uncorroborated for 400+ seconds with peak_height null throughout, while the installed node
corroborated within the same minutes and a later fresh run corroborated in ~30 seconds. So the
sequence is enroll → unlock → catch up → restart → corroboration lags → the node reports synced
while frozen and falling behind.

dig_ecosystem#2648 chains with it and is also still open.connect_random_peer unconditionally
prepends loopback and chia-query's pool does not dedupe, so a co-resident process can hold the pool
and make corroboration fail deliberately and indefinitely — converting the timing window above
into a controllable one. The two tickets are one attack when chained.

Gate record

• Correctness gate: PASS — all three probes re-run.
• Security gate: PASS at 22c294bd, with one required correction, applied in 4092e78c: three
  comments overstated the fix's reach (sync_supervisor.rs claimed a completed catch-up can never
  speak for a session watching nothing; the tests.rs acceptance bar implied more than it pins;
  control.rs credited the measured zero as a discriminator it is not). 22c294bd..4092e78c is
  doc-only — zero non-comment lines — so the code verdict carries forward unchanged.

Draft status alone did not prevent the previous merge — tracked as #2627. This PR was held DRAFT
until both verdicts were in hand, and undrafted immediately before merge.

[MichaelTaylor3d]

Real-machine verification — 0.114.0

Both nodes on one box, same chain, same minute. No wallet is enrolled here, so
no_wallet_enrolled is the expected phase and is what it reports.

BEFORE — installed dign 0.111.0:

{"phase":"syncing","peak_height":9132747,"chia_peer_count":1}

AFTER — this branch, dign 0.114.0:

{"phase":"no_wallet_enrolled","peak_height":9132741,"chia_peer_count":1,"watched_addresses":0}

Advancing under the new phase, so this is a live replica and not a latched snapshot — four
consecutive samples: 9132741 → 9132742 → 9132745 → 9132746.

The token is the CONTRACT's

no_wallet_enrolled is a member of WalletSyncPhase::ALL in dig-node-control-interface 0.11. The
v0.113.0 token no_addresses_to_watch appears nowhere in this build.

The invariant, read straight out of the DB

peak=9132747 initial_sync_complete=0

Still 0. The phase settles without latching the flag that would flip §18.7 routing to
Source::Db and read a funded wallet as empty.

What this run does NOT prove

wallet_not_unlocked is not exercised here — this box has no wallet enrolled, and enrolling one
would mean handling seed material, which is out of scope for a verification run. That path is
covered by an_enrolled_wallet_with_no_derivable_addresses_is_not_an_all_clear (handle level, one
bool different from the passing no-wallet case) and
a_locked_wallet_reaches_wallet_not_unlocked_through_the_supervisor (through the real supervisor
loop, from custody's own answer). Both are mutation-verified: collapsing the two states back into a
single all-clear turns both red. Saying so explicitly because "verified on the real machine" would
otherwise imply more than the run actually covered.

Live node untouched

The installed service was never stopped and its binaries were never swapped — the new build ran
standalone on its own port and state dir. dign 0.111.0 still installed and syncing; the test
process has been stopped.

[MichaelTaylor3d]

CORRECTNESS GATE: CHANGES-REQUIRED at head 8caa3d41b7ca39a433375ab667419b9954330b26.

The core of this fix is right: the ladder maps correctly, the two empty-set states are genuinely separated (I independently mutation-verified the collapse - an_enrolled_wallet_with_no_derivable_addresses_is_not_an_all_clear and a_locked_wallet_reaches_wallet_not_unlocked_through_the_supervisor both go RED), the doubles are expressive (FixedHashes carries enrolled independently of the set, so WalletNotUnlocked is representable), as_wire is pinned to serde, the dnci 0.11 contract does declare both new tokens plus Unrecognized, the #2568 quorum tests are untouched and green (34/34), SPEC 18.6b is structurally intact (exactly one 18.6b., the two distinct 18.6c. sections at 3806 and 3992, a single contiguous hunk - the restore was clean), and every required check is green with zero unresolved threads.

Three findings block. Two are exactly the #2609 shape - a guard whose PRODUCTION wiring nothing exercises, and a hand-maintained list standing in for a compile-time fact.

1. MAJOR - the production any_wallet() sourcing is UNVERIFIED. I replaced WalletCustodys impl with the precise wrong implementation the docs warn against and 456/456 dig-wallet lib tests stayed green.
2. MAJOR - SyncPhase::ALL is hand-maintained; I added a variant to the enum and to as_wire but not to ALL, and both conformance guards stayed green.
3. MAJOR - Synced outranks WalletNotUnlocked, and initial_sync_complete is persistent, so the state both the code doc and the SPEC call the COMMON state after every restart reports synced on the main path.

