the automated-spend record has a production writer that can now fire — needs a real cycle to prove a row

[MichaelTaylor3d]

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3166
Sibling of: #408
Found by: the #408 lane, during its blast-radius pass.

Nothing in production writes the automated-spend record

SpendJournal and SpendLog::append have no non-test caller anywhere in the workspace. Every
SpendIntent construction is in a test: crates/dig-node-service/src/spend_audit_cli.rs:310 (test
module) and crates/dig-node-service/tests/spend_audit_e2e.rs:36. control.rs and spend_audit_cli.rs
READ the record; nothing produces it. The mirror-coin collateral cycle — the producer the whole SPEC §23
section is written for — does not journal its spends.

Why this is a money lie and not a missing feature

control.spends.list on a real node therefore returns {"spends": [], "complete": true}, and by the
contract's own words that is an answer, not an absence:

spends: [] with complete: true means this node has moved no money unattended that matches the
filters.

So a node that IS signing mirror-coin spends automatically states, in the contract's sanctioned voice,
that it has moved no money unattended. That is worse than the #408 decode failure it sits beside: a
decode failure is loud on the client, whereas an empty page is silently reassuring, and the contract
went to deliberate lengths (complete, unreadable_lines, SpendAuditUnreadable) to make "nothing to
report" distinguishable from "I could not look" — a distinction this bypasses entirely, because the node
genuinely did look at a file nobody writes.

This is the accountability half of the §908 carve-out. The node signs mirror-coin spends without
per-spend approval because the record is readable afterwards. Today it is readable and empty.

Acceptance

The mirror-coin collateral cycle journals through SpendJournal — begin before it is permitted to
sign, and the terminal outcome written as a new revision — so a node that has collateralised a store
shows that spend in control.spends.list. Proven end to end rather than by unit test: a node that
performs the cycle, then a dign spends list that shows the row.

Note the ordering dependency: #408 fixes the SHAPE of the response and must land regardless, but this
ticket is what gives that shape anything to carry. dig-app#289 will otherwise land against a tab that
decodes correctly and renders nothing.

[MichaelTaylor3d]

Paired with #410 — these are two halves of one hole

Verified independently: SpendJournal::new appears only in crates/dig-node-service/tests/spend_audit_e2e.rs (lines 61, 129, 176). No production constructor anywhere in the workspace.

Found the same day, in the same shape:

	the unwired thing	consequence
#410	no WalletSigner in production — every with_signer call site is inside #[cfg(test)]	nothing can sign
this ticket	no SpendJournal in production	nothing is recorded

Together they make the §908 carve-out's accountability bargain structurally unavailable: the node is permitted to sign automatically because the record is readable afterwards, and today neither half exists outside tests.

They are consistent rather than contradictory — nothing signs, so there is nothing to journal — but they must be fixed together or in the right order. Wiring the signer without the journal produces exactly the state this contract exists to prevent: unattended spends with no record.

The mirror lane already fixes both, by construction

#377 locked spec requires sign(&MirrorSpends, &RecordedSpend), and a RecordedSpend can only be obtained from SpendJournal::begin. Recording is the shape of the call, so the mirror lifecycle cannot sign without journaling — the type system enforces it rather than a convention.

So for the mirror path these close together. What that does not cover is tipping, which would still be unaudited if it were wired on its own. Whoever wires a signer for any other spender inherits this ticket.

[MichaelTaylor3d]

Verdict: VACUOUSLY SATISFIED — measured against origin/main @ 8b53156, 2026-08-30

A production writer now exists and is reachable by construction. It cannot fire on this build, so the
empty page control.spends.list returns is currently true.

The writer, on the production path

• crates/dig-node-service/src/mirror/signer.rs:183 — journal.begin(spends.intent()) inside
  MirrorSigner::sign, which is not test code (#[cfg(test)] starts at signer.rs:207).
• Called from lifecycle.rs:233-235, journal supplied from production at server.rs:2735
  (lifecycle::journal() → lifecycle.rs:668 → SpendLog::in_state_dir()) — the same machine-wide
  log control.spends.list reads.
• The structural guarantee this ticket asked for holds: sign returns
  (SpendBundle, RecordedSpend) (signer.rs:166-170), and RecordedSpend is obtainable only
  from SpendJournal::begin (spend_audit.rs:782, :645-653). The mirror path cannot sign without
  journaling — it is the shape of the call, not a convention.
• 8b53156b additionally made journal.submitted fire unconditionally on a broadcast that reached
  the mempool (lifecycle.rs:289-292), with funding ids read from the signed bundle
  (lifecycle.rs:239-243) and intended_coin_id left Optional so a create records its consumed
  coins rather than discarding them.

Why it is vacuous, not live

lifecycle.rs:225 refuses on the missing broadcaster before lifecycle.rs:233 signs — deliberately,
so a refused spend leaves no pending entry. production_broadcaster() is a literal None
(lifecycle.rs:595-597), which is #424.

Every other journal.begin call site in the workspace is inside #[cfg(test)] — funding.rs:371-521
(after :273) and runner.rs:951-1014 (after :444). Verified by grep across origin/main, not from
a PR report.

What is now false in this ticket's body

The headline says "a node that is spending". main cannot reach that state. The writer is not
missing; its trigger is.

Disposition — reword and keep, do NOT close and do NOT work

• Nothing is left to build in this repo. The writer is correct and complete.
• Do not close it either: the acceptance bar is a real dign spends list row from a real cycle, and
  that is unreachable on this build.
• It resolves the instant The mirror lifecycle has no production broadcaster, so no reclaim can reach chain #424 closes — that single seam (lifecycle.rs:595) is read by both the
  reported capability (lifecycle.rs:567) and the effects the scheduler builds (server.rs:2800), so
  the node's claim and the money path cannot disagree.

#426 is NOT a second gate here. It gates creates only (server.rs:2792 passes an empty Vec)
and does not gate reclaims, so it is not a precondition for this writer firing. server.rs:2787-2791
says so at the site.

This stops being a harmless vacuity if a signer is ever wired for a spender that bypasses
MirrorSigner — exactly the residue flagged on this ticket earlier, and exactly what
#410's half B is.