Mirror creates need an operator-scoped $DIG CAT coin selector

[MichaelTaylor3d]

Task

dig_mirror_coin::create takes its Vec<Cat> $DIG inputs from the caller, and this node has no way
to select them scoped to the operator puzzle hash. Until it does, the mirror lifecycle can
observe and reclaim but cannot create a bond — so a held (store, root) stays uncollateralised and
the node stays undiscoverable for that capsule.

Why the existing selector cannot be used

WalletBackend::select_cats selects from the node-custodied replica's own coin set
(db.unreserved_unspent_coins), not from the §16.4 operator wallet's coins. Funding a mirror coin
from those would be a real spend of the wrong wallet's money that looks entirely successful — so
NodeMirrorEffects::create refuses by name instead (crates/dig-node-service/src/mirror/lifecycle.rs),
the pass reports it in stopped_at, and §25.8 keeps reporting the bond as uncovered. That is true,
and it is the safe direction.

What is needed

A $DIG CAT coin selector over a dig_chainsource_interface::ChainSource, scoped to a given owner
puzzle hash: the unspent CAT coins at that owner under dig_mirror_coin::DIG_ASSET_ID, with their
lineage reconstructed from each creating spend so the resulting Cat values are spendable.

Note the asymmetry that makes this the hard half: a reclaim needs no coin selection at all —
dig_mirror_coin::reclaim is supported at fee = 0 with no fee coins, which is §25.4.4 and is
already implemented. Only creates need this.

Constraints

• The asset id is dig_mirror_coin::DIG_ASSET_ID; never re-derive it.
• Never hand-roll a spend bundle — dig-mirror-coin builds them.
• Selection must be reservation-aware, or one coin funds two in-flight bundles.
• A partial or unauthenticated selection must REFUSE rather than fund a smaller coin: a mirror coin
  below the epoch's requirement is collateral that is genuinely locked and does not satisfy the
  bond.

Parent

#412 ·
#377 ·
epic https://github.com/DIG-Network/dig_ecosystem/issues/3166

[MichaelTaylor3d]

Lane open — dig-node#421

• Branch loop/421-operator-cat-selector, based on loop/412-step7-observation (PR feat(mirror): construct the bond-state observation (#412 step 7) #419, not yet merged; it introduces the mirror/lifecycle.rs this changes). Draft PR feat(mirror): operator-scoped $DIG CAT coin selector for mirror creates (#421) #423.
• HEAD at the create-wiring commit.

DONE

• dig_wallet::sage::selection::select_largest_first — the largest-first algorithm extracted ONCE. Three rivals existed (rpc::select_cat_rows over DB rows, offers::select_cats over Cats, and this new one over chain records); the first two now call it, with byte-identical refusal messages.
• dig_node_service::mirror::funding — the operator-scoped selector. Scans ChainSource::coin_records_by_puzzle_hash at CatArgs::curry_tree_hash(DIG_ASSET_ID, operator_ph), filters out coins committed to in-flight bundles, selects largest-first, and authenticates each selected candidate by executing its creating spend through resolve_cat. Refuses the WHOLE selection on shortfall, unauthenticated candidate, unreadable chain, or unreadable audit record.
• Reservations come from the spend audit record: funding_coin_ids of any record where SpendStatus::is_terminal() is false. Durable across restarts, which a per-pass set is not.
• NodeMirrorEffects::create now selects and builds; reclaimed_coin_id reuses the one CAT derivation instead of its own curry.
• Probes: crates/dig-node-service/tests/mirror_operator_funding.rs (two funded wallets on one chain), unit tests in funding.rs and selection.rs.

IN PROGRESS — first full compile of the wired tree.

NEXT ACTION — read /tmp/b421b.log, fix compile errors, run cargo test -p dig-node-service --test mirror_operator_funding, then SPEC §25 + CHANGELOG + version bump.

REMAINING GAP after this lands — a create still refuses by name because this node has no configured advertised URL, and dig_mirror_coin::create refuses an advertisement with nowhere to fetch from. That is an advertisement question, not a funding one, and it needs its own ticket. Live broadcast is also still passed None at bring-up.

[MichaelTaylor3d]

Evidence — the probes are load-bearing, proved by mutation

Tree committed first, mutations applied to mirror/funding.rs alone, git checkout -- after each;
tree verified clean afterwards.

Green baseline (15b4465)

• tests/mirror_operator_funding.rs — 10 passed, 0 failed
• cargo test -p dig-node-service --lib mirror:: — 87 passed, 0 failed (the whole mirror module,
  so the NodeMirrorEffects change does not regress step 7)
• cargo test -p dig-wallet --lib sage::selection — 6 passed, 0 failed

M1 — dig_cat_puzzle_hash ignores its owner argument (wraps a constant instead)

2 passed; 8 failed. Including the_selector_funds_from_the_operator_wallet_and_never_from_the_replica.

The two survivors are honest and worth naming rather than hiding:

• a_chain_that_cannot_answer_is_unknown_rather_than_a_short_wallet never reads a puzzle hash.
• an_operator_with_no_coins_refuses_even_when_the_replica_is_rich expects have: 0, and a bogus
  scan hash also finds nothing. It is one-sided by construction, which is exactly why it is
  paired with the positive probe above — that one does fail. Neither alone is sufficient; the pair is.

M2 — the committed-coin filter removed (.filter(|_| true))

8 passed; 2 failed — and the two are precisely
a_committed_coin_is_withheld_and_the_uncommitted_one_is_taken and
a_reservation_that_makes_the_balance_short_refuses_rather_than_double_spending. Nothing else moved,
so the reservation probes test the reservation and not something adjacent.

A false green found and removed during the work

The first version of both reservation probes funded the operator with [REQUIRED, REQUIRED]. A coin
id is (parent, puzzle_hash, amount), so two children of one spend paying the same amount to the
same address are literally the same coin — the fixture published one coin while believing it had
published two, and committing "one of the two" committed both. It failed rather than passing falsely,
but only by luck of which direction it broke in. Chain::fund now asserts the ids are distinct,
so that collapse is a fixture failure rather than something a future test is left to notice.

[MichaelTaylor3d]

Follow-up filed: #426 — the advertised URL, which is now the last thing between a funded operator wallet and an actual create. Named in lifecycle.rs, server.rs and SPEC §25. PR #423 is ready for its gate round (still DRAFT).