Detail inline. Nothing handed to Copilot except the minor doc sweep: (1) and (2) are test/gate-integrity judgement calls and (3) is a state-machine plus SPEC decision.

---

NON-GATING (minor), posted here because the file is not in the diff so it cannot be anchored inline:

NON-GATING (minor) - stale after the rename: this still names SyncPhase::NoAddressesToWatch, a variant that no longer exists. Same sweep: crates/dig-wallet/src/sage/sync_supervisor/tests.rs:842 is still called phase_is_no_addresses_to_watch_when_custody_is_empty_on_a_writing_peer while asserting NoWalletEnrolled.

@copilot fix this: in DEVELOPMENT_LOG.md line 26 replace SyncPhase::NoAddressesToWatch with SyncPhase::NoWalletEnrolled, and rename the test function at crates/dig-wallet/src/sage/sync_supervisor/tests.rs:842 to phase_is_no_wallet_enrolled_when_custody_is_empty_on_a_writing_peer. Rename only - do NOT change any assertion, fixture, or the set_watched(0, false) argument.

[Copilot]

CORRECTNESS GATE: CHANGES-REQUIRED at head 8caa3d41b7ca39a433375ab667419b9954330b26.

The core of this fix is right: the ladder maps correctly, the two empty-set states are genuinely separated (...

Done in the latest commit. DEVELOPMENT_LOG.md:26 now reads SyncPhase::NoWalletEnrolled, and the test at line 842 is renamed to phase_is_no_wallet_enrolled_when_custody_is_empty_on_a_writing_peer — no assertions, fixtures, or set_watched arguments touched. 34/34 sync_supervisor tests pass.

[MichaelTaylor3d]

PASS (correctness re-gate) — head 22c294b

All three prior MAJOR findings verified addressed by execution, not by claim. Probes run in an isolated worktree (all reverted; tree clean):

1. Finding 1 — any_wallet() sourcing. Rewrote production WalletCustody::any_wallet (crates/dig-wallet/src/sage/custody.rs:254) to !puzzle_hashes().is_empty(). production_any_wallet_reads_the_manifest_not_the_derivable_keys → FAILED at sync_supervisor/tests.rs:958. The test discriminates the property (enrollment source), not an outcome.
2. Finding 2 / security F1 — ALL untied to the enum. The bypass is now unrepresentable: SyncPhase is emitted only by declare_sync_phases! (sync_supervisor.rs:98-127), which derives the enum, ALL and as_wire from one list, so there is no path to declare a variant outside it and no way to give a variant an as_wire arm while omitting it from ALL. Constructive probe: added Bogus => "bogus" to the invocation → every_phase_the_node_can_emit_is_declared_by_the_published_contractFAILED. My original probe is now structurally foreclosed.
3. Finding 3 — arm ordering. Moved the Synced arm back above the empty-set arm → a_previously_synced_wallet_restarted_locked_is_not_reported_as_syncedFAILED; its control a_completed_catch_up_still_reports_synced_while_watching_addresses stayed green. Both directions proven.

Reorder blast radius (the risky change). The empty-set arm's predicate is peers >= 1 && session_may_write && watched == Some(0). Its intersection with the old Synced predicate (initial_sync_complete && peers >= 1) is exactly the latched + attached + writable + measured-zero case. So watched == None (unmeasured) and session_may_write == false are untouched — they never entered the new arm — and the only behaviour change is the defect case plus the semantically identical "legitimately became empty after a successful sync", which is the same falsehood and correctly no longer reports Synced. No state lost Synced that should have kept it.

4. Security F2. The is_open_control_read rationale now attributes the disclosure to the enrollment bit rather than the count, and states the DIG_NODE_ALLOW_REMOTE caveat. Accurate against the code.
5. Copilot 41845d4.NoAddressesToWatch has zero occurrences repo-wide; the rename survived the rebase.

Readability. The macro is module-private, single-invocation, defined immediately above its use, forwards per-variant doc metas so the full doc surface survives in rustdoc, and its own doc-comment states why it exists. Right scope; nothing a reader needs is obscured.

Gates. All five required contexts asserted BY NAME: SUCCESS (incl. Test + coverage). Unresolved review threads: 0. mergeStateStatus=CLEAN. PR is still draft — correct, per §2.4a; undraft only once the sibling gate verdict is in.

Non-gating observation (no thread opened, not a blocker): with session_may_write == false and a latched flag, a refused writer still reports Synced. Pre-existing, unchanged by this diff, and outside this PR's scope.