The mirror lifecycle has no production broadcaster, so no reclaim can reach chain

[MichaelTaylor3d]

Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3166
Parent ticket: #412
Sibling: #421 (the create half's missing piece)
Related: #410 (the same class in the served WalletBackend)

The mirror lifecycle has a signer but no broadcaster, so no reclaim can reach chain

spawn_mirror_passes (crates/dig-node-service/src/server.rs) builds NodeMirrorEffects with
lifecycle::production_broadcaster(), which is None today. sign_and_broadcast refuses on that
None before it signs anything, so MirrorEffects::reclaim — the only half of the lifecycle that is
reachable at all, since create refuses pending #421 — cannot complete on a real node.

The reporting is honest about this as of PR #419: open_signer reports
SpendCapability::BroadcasterUnwired rather than Available, the bring-up log says the lifecycle
observes only, and the refusal names this ticket. A test asserts the capability and the broadcaster
cannot disagree. So this is a stated gap, not a silent one — but the gap is real and the lifecycle
cannot settle any money until it closes.

What closing it needs

ChiaQueryBroadcaster (crates/dig-wallet/src/sage/spend.rs:210) is the production implementation
and takes an Arc<chia_query::ChiaQuery>. The node's ChainTransport already holds one, but
ChainTransport::shared_client is pub(crate) to dig-wallet, so dig-node-service cannot reach
it. Closing this means deciding how that client is exposed — a ChainTransport::broadcaster()
constructor in dig-wallet is the smaller surface than making the client public, and it keeps the
"attaching a broadcaster turns on node-custodied sending" decision inside the crate that owns
DIG_WALLET_ENABLE_LIVE_BROADCAST (see the deliberate non-impl note at sage/chain.rs:578).

production_broadcaster() is the single seam to change: open_signer derives the reported
capability from it, and the scheduler passes the same value into the effects, so wiring it turns the
capability to Available and the reclaim path live in one edit.

Done when

• A real node with DIG_WALLET_ENABLE_LIVE_BROADCAST set reports SpendCapability::Available.
• A reclaim planned by a pass reaches the mempool on mainnet and is observed confirmed on a later
  pass (the TargetCoinId derived by reclaimed_coin_id appears on chain).
• The §25.4.4 zero-fee behaviour is unchanged: a reclaim not admitted under fee pressure is retried
  next pass rather than gated on selectable XCH.

[MichaelTaylor3d]

Two constraints from a duplicate (dig-node#425, closed as not planned) that are worth carrying here,
because both are easy to trip when wiring this:

1. ChainTransport can push but is DELIBERATELY not a Broadcaster — do not "restore" the impl.
crates/dig-wallet/src/sage/chain.rs has ChainTransport::push, and immediately below it:

DELIBERATELY NOT a Broadcaster (dig_ecosystem#2376 review). [...] An unused
impl Broadcaster for ChainTransport sat here and made a one-line .with_broadcaster(chain.clone())
compile, pass every test, and silently enable node-custodied sending on a default install.

So the mirror lifecycle needs a broadcaster of its own, scoped to mirror spends, that cannot become
the served WalletBackend's own-spend path as a side effect. ChiaQueryBroadcaster /
ConfirmingBroadcaster (sage/spend.rs) are the candidates.

2. The structural guard must still pass.
mirror/lifecycle.rs's no_signer_or_broadcaster_is_ever_installed_on_the_served_wallet_backend
asserts that neither lifecycle.rs, signer.rs nor server.rs contains .with_signer( or
.with_broadcaster(. Constructing a broadcaster FOR the lifecycle is fine; attaching one to the shared
backend is what the guard forbids, and that distinction is the whole point.

Ordering: there is nothing to reclaim until creates work (dig-node#421), because nothing has ever
been created — so this can land after #421 without stranding money. It must land before dig-node#377's
real-machine proof, whose second half is watching the collateral come back.

[MichaelTaylor3d]

This is now the KEYSTONE of the epic — measured 2026-08-30 against origin/main @ 8b53156

A read-only measurement of #410 and
#411 found that this one ticket is the single gate
making both of them vacuous. Recording it here so whoever picks this up knows what closing it turns on.

What is already wired behind this gate

The mirror signer is fully wired in production — that is no longer the gap #410 described:

server.rs:2136 → server.rs:2691 lifecycle::open_signer(…) → lifecycle.rs:552-568 opens the
§16.4 seed under the device key and returns Some(MirrorSigner::new(wallet)) → server.rs:2795 hands
signer_ref to NodeMirrorEffects.

And the spend record has a production writer that cannot be bypassed: MirrorSigner::sign returns
(SpendBundle, RecordedSpend) (signer.rs:166-170), and RecordedSpend is obtainable only from
SpendJournal::begin (spend_audit.rs:782). The mirror path structurally cannot sign without
journaling.

Both are inert solely because production_broadcaster() is a literal None at
lifecycle.rs:595-597. lifecycle.rs:225-231 refuses on it before signing, so journal.begin
is never reached.

Why the seam matters, and must not be broken when this is closed

production_broadcaster() is read by both the reported capability (lifecycle.rs:567) and the
effects the scheduler builds (server.rs:2800). That is deliberate: it makes it inexpressible for
the node to announce a capability its money path does not have. The previous Available log line was
reachable and false on every real node, which is why the seam exists.

Whatever wires the broadcaster must keep reading that single seam. Two call sites reading two
sources is the defect, re-created.

The obstacle, restated precisely

Wiring the real ChiaQueryBroadcaster needs ChainTransport::shared_client, which is pub(crate) to
dig-wallet. So it means widening another crate's public API and switching on unattended mainnet
spends. sage/chain.rs:578 records by name that a one-line .with_broadcaster(chain) once silently
enabled node-custodied sending on a default install.

Two independent safety facts worth having in view before that flip:

• config.rs:176/:242 — enable_live_broadcast defaults false, so a default install still stops
  at SpendCapability::BroadcastDisabled (lifecycle.rs:560) even with a broadcaster present.
• §908 binds absolutely: the node signs only from its own §16.4 operator wallet, never on a user's
  behalf. The mirror carve-out is scoped to mirror coins and nothing else.

What closing this turns on, at the same instant

• the automated-spend record has a production writer that can now fire — needs a real cycle to prove a row #411 stops being vacuous — control.spends.list starts returning real rows, and its acceptance
  (a real dign spends list row from a real cycle) becomes reachable.
• Reclaims become possible. Creates additionally need
  Mirror creates need an advertised URL this node can be fetched at #426 (server.rs:2792 still passes an empty
  advertised-URL Vec) — that gate is creates-only and does not block reclaims.
• Epic https://github.com/DIG-Network/dig_ecosystem/issues/3166's real bar — a bond created on chain
  and reclaimed on the next epoch, watched on a real machine — becomes attemptable.

Sequencing

Not dispatched yet, deliberately. lifecycle.rs is held right now by the #426 lane
(PR #430, wiring the advertised URLs). Two lanes on that file has cost this family a duplicated test,
a briefly-committed defect and a wholly duplicated PR in the last day. This starts when #430 merges